How "telegram" is related to the FSB

For the infrastructure of the messenger are those who serve the secret complexes of Russian special services used to survive citizens

Pavel Durov is the most famous Russian IT entrepreneur in the world. His main invention, Telegram, has, according to Durov himself , more than a billion of active users. The messenger is popular not only in Russia, where it is used by more than 70% of the population, but also in Ukraine, India, Iran, the USA and many other countries.

"Telegram" is not only a means of communication for a long time. This is a news platform for Russian independent media and propaganda; and the tool with which the Russian special services recruit agents for sabotage abroad; And the criminal marketplace, where criminals sell drugs, weapons and children's porn.

One of the main reasons why hundreds of millions of people in the world trust their secrets to Telegram is the image of an unshakable fighter for freedom, which is guarded by Pavel Durov, who is guarding the confidentiality of users and undergoes a persecution by the Russian authorities and other countries.

Journalists of the “important stories” conducted their own investigation and found out that the myth of himself and his brainchild, who was sung by a fool, has little in common with reality. We learned what data of Telegram users can have access to the FSB, who is responsible for the infrastructure of the messenger and why these people prefer to stay in the shadows.

The myth of exile

“The idea of“ Telegram ”appeared [in 2013] when we were still in Russia: the armed police officers tried to break into my house because I refused to remove opposition groups on VKontakte, and then I realized that I had no safe way to contact my brother,” so, according to Durov , the history of the messenger began.

A year later, he left Russia, publishing a farewell to the manifesto “Seven reasons not to return to Russia” : “There is no way back. Especially after I publicly refused to cooperate with the authorities, ”said Durov.

After leaving Russia, Pavel chose a new house for himself and Telegram for a long time : in Europe he was annoyed by an excessive bureaucracy, in the USA the attention of the FBI. As a result, he decided to place the messenger headquarters in the Al Kazim Towers skyscraper in Dubai.

But when in 2021 the journalists of the German edition of Der Spiegel arrived at Dubai Durov's office, the room was empty. The woman at the reception told reporters that no one went there for more than three years.

:

Last year, “important stories” found that Durov’s numerous statements that he does not visit his homeland is not true. From the leak of the FSB border service, we learned that Pavel came to Russia more than 50 times since his departure in 2014.

Durov went to Russia especially actively when he had serious financial problems: in 2019, the American securities commission banned the release of his Ton cryptocurrency, with the help of which he hoped to cover the costs of the purchase of servers and other equipment for Telegraph.

Durov owed almost $ 2 billion to investors, among which were Russian oligarchs, as well as the GRU GRU, Jan Marslek and companies that traded illegally exported raw materials from the occupied territories of Ukraine (while the founder of Telegram emphasized that all investors underwent a thorough selection procedure).

Due to the ban on the release of cryptocurrency, Pavel even thought about selling his share in Telegram, but immediately after the first for several years of visit to Russia, he pledged to pay part of the debts, and already in 2021 he attracted a billion dollars with the help of the Russian State Bank of VTB, Alpha Capital, Mikhail Friedman and the Aton investment group.

Shortly before, in June 2020, Roskomnadzor suddenly removed all the claims to the messenger and stopped blocking him. On the day of the announcement of this decision, Durov was in St. Petersburg, follows from the Base of the FSB border service.

In Telegram itself, they did not know about the trips of its leader to Russia: “I believed in the narrative that the team had to leave the country and wander around the world as nomads because they experienced in Russia. Our personal conversations [with Durov] converged with the fact that he stated in an interview and public speeches, ”the former manager of Telegraph on the development of partnerships Elies Kampo recalls in a conversation with“ important stories ”.

“He said that he had left Russia and, of course, could come there, but does not want to be in this country due to experience with VKontakte and the launch of Telegraph,” says Kampo.

Does the Telegram have an office in Russia

In 2017, Anton Rosenberg, who previously worked on VKontakte, said that the company was engaged in the development of Telegram from St. Petersburg Telegraph; In her office, according to the former colleague of Durov, the messenger team was located.

The leadership of the Telegraph accused Rosenberg of disclosing commercial secrets and required compensation of 100 million rubles. Later, Telegraph offered Rosenberg a settlement agreement, and this ended.

“Important stories” found out from the tax leak that the members of the Durov team were employed and received a salary: his personal assistant Irina Pravdina and the top manager of Marta Kudina, who calls himself the Ph, Director of Telegram.

Security myth

Pavel Durov loves to criticize competitors. “WhatsApp is absolutely sucks ... it is not confidential,” he said in 2015. “Signal encryption was funded by the US government. I predict that five years later Bacdor will be discovered in it, ”Paul criticized another competitor in 2020.

Durov’s prediction did not come true: no hidden vulnerability in Signal was found, experts in the field of digital security continue to consider this messenger reliable and protected. What cannot be said about "Telegram".

Unlike the same WhatsApp and Signal, the Durov application does not use the default technology of through encryption. Its principle lies in the fact that the sender's message can be deciphered only on the device of the recipient on which the secret key is stored.

But Telegram is arranged differently. Through encryption is used only in secret chats that need to be activated separately. According to former colleague Durov Anton Rosenberg, 98% of the messenger users correspond in ordinary chats. All messages from them are deciphered and stored on Telegram servers. This means that the one who controls the server can gain access to correspondence.

“Unfortunately, most users believe that Telegram is absolutely safe, but I would like either the team would really make it like that, well, or honestly reported that users know how it works,” said Rosenberg.

The fact that Telegram is not protected by through encryption, experts in the field of digital security have been warned for a long time. However, Durov's application has another significant difference from other messengers.

“Telegram protocol works in such a way that when the application on your phone or computer creates an encrypted message, an unspenting device, which is called Auth_key_id, is added to it to it. This applies to all chats, not only cloud, but also secret, ”says Michal“ Ryshki ”, an expert in the field of digital security with 20 years of experience.

According to Wozniak, this identifier is used to determine the device on the side of the Telegram server and choose the key to decryption of messages. However, for some reason messenger Durov sends this identifier to unencrypted, in the form of a regular text. “Other messengers have long been using TLS ( a technology that encrypts data when transmitting via the Internet. - approx. Ed.) Or other similar tools to protect the connection between the device and the server. And there is no reason why Telegram could not do the same, ”said Wozniak.

(Technical details about Auth_key_id and other features of the Telegram Protocol can be read on the Boznyak blog .)

In practice, this means that the one through whom the traffic of the messenger passes can track the device identifiers and in conjunction with other data, for example, IP addresses (a unique number due to which the devices find each other on the Internet), as well as the time of sending messages, determine the location of a person and receive other valuable information: for example, which devices are exchanged, which ultimately allows you to build a network Telegram users.

“We know that in Russia there is a SORM ( the system by which the Russian special services monitor phone calls and Internet active users. - Approx. Ed.). Each Internet provider must install it in his infrastructure. Thus, the Russian special services have access to traffic, which goes through the provider. They can monitor traffic, preserve it and then analyze it, ”Wozniak explains.

This applies not only to Russia, but also to the occupied territories of Ukraine. The Messenger protocol allows Russian special services to identify devices identifiers in all places where the security forces have access to the Internet infrastructure.

However, as “important stories” managed to find out, the confidentiality of hundreds of millions of Telegram users from other countries can also be at risk. Due to the fact that Pavel Durov transmitted the arrangement of the entire infrastructure of the messenger of one company de facto located in Russia.

Who serves servers

To understand who administers Telegram servers and may have access to its traffic, “important stories” conducted an experiment. We asked users who were in Russia to send messages to each other and the correspondent of “important stories” in Europe and record traffic using the WireShark program (it allows you to analyze network data packages).

The experiment, firstly, allowed us to see the identifiers of user devices (auth_key_id), about which Vozniak spoke. We repeated the experiment three times - twice with users in Russia and once - with users abroad - in all cases, the device identifiers were transmitted over the network in unniffereed form.

Secondly, we learned the IP addresses of servers that our messages came to. It turned out that, judging by the RIPE European Internet registrar, they belong to a little-known company from the Caribbean Islands Antigua and Barbud-Global Network Management (GNM).

Then we analyzed other ranges of IP addresses under the control of this company, and learned that it transferred more than 10 thousand IP addresses for TELGRAM. So it became obvious that GNM can play a significant role in the infrastructure of the messenger.

Soon we managed to confirm this assumption with the help of an unexpected find. In 2018, GNM sued the owner of the Data Center in Miami. We downloaded the available materials of the process and found that at first glance, the most important details of how the telegram infrastructure from the inside and who served it are arranged at first glance.

From the documents submitted to the court, we became aware of the name of the owner of the company from the islands of Antigua and Barbud. It turned out to be a native of Togliatti Vladimir Vedeneev. “GNM is engaged in the installation of customer equipment - in this case for the Telegram messenger - and the subsequent technical support of this equipment,” he explained in court.

According to Vedeneev, half of GNM employees are in Russia, where the company has an office in St. Petersburg.

In addition, Vedeneev informed the court that he is the only person with authorized access to Telegram servers in the Date Center in Miami. Its company also owns a router in server - this is a key component of network equipment through which traffic passes.

“If the company controls the routers that distribute traffic passing through the Telegram servers, this means that it or the one to whom it will provide a similar level of access can see identifiers of the messenger users and determine the data streams related to the device,” explains Mikhal Vozniak.

From the materials of the process in Miami, we also became aware that Vladimir Vedeneev is not only the owner of the company serving almost the entire telegram infrastructure - at the same time he occupied one of the key posts in the hierarchy of the messenger.

Initially, Pavel Durov personally signed agreements for the rental of premises in Data Centers and the equipment of equipment, however, in 2018, Telegram Corp (Panama Company Durova) lost all rights and obligations under contracts to arrange its GNM infrastructure. On behalf of GNM, the assignment agreement was signed by Vladimir Vedeneev as the general director, and on behalf of Telegram - by the same Vedeneev as a financial director.

“My work with the Telegram messenger began with the fact that Pavel Durov in St. Petersburg asked me to take the position of a financial director, to be responsible for communication with suppliers, to sign documents, and so on. And formally, I had a power of attorney to sign documents on behalf of Pavel Durov and on behalf of “Telegram”, ”Vedeneev explained in court, but at the same time emphasized that he did not receive a salary for his work.

Despite the fact that Vladimir Vedeneev is a key person for the Telecrama infrastructure, his former colleague Elies Kampo, as well as other interlocutors of “important stories”, familiar with Durov, never heard Vedeneev’s last name.

The owner of the GNM had reasons to stay in the shade.

Secret communication channels

Until 2020, the Telegram IP address, which today controls GNM, belonged to companies from Globalnet St. Petersburg. This is a main operator of communications, owning fiber -optic networks throughout Russia with a length of over 18 thousand km.

Despite the change of owner, hundreds of these IP addresses of the messenger are still determined in Russia.

Until recently, the same Globalnet beneficiary was Vladimir Vedeneyev, but in 2024 he rewritten it to his relatives: they control 96% of the company. Another 4% belongs to Roman Venediktov.

Venediktov graduated from the Military Space Academy. Mozhaisky. This is an elite forge of engineers for the Russian military industry, intelligence and astronautics. For almost 10 years, Venediktov has served in the Main Center for the Testing and Department of Cosmic Funds of the Ministry of Defense in the Military Town of Shchelkovo-7 .

Venediktov could get acquainted with the Durov family about 10 years ago. He was a co-owner of Piring from St. Petersburg, which owned the Dataix traffic network. Through it, all the VKontakte traffic was walking . In 2012, Venediktova’s partner became Durova Albina, and in 2013, they were joined by the Unified Military brother of Paul, the chief engineer of VKontakte Mikhail Petrov.

In 2018, Globalnet and Dataix united , and today it is one of the largest traffic exchange networks in the world: many Internet providers of Europe are connected to its infrastructure. According to Vedeneev , as of 2019, the globalnet and DataX united to sit down also served 90% of the telecom market of Ukraine and 100%.

Why do you need exchange points and what is pyric

The essence of the huge extensive highways and the traffic exchange points included in them is that the data of billions of users and tens of thousands of services around the world redirect and reach the devices in the shortest way without intermediaries with the highest possible speed. This process is called peering.

In 2020, Globalnet approved on the site that he is the only operator of communication providing direct access to Telegram in Russia and the CIS. And he, in the spring of 2022, shortly after the start of a full-scale invasion of Ukraine, the first among Russian peer platforms introduced at the request of Roskomnadzor the user traffic control system using the Deep Packet Insption technology (DPI browsing Internet traffic and blocks access to prohibited sites).

Almost simultaneously with the way Globalnet installed equipment for the analysis of traffic, the deputy chairman of the State Duma Committee on Information Policy Oleg Matveychev directly stated that Telegram and the FSB agreed: “Durov found a compromise with the FSB. Requests within the framework of operational measures are transmitted there if terrorists or someone is under control. “Telegram” installed equipment so that there was an opportunity to watch all dangerous subjects. ”

Globalnet provides communication services to several Russian state-owned enterprises, including those working in the defense sector: under the Western sanctions of the Kurchatov Institute and the Main Scientific Research Cuming Center for the Office of the President of Russia (Glavnivts).

Officially, Glavnivz is engaged in the technical support of summits, direct lines and meetings with the participation of Vladimir Putin, and unofficially, this is, in fact, a closed analytical center, working in the interests of the FSB, FSO, the Ministry of Internal Affairs and the Ministry of Defense.

Glavnivz is engaged in mass surveillance of Russians on the Internet and with the help of bots promotes the Kremlin propaganda in social networks. The Center is also responsible for the development of the all -Russian video surveillance system with person recognition. С ее помощью силовики устраивают облавы как на политических активистов, так и на тех, кто, например, пытается избежать отправки в армию.

«Глобалнет» — не единственная компания Веденеева в России. До недавнего времени он был бенефициаром «Электронтелекома» из Санкт-Петербурга (в 2024 году Веденеев переписал ее на родственников). Судя по данным европейского интернет-регистратора RIPE, «Электронтелеком» также имеет отношение к инфраструктуре «Телеграма»: компания передала в пользование мессенджеру более 5 тыс. IP-адресов.

«Важные истории» получили внутреннюю финансовую документацию «Электронтелекома» за 2024 год и узнали, что один из важнейших госзаказчиков компании — ФСБ.

«Электронтелеком» оказывает ФСБ услуги по монтажу и техническому обслуживанию — цитата — «комплекса передачи специальной информации со стационарных объектов УФСБ России по городу Санкт-Петербургу и Ленинградской области, используемого для проведения оперативно-разыскных мероприятий в целях выполнения государственного оборонного заказа».

This means that those who at the same time serve the secret complexes of the FSB used to survive citizens are responsible for the server infrastructure of “Telegram”.

«Меня это шокирует, но не удивляет, — признается эксперт в области цифровой безопасности Михал «Рышек» Возняк. — Если кто-то имеет доступ к трафику “Телеграма” и сотрудничает с российскими спецслужбами, это значит, что идентификатор устройства становится действительно большой проблемой — инструментом для глобальной слежки за пользователями мессенджера вне зависимости от того, где они находятся и к какому серверу подключаются».

Возможные жертвы

За последние годы накопилось немало свидетельств того, что российские спецслужбы получают данные о пользователях «Телеграма» без физического доступа к их устройствам и без взлома.

In 2023, The Wired published the stories of several Russian activists who were persecuted for participating in anti -war protests and discussing resistance shares. According to them, messages in “secret” chats were read, although the recipients did not open them. В одном случае полицейский цитировал задержанной её сообщения, отправленные соратникам в «Телеграме» незадолго до обыска.

О новом эпизоде стало известно несколько дней назад. Правозащитный проект «Первый отдел», оказывающий помощь обвиняемым в государственной измене, сообщил , что ФСБ получила доступ к сообщениям, которые россияне отправляли в боты украинских телеграм-каналов — в том числе «Крымский ветер», «Військовий Віщун» и другие.

Согласно документам, переданным «Важным историям» юристами проекта, спецслужбы начали отслеживать переписку пользователей с администраторами украинских каналов как минимум за год до возбуждения уголовного дела. Это практически исключает возможность того, что доступ был получен через устройства самих обвиняемых. А тот факт, что пользователи жили в разных регионах России, указывает на вероятный мониторинг телеграм-ботов и каналов самими силовиками — с фиксацией всех обращений от российских граждан.

Перед публикацией расследования «Важные истории» отправили запросы Владимиру Веденееву и Павлу Дурову. Веденеев согласился ответить на наши вопросы, и мы были готовы представить его позицию, однако на следующий день после разговора он отказался от комментариев. Дуров запрос проигнорировал.

Миф о свободе

«Вся моя жизнь — это стремление к свободе, и моя миссия — дать другим людям шанс — насколько это возможно — тоже обрести свободу. Через платформы, которые я создавал, я надеялся, что они смогут выражать эту свободу. В этом я вижу миссию “Телеграма”, и отчасти такой же была миссия моей предыдущей компании — “ВКонтакте”», — декламировал Павел Дуров в интервью Такеру Карлсону в 2024 году.

За 13 лет до этого Москву и Санкт-Петербург охватили массовые протесты граждан против фальсификаций на выборах в Госдуму. Эти протесты собрали сотни тысяч человек и всерьез напугали власти.

В декабре 2011 года Дуров опубликовал письмо из управления ФСБ по Санкт-Петербургу c требованием удалить ряд оппозиционных сообществ во «ВКонтакте». Соцсеть тогда не стала закрывать группы целиком, но заблокировала аккаунты их наиболее активных пользователей. Свое решение Дуров объяснил так.

«Разговоры о голосованиях, выборах, митингах и гражданской позиции мы считаем формой массового развлечения, наряду с обсуждением футбольных матчей и игрой в “Счастливого фермера”.

В эти декабрьские дни, пока молодежь и ОМОН увлеченно играли в революционеров и реакционеров, мы занимались нашим прозаичным ремеслом, фиксируя запросы аудитории.

Те, кто бросились благодарить нас за содействие политическим протестантам, теряют из вида простое обстоятельство. Если бы в те же дни мы стали проигрывать в конкурентной борьбе из-за отсутствия какого-нибудь сервиса виртуальных массовых репрессий, нам бы пришлось ввести и его. И будьте уверены — наши репрессии были бы самыми массовыми и самыми кровавыми на рынке».

В этом обращении в редакцию Lenta.ru Павел Дуров с удивительной откровенностью, по сути, пересказал свое письмо замруководителя администрации президента Владиславу Суркову, отправленное тогда же, в разгар протестов.

«Как вы знаете, мы уже несколько лет сотрудничаем с ФСБ и отделом “К” МВД, оперативно выдавая информацию о тысячах пользователей нашей сети в виде IP-адресов, номеров мобильных телефонов и другой информации, необходимой для их идентификации. Блокирование оппозиционных сообществ “ВКонтакте” подорвет доверие к нашей сети среди пассионарной молодежи, что в долгосрочной перспективе может свести на нет наши технологические и идеологические усилия по сдерживанию натиска иностранных социальных сетей на отечественный рынок ( а также лишит ФСБ и отдел “К” МВД доступа к личным данным пассионарной молодежи. — Прим. ред.) ".

Это письмо в 2013 году опубликовала «Новая газета». Журналисты обнаружили его в полученном от источника архиве писем пресс-секретаря «ВКонтакте» Владислава Цыплухина. В переписке Цыплухин отчитывался перед Сурковым о том, как «ВКонтакте» блокирует радикально настроенных пользователей и создает фейковые группы, чтобы разделить и столкнуть протестующих друг с другом. В том же архиве было и письмо Дурова Суркову.

В комментарии «Новой газете» Цыплухин сначала заявил, что не писал писем в администрацию президента, однако после того, как газета опубликовала скриншоты переписки, признал сотрудничество с Кремлем.

Знакомый с Дуровым журналист Николай Кононов пишет в биографической книге о предпринимателе, что в тот день, когда Павел отправил письмо Суркову и колонку в редакцию Lenta.ru , он, «прячась от ведомственных автомобилей, дежуривших у дома Зингера ( где располагается офис «ВКонтакте». — Прим. ред.), поднялся в штаб и написал: “Человек не может стать по-настоящему свободным, пока существует в тупиковой парадигме “раб — хозяин“. В этой системе любой хозяин — чей-то раб, и любой раб — чей-то хозяин”».