ANNOUNCEMENT: You can find the new home of CEPA's StratCom Program here.
This Week in Info War

The Kremlin targets encrypted messaging

  • Share on Facebook
  • Share on Twitter
Russian officials have fined the popular encrypted messaging app Telegram 800,000 rubles ($14,000) for failing to provide the Federal Security Services with encryption keys, the RNS news agency reported on 16 October. The presiding judge cited a 12 July letter demanding that Telegram give Russia's Federal Security Service (FSB) data to decode messages to six phone numbers by 19 July. 

The company has 10 days to appeal the verdict and reportedly will do so. If the court decision is reaffirmed, the state media watchdog Roskomnadzor will give Telegram 15 days to turn over the encryption keys. Roskomnadzor could block Telegram if the company’s founder, Pavel Durov, refuses to comply. Telegram complied with a law requiring it to register with a government database in June, but stopped short of adhering to government-mandated data storage or decryption rules. 

Telegram accounts are initially tied to users’ cellphone numbers. This allows the device to be registered before the number is hidden and lets devices be connected privately for conversations outside the public sphere. Telegram also hosts conversation channels for users to openly share ideas and discussions in a secure environment. 

Publicly accessible channels or message groups on Telegram allow individuals to join and access all message history, but they are unable to see who sent what. Although public channels are anonymous, the government can still easily track accounts and monitor conversations. The app currently boasts six million active users worldwide.

Telegram’s controversial private messaging allows for the direct link between two or three devices. Messages are encrypted and can only be seen by the intended recipient device. In addition, a self-destruct feature lets users permanently erase their conversations after a set period of time. 

Since the terrorist attacks in St. Petersburg last April, Russian authorities have been fighting to gain access to Telegram, which critics say acts as a safe platform for extremist groups. They have relied on the controversial Yarovaya laws, which expands penalties for newly defined criminal activities and places new requirements on internet and communication operators to share data. Indeed, significant evidence exists to suggest that terrorist organizations do use Telegram’s encrypted messaging service to plan attacks. 

Statements by Russian FSB officials claim that “[the app gives] terrorists the opportunity to create secret chat rooms with a high degree of encryption”—which justifies their efforts to gain access to encrypted channels and user identities.

However, Telegram argues that even if access were granted to encrypted networks, terrorists would find new workarounds and that companies should be encouraged to block networks on their platforms rather than leaving it up to the government’s discretion and possible abuse.  

Critics fear the Kremlin will use the Yarovaya laws to crack down on political opponents. FSB requests for Telegram encryption keys would let the Kremlin access back doors in the app’s code and collect data on users, their conversations, and other personal information. While the definitions of “terrorist”’ activity are laid out in the Yarovaya laws, they are vague enough to give Russian officials a rationale for using them against the opposition.

Russia's battle against encrypted messaging is not isolated to Telegram alone. Although it is unclear if WhatsApp and Viber shared their encryption keys, RT reported that Russian security firms have been given the go-ahead to hack those applications. 

Indeed, there are solid grounds to share Durov’s concerns. Russia has a long track record of using laws overtly designed to maintain law and order to restrict citizens’ rights. Officials have banned religious groups, forbidden gay expression as “propaganda” and violently dispersed political gatherings

In separate statements to Tech Crunch and Fortune, Durov said that in his view “privacy, ultimately, is more important than our fear of bad things happening, like terrorism. If you want to defeat terrorism by blocking stuff, you’ll have to block the Internet.”