August 29, 2024

Telegram’s CEO Pavel Durov was arrested by French police as he landed at a French airport in northern Paris on Aug 25, 2024, which was first reported by the BBC. Reporting indicated that he was arrested in relation to the messaging app, although it was initially unclear what the exact offense was. Early reports stated it was due to a “lack of moderation [and] failing to take steps to curb criminal used of Telegram.”

Figure 1: Pavel Durov; Source: BBC

Durov is a 39 year old Russian National who also holds citizenship in France, the UAE, and St Kitts. He founded the messaging app Telegram in 2013 after previously founding and creating the popular Russian social media app VK. Telegram has 950 million registered users worldwide. 

Telegram has long been criticized by law enforcement and security analysts for hosting extremist content, CSAM material, and other illicit content. It is renowned for not cooperating with law enforcement and has only been known to take action against ISIS affiliated channels in response to the terror attacks in France in 2015 – only after pressure – Durov had previously stated “IS would simply find another app if kicked off his, I don’t think we should feel guilty about this.”

However, further reporting did indicate that they were taking steps to remove Indonesian terrorist groups from the platform, but this was in response to the Indonesian authorities limiting the access to the app and threatening a total ban.  

Figure 2: Chat about history of Telegram; Source: DarkOwl Vision

Channels can be found on Telegram that sell illicit goods, share extremist rhetoric, and conduct financial fraud. 

More recently, the messaging app has been pivotal in both the war in Russia and Ukraine and the conflict between Hamas and Israel, with the app being used to spread propaganda, as a source of news as well as a hotspot for hacktivists and cyber attacks. Many argue it had been weaponized to share violent images, disinformation, and false narratives. 

After his arrest at Le Bourget Airport, flying from Azerbaijan, Durov was held for four days before appearing in court 28 August. Scant reporting/conspiracy theories have begun to circulate that Durov only flew to France at the invitation of President Macron.  

Durov was released from court and officially “placed under formal investigation as part of a probe into organized crime on the messaging app.”  Durov was required to pay 5 million euros to the French government, cannot leave French territory, and must visit a police station two times a week until the investigation concludes.

Durov’s arrest has received widespread criticism from Elon Musk, Edward Snowden, and the Russian Foreign Ministry as an attack on human rights and freedom of speech. Snowden called it “an assault on the basic human rights of speech and association.”

It does appear to be unprecedented for law enforcement to take action against the owner/founder of a social media platform and hold them accountable for what is posted by others on the site.  

Yesterday (28 August) it was reported that Telegram has repeatedly ignored outreach from the National Centre for Missing and Exploited Children (NCMEC) and the Internet Watch Foundation (IWF), who are dedicated to stopping the spread of CSAM (Child Sexual Abuse Material). Without joining these groups, they are not able to proactively identify and remove previously identified CSAM material.  

Other social media platforms like SnapChat, Facebook, Instagram, Threads, TikTok, Pornhub, and OnlyFans are all members of these organizations.

Yet, there is no legal obligation to join NCMEC for organizations outside of the US, although one could definitely argue a moral obligation. Telegram, along with Durov, is based in Dubai.  

Telegram continues to assert that they proactively moderate harmful content on the platform including child abuse material. The company insists that its moderation is “within industry standards and constantly improving.”

However, it does seem that Telegram’s continued reluctance to engage with law enforcement or other regulators to reduce the amount of illicit material on the site is the reason for the arrest.  

DarkOwl analysts located a copy of Durov’s official arrest record, the below highlights the charges against him. 

• Complicity – Administration of an online platform to allow an illegal transaction in an organized band, 

• Refusal to communicate, at the request of the authorized authorities, the information or documents necessary for the realization and exploitation of interceptions authorized by law, 

•  Complicity – Detention of the image of a minor of a child-pornographic nature, 

• Complicity – Dissemination, offer or making available in an organized tape of images of a minor of a pornographic nature, 

• Complicity – Acquisition, transport, holding, offer or disposal of narcotic products, 

• Complicity – Offer, assignment or making available without legitimate reason of equipment, an instrument, a program or data designed or adapted for the attack and access to the operation of an automated data processing system, 

• Complicity – Organized gang scam, 

• Association of criminals with a view to committing a crime or offence punishable by 5 years of imprisonment at least, 

• Money laundering of crimes or offences in organized gangs, 

• Provision of cryptology services to ensure confidentiality functions without a declaration of conformity, 

• Provision of a cryptological means not exclusively ensuring authentication or integrity control functions without prior declaration, 

• Import of a cryptology means that does not exclusively perform authentication or integrity control functions without prior declaration. 

Figures 7-10: Screenshots taken by DarkOwl analysts of Durov’s arrest record

It is clear from the levelled charges that Durov is being held accountable for supplying the means for criminals to communicate and operate on his platform, for the encryption the site provides and a lack of cooperation with law enforcement.  

Darknet Reactions 

Response on Telegram to the arrest has been swift. With most of the posts identified questioning why the arrest was made and asserting probably conspiracy theories about who was involved and what ties Telegram has.  

DarkOwl identified over 1300 mentions of Durov’s arrest. The bulk of the Telegram channels commenting on the arrest with negativity appeared to be primarily from right wing leaning political extremist channels. Some of the channel names that expressed outrage towards Durov’s arrest: 

• The Patriot Voice 

• God Wins! 

• QANON+ 

• Greek Trump Supporters 

Figure 11: Vision results for mention of Durov’s arrest; DarkOwl Vision

One user on another right wing leaning political extremist channel shared a link to a Russia Today article that focused on Elon Musk’s response to Durov’s arrest and the coinciding rise in popularity of the hashtag #FreePavel: 

Figure 12: Users share Elon Musk response to arrest; Source: DarkOwl Vision

Other channels have discussed the theory that as a result of the arrest, Telegram will be removed from at Apple App store and from individual’s devices. The post gave users instructions on how to prevent that from happening.  

Figure 13: Telegram Channel Massachusetts Unified 

Further chatter was identified which pondered why Telegram had been targeted for using encryption techniques when other messaging apps used the same.  

Figure 14: Source: DarkOwl Vision

Others commented that Durov was not arrested but kidnapped and that Telegram was to be muzzled.  

Figure 15: Source: DarkOwl Vision

Other posts indicate that Telegram is connected to the Deep State, run by the CIA and wondered if Elon Musk would be targeted next and if the Biden administration was involved in the arrest. 

Figure 16: Source: DarkOwl Vision

Unsurprisingly, given the nature of our collection efforts, targeting illicit activities, extremists and fraud, we did not find many posts which were supportive of the arrest within our data.  

Conclusion 

The arrest of Durov has cause debate among many regarding freedom of speech, responsibility of CEOs of social media platforms and their perceived requirement to cooperate with law enforcement requests and remove harmful or illegal material. This debate is likely to continue as the investigation into Durov continues.  

Many users on Telegram and other dark web sites have shown support for Durov, although much of the rhetoric seems to target the state and provides little evidence for the views.  

Whatever the outcome of the investigation, this will have ramifications for privacy, security, social media, and the individuals responsible for them. It is still yet to be decided what impact if any the arrest will have on the operations of Telegram going forward. It is unlikely that a platform as large with so many users could be removed but remains to be seen if they will change their stance on helping law enforcement and other organizations to crack down on illicit activities. What is likely is that no more Telegram members of staff will be traveling to Europe any time soon! 

---

Stay up to date with DarkOwl. Follow Us on LinkedIn.