Telegram expands cooperation with authorities beyond the scope of terrorism

Instant messaging service Telegram updated its Privacy Policy and Terms of Service to deter from using its platform for illegal activities. The changes allow Telegram to disclose the IP addresses and phone numbers of users following a valid order “from the relevant judicial authorities that confirms you’re a suspect in a case involving criminal activities that violate the Telegram Terms of Service”.

Previously, Telegram’s policy stated that it may disclose such information only if it received a “court order that confirms [the user was] a terror suspect”. The updated policy broadens the scope far beyond terrorism. The updated Terms of Service now list as forbidden “activities that are recognized as illegal in the majority of countries”, and cites as example child abuse and the selling or offering of illegal goods and services such as drugs, firearms, and forged documents. The phrasing leaves significant room for further activities, as the updated text closes the list with “etc”.

These updates were announced by CEO Pavel Durov on his Telegram channel, emphasizing efforts to make Telegram Search safer by preventing the platform from being used to promote illegal goods and to discourage criminals from abusing its services. They follow his arrest by French authorities and transfer to police custody at Le Bourget airport in the outskirts of Paris on the 24th of August 2024, during which he reportedly immediately accepted to cooperate with authorities.

While these changes to Telegram’s approach to moderation were fundamental enough to be announced by its CEO, they are not listed in the changelog of the Privacy Policy, which still indicates the most recent update as having been made on March 31, 2024. Similarly, while the Privacy Policy claims that “Important changes made to this Privacy Policy will be notified to you via Telegram”, it was necessary to follow Pavel Durov’s channel to receive the information.

It is at this stage impossible to know if user data has been sent to authorities. Indeed, while the publication of transparency reports listing user data disclosure to authorities has been accelerated from semiannual to quarterly, these reports are only provided through the @transparency bot on Telegram instead of a public web page. As of writing, these reports are unavailable since the bot systematically replies “We are updating this bot with current data. Please come back within the next few days.”

However, one may note that Telegram removed the warrant canary from its Privacy Policy. A warrant canary is a statement indicating that a service provider has not received any secret government subpoenas or requests for user data. By removing this statement, it may imply that such requests have been received, even if the provider cannot disclose them due to legal restrictions.