Development

Telegram was launched in 2013 by the brothers Nikolai and Pavel Durov. Previously, the pair founded the Russian social network VK, which they left in 2014, saying it had been taken over by the government.^[23] Pavel sold his remaining stake in VK and left Russia after resisting government pressure.^[24] Nikolai created the MTProto protocol that is the basis for the messenger, while Pavel provided financial support and infrastructure through his Digital Fortress fund.^[25] Telegram Messenger states that its end goal is not to bring profit,^[26][27] but it is not structured as a non-profit organization.^[28]

Telegram is registered as a company in the British Virgin Islands^[9] and as an LLC in Dubai.^[29][30] It does not disclose where it rents offices or which legal entities it uses to rent them, citing the need to "shelter the team from unnecessary influence" and protect users from governmental data requests.^[31] After Pavel left Russia in 2014, he was said to be moving from country to country with a small group of computer programmers consisting of 15 core members.^[24][32] While a former employee of VK claimed that Telegram had employees in Saint Petersburg,^[33] Pavel said the Telegram team made Berlin, Germany, its headquarters in 2014,^[34] but failed to obtain German residence permits for everyone on the team and moved to other jurisdictions in early 2015.^[33] Since 2017, the company has been based in Dubai.^[35] It has a complex corporate structure of shell companies to delay complying with government subpoenas.^[36]

Usage

In October 2013, Telegram announced that it had 100,000 daily active users.^[25]

On 24 March 2014, Telegram announced that it had reached 35 million monthly users and 15 million daily active users.^[37] In October 2014, South Korean government surveillance plans drove many of its citizens to switch to Telegram from the Korean app KakaoTalk.^[34] In December 2014, Telegram announced that it had 50 million active users, generating 1 billion daily messages, and that it had 1 million new users signing up on its service every week,^[38] traffic doubled in five months with 2 billion daily messages.^[39] In September 2015, Telegram announced that the app had 60 million active users and delivered 12 billion daily messages.^[40]

In February 2016, Telegram announced that it had 100 million monthly active users, with 350,000 new users signing up every day, delivering 15 billion messages daily.^[41] In December 2017, Telegram reached 180 million monthly active users.^[42] By March 2018, that number had doubled, with Telegram reaching 200 million monthly active users.^[43]

On 14 March 2019, Pavel claimed that "3 million new users signed up for Telegram within the last 24 hours."^[44] He did not specify what prompted this flood of new sign-ups, but the period matched a prolonged technical outage experienced by Facebook and its family of apps, including Instagram.^[45] According to the US Securities and Exchange Commission, as of October 2019, Telegram had 300 million monthly active users worldwide.^[46]

On 24 April 2020, Telegram announced that it had reached 400 million monthly active users.^[47]

On 8 January 2021, Pavel announced in a blog post that Telegram had reached "about 500 million" monthly active users.^[48] In August, TechCrunch reported that India was Telegram's largest market, with a 22% share of total installs coming from the region.^[49] Telegram then gained over 70 million new users as a result of an outage which affected Facebook and its affiliates on 5 October, 2021.^[50]

As of March 2022, Telegram's usage share had jumped to 63%, overtaking WhatsApp's usage share of 32% to become the most popular messaging app in Russia.^[51] On 19 June 2022, Telegram announced that it had reached 700 million monthly active users.^[52][53]

As of July 2023, Telegram has more than 800 million monthly active users.^[19]

Accounts

Account self-destruction

The user was limited.

Telegram accounts are usually tied to telephone numbers which are verified by SMS or phone call.^[54] In December 2022, an update introduced the ability to sign up without a phone number and instead by using a +888 number purchased on the Fragment platform, which is linked to the user's TON wallet.^[55] Account creation requires an iOS or Android device regardless of the platform intended to be used.^[56][57] Users can add multiple devices to their account and receive messages on all of them. Connected devices can be removed individually or all at once. The associated number can be changed at any time and when doing so, the user's contacts will receive the new number automatically.^[54][58][59] In addition, a user can set up a username as an alias that allows them to send and receive messages without exposing their phone number.^[60] Telegram accounts can be deleted at any time and they are deleted automatically after six months of inactivity by default, which can optionally be changed from 1 month at the shortest up to 12 months at most with a range between. Users can replace exact "last seen" timestamps with broader messages such as "last seen recently".^[61]

The default method of authentication that Telegram uses for logins is SMS-based single-factor authentication.^[62][63] A one-time passcode that is sent via SMS to the user's phone number is required to log into the account by default.^[63][64] Users also have the option to create a password as a form of two-step verification.^[65] In late 2022 Telegram began testing, for a select number of users, the ability to receive their one-time code via email, as well as testing the integration of Sign in with Apple and Sign in with Google.^[66]

Telegram allows groups, bots and channels with a verified social media or Wikipedia page to be verified but not user accounts.^[67][68] In the past, exceptions have been made to have accounts verified, but this practice is no longer carried out.

Accounts of users who purchased Telegram's Premium subscription are marked with a star emoji, which the users can change to any emoji of their choice.^[69]

Cloud-based messages

Telegram's default messages are cloud-based and can be accessed on any of the user's connected devices. Users can share photos, videos, audio messages and other files (up to 2 gigabytes per file). Users can send messages to other users individually or in groups of up to 200,000 members.^[70] Sent messages can be edited up to 48 hours after they have been sent and can be deleted at any time on both sides. Messages in all chats, including groups and channels, can be set to auto-delete after 24 hours, 7 days or a month, although this will only apply to messages sent after the auto-delete timer is enabled.^[71][72] People can react to messages, choosing from a range of emoji. A user can only send one reaction and tapping on any other reaction will switch to it. In groups, a list of people who reacted is available. Reactions are always on in personal chats but have to be enabled by the admin in groups and channels, fully or partially, with a smaller number of reactions chosen.^[73]

Telegram offers drafts which sync across user devices, such as when a user starts typing a message on one device and can later continue on another. The draft will persist in the editing area on any device until it is sent or removed.^[74] All chats, including groups and channels, can be sorted into custom folders set by the user. Users have the option to schedule messages in personal chats to be sent when the other side comes online.^[75] Users can also import chat history, including both messages and media, from WhatsApp, Line and Kakaotalk due to data portability, either making a new chat to hold the messages or adding them to an existing one.^[76][77]

The transmission of cloud messages to Telegram's servers is encrypted with the service's MTProto protocol, while 'Secret Chats' use end-to-end encryption based on the same protocol.^[78] According to Telegram's privacy policy, "all data is stored heavily encrypted and the encryption keys in each case are stored in several other data centers in different jurisdictions. This way local engineers or physical intruders cannot get access to users' data".^[79] Telegram's local message database is not encrypted by default.^[80] Some Telegram clients allow users to encrypt the local message database by setting a passphrase.^[81]

Telegram users can share their live location in a chat for either 15 minutes, one hour, or eight hours. If multiple users share their live location within a group, they are shown on an interactive map. Sharing the 'live location' can be stopped at any time.^[82]

Secret chats

A "secret chat" confirmation notice – screenshot from iOS 16

Messages can also be sent with client-to-client encryption in so-called secret chats. These messages are encrypted with the service's MTProto protocol.^[83] Unlike Telegram's cloud-based messages, messages sent within a secret chat can be accessed only on the device upon which the secret chat was initiated and the device upon which the secret chat was accepted.^[25][78][84] Messages sent within secret chats can, in principle, be deleted at any time and can optionally self-destruct.^[85]

Secret chats have to be initiated and accepted via an invitation, upon which the encryption keys for the session are exchanged. Users in a secret chat can verify that no man-in-the-middle attack has occurred by comparing pictures that visualize their public key fingerprints.^[86]

According to Telegram, secret chats have supported perfect forward secrecy since December 2014. Encryption keys are periodically changed after a key has been used more than 100 times or has been in use for more than a week.^[80] Old encryption keys are destroyed.^[58][59][87]

Secret Chats are available only on the Android, iOS and macOS clients of the app.^[88]

Groups and Channels

Telegram users can create and join groups and channels. Groups are large multi-user chats that support up to 200,000 members and can be public or private. Users can freely join public chats and find them using the in-app search function, while private chats require an invitation. They support flexible admin rights and can use bots for moderation to prevent spam and unwanted activity. Groups can be split into topics, effectively creating subgroups dedicated to various subjects with separate settings for each.^[89]

Admins can choose to hide the list of members in a group, as well as post anonymously themselves.^[90] Similarly, groups and channels can have content protection enabled, which prevents screenshots, forwarding and downloading of media.^[91][92] Ownership of channels and groups can be transferred to one of the admins if the owner wishes to give up their rights.

Groups support threaded replies, where bringing up the context menu on a message allows one to open a screen with a thread of replies made to that message and the subsequent ones in the thread. Specific users can be tagged in the group by adding @username to a message, where “username” is that particular user’s username.

Groups and channels also support polls, which can be open or anonymous and can support multiple choices. When forwarded, polls retain the answer data and any votes cast in other chats will count toward the overall total.^[93][94]

Channels are one-way feeds where the channel owner or admins can post content while followers can only read, react and comment, if comments have been enabled.^[95][96] Channels can be created for broadcasting messages to an unlimited number of subscribers.^[97] The list of those who subscribe to a channel can only be seen by its admins. Posting in the channel is anonymous, though admins can choose to add signatures to their posts. Channels offer detailed statistics on view counts, user growth and interactions, also visible only to admins.^[98] Channel owners are able to use Telegram to create giveaways, randomly awarding channel members with prizes such as Telegram Premium subscriptions to their followers, based on certain criteria.^[99] Users with a Telegram Premium subscription have a number of "boosts" that they can give to channels, which allow the channel to "level up" and unlock features, such as the ability to customize messages or post stories as the channel.^[100]

In December 2019, Bloomberg News moved their messenger-based newsletter service from WhatsApp to Telegram after the former banned bulk and automated messaging.^[101][102] Other news services with official channels on the platform include the Financial Times,^[103] Business Insider^[104] and The New York Times.^[105]

Channels have also been used by governments and heads of state. Notable examples include Volodymyr Zelensky^[106] and Emmanuel Macron.^[107] Channels have been used by journalists in oppressive regimes to establish independent news networks.^[108]

Video and voice calls

At the end of March 2017, Telegram introduced its own end-to-end encrypted voice calls. Connection is established as peer-to-peer whenever possible, otherwise the closest server to the client is used. According to Telegram, there is a neural network working to learn various technical parameters about a call to provide better quality of service for future uses.^[109]

Telegram added group voice chats in December 2020.^[110] Any group or channel admin can launch a chat, which will be open to all members and ongoing even if no one is currently using it. Admins can mute members by default or selectively as well as create invite links that will add people as muted by default. Members can use the Raise Hand button to signal their desire to speak. A push-to-talk option is available on mobile versions, as well as key shortcuts to mute and unmute oneself on Telegram Desktop. Admins of groups or channels have the option to join as their group or channel, hiding their personal account. Users can also record chats with a red dot shown as a warning during the recording period.^[111]

Telegram announced in April 2020 that they would include group video calls by the end of the year.^[112] On 15 August 2020, Telegram added video calling with end-to-end encryption.^[113] Picture-in-picture mode is also available, giving the ability to use the other functions of the app during the call.^[114] In June 2021, Telegram implemented group video calls across all of its clients. Users can stream video from their camera, share their screen or do both simultaneously.^[115][116] Group calls have support for selective screen sharing, split screen view and improved noise suppression.^[117] In July 2021, Telegram introduced the ability for up to 1000 people to watch the streamed video.^[118] Livestreams support unlimited participants and third-party streaming software such as OBS Studio and XSplit, supporting custom interfaces and overlays.^[119][120]

Bots

In June 2015, Telegram launched a platform for third-party developers to create bots.^[121] Bots are Telegram accounts operated by programs. They can respond to messages or mentions, can be invited into groups, and can be integrated with other programs. Bots can also accept online payments made with credit cards or Apple Pay.^[122] The Dutch website Tweakers reported that an invited bot can potentially read all group messages when the bot controller changes the access settings silently at a later point in time. Telegram pointed out that it considered implementing a feature that would announce such a status change within the relevant group.^[123] There are also inline bots, which can be used from any chat screen. To activate an inline bot, a user must type the bot's username and a query in the message field. The bot then will offer its content. The user can choose from that content and send it within a chat.^[124]

Bots can also handle transactions provided by Paymentwall, Yandex.Money, Stripe, Ravepay, Razorpay, QiWi and Google Pay for different countries.^[125] Bots also power Telegram's gaming platform, which utilizes HTML5, so games are loaded on-demand as needed, like ordinary webpages. Games work on iPhones 4 and newer and on Android 4.4 devices and newer.^[126]

People can use Internet Of Things (IoT) services with two-ways interaction for IFTTT implemented within Telegram.^[127]

Test order receipt prior checkout through Telegram

In April 2021, the Payments 2.0 upgrade enabled bot payments within any chat, using third-party services such as Sberbank, Tranzoo, Payme, CLICK, LiqPay and ECOMMPAY to process the credit card information.^[128]

In February 2018, Telegram launched their social login feature to its users, named Telegram Login. It features a website widget that could be embedded into websites, allowing users to sign into a third party website with their Telegram account. The gateway sends users' Telegram name, username, and profile picture to the website owner, while users' phone number remains hidden. The gateway is integrated with a bot, which is linked with the developer's specific website domain.^[129]

In June 2021, an update introduced a new bot menu where users can browse and send commands while in a chat with a bot.^[130]

In April 2022, bots gained support for customized interfaces and inline page loading. Interfaces can be adjusted to match the app's theme even if it is changed while interacting

Stickers and animated emoji

Telegram has more than 20,000 stickers. Stickers are cloud-based, high-resolution images intended to provide more expressive emoji. When typing in an emoji, the user is offered to send the respective sticker instead. Stickers come in collections called "packs", and multiple stickers can be offered for one emoji. Telegram comes with one default sticker pack,^[131] but users can install additional sticker packs provided by third-party contributors. Sticker sets installed from one client become automatically available to all other clients. Sticker images use WebP file format, which is better optimized to be transmitted over the internet. The Telegram clients also support animated emoji.^[130] In January 2022, video stickers were added, which use the WebM file format and do not feature any software requirements to create.^[132] In September 2022, Telegram has given free users access to dozens of reactions, even some that were only previously available to Premium subscribers. In order to accommodate the new reactions, the reaction panel has been expanded and redesigned.^[133]

People Nearby and Groups Nearby

People Nearby can help users meet new friends by turning on phone GPS location and opting-in contacts and through Groups Nearby people can create a local group by adding location data to groups.^[134][135]

Stories

Similar to other social platforms, Telegram users can post stories, a type of short-form content. Telegram stories have several distinctive features, like a dual-camera mode, extra privacy settings, the ability to edit stories after posting them, as well as to rewind and fast-forward them while watching.^{[136][137][138]}

Premium Features

Telegram Premium was launched on 19 June 2022 with regional pricing.^[52][53] The optional paid subscription gives users increased limits in the app, such as larger file uploads, faster download speeds, unlimited voice message transcription,^[139] as well as numerous other increases such as the number of pinned chats and folders. Premium users also have access to extra stickers, emoji, reactions, and customization features like a special badge and the ability to change the look of their messages in chats. Premium users also get access to additional settings, like instant chat translation, and the ability to restrict who can send them voice messages.^[140][141]

As of 2023, Telegram Premium can be acquired via in-app purchases facilitated by Apple and Google, directly via Telegram’s @PremiumBot, or with cryptocurrency on the Fragment platform.^[142] Users are able to purchase a subscription for themselves, or purchase a subscription for someone else to send as a gift. Premium subscriptions can also be won through official Channel Giveaways, in which Telegram channels pre-purchase a specific number of Premium subscriptions that are randomly given away to their subscribers.^[143]

Privacy

A simplified illustration of the MTProto encryption scheme

For encrypted chats (branded as Secret Chats), Telegram uses a custom-built symmetric encryption scheme called MTProto. The protocol was developed by Nikolai Durov and other developers at Telegram and, as of version 2.0, is based on 256-bit symmetric AES encryption, 2048-bit RSA encryption and Diffie–Hellman key exchange.^[83][153]

MTProto 1.0 was deprecated in favor of MTProto 2.0 in December 2017, which was deployed in Telegram clients as of v4.6.^[153]

Version 2.0 was proven formally correct in December 2020 by a team from the University of Udine, Italy. The team reviewed the protocol after realizing that they could only find in-depth verifications done of version 1.0, where most criticisms were levied. They used ProVerif, a verifier based on the symbolic Dolev-Yao model. In the published paper, they "provide a fully automated proof of the soundness of MTProto 2.0’s protocols for authentication, normal chat, end-to-end encrypted chat, and re-keying mechanisms with respect to several security properties, including authentication, integrity, confidentiality and perfect forward secrecy...MTProto 2.0 is assumed to be a perfect authenticated encryption scheme (IND-CCA and INT-CTXT)."^[153][154] However, the team also stated that because all communication, including plaintext and ciphertext, passes through Telegram servers, and because the server is responsible for choosing Diffie–Hellman parameters, the "server should not be considered as trusted." They also concluded that a man-in-the-middle attack is possible if users fail to check the fingerprints of their shared keys. Finally, they qualified their conclusion with the caveat that "properties need to be formally proved in order to deem MTProto 2.0 definitely secure. This proof cannot be done in a symbolic model like ProVerif’s, but it can be achieved in a computational model, using tools like CryptoVerif or EasyCrypt."

Servers

As with most instant messaging protocols, Telegram uses centralized servers. Telegram Messenger LLP has servers in a number of countries throughout the world to improve the response time of their service.^[155] Telegram's server-side software is closed-source and proprietary.^[8] Pavel Durov said that it would require a major architectural redesign of the server-side software to connect independent servers to the Telegram cloud.^[156]

For users who signed in from the European Economic Area (EEA) or United Kingdom, the General Data Protection Regulations (GDPR) are supported by storing data only on servers in the Netherlands, and designating a London-based company as their responsible data controller.^{[157][158][159]}

Clients

Telegram has various client apps, some developed by Telegram Messenger LLP and some by the community. Most of them are free and open-source and released under the GNU General Public Licence version 2 or 3. The official clients support sending any file format extensions. The built-in media viewer supports common media formats – JPEG, PNG, WebP for images and H.264 and HEVC in videos in MP4 container and MP3, FLAC, Vorbis, Opus and AAC for audio.

In 2021, the Telegram team announced a direct build of its Android app. Telegram for Android is available directly from the Telegram website.^[160] It is automatically updated and will most likely get new versions faster than the apps in the Play Store and App Store.^[161] A distinctive feature of this version is the ability to view channels/groups on a specific topic without censorship, which cannot be viewed from an app distributed from Google Play or the Apple Store due to their policies.

Common specifications:

• No cloud backup option for secret chat

APIs

Telegram has public APIs with which developers can access the same functionality as Telegram's official apps to build their own messaging applications.^[179] In February 2015, creators of the unofficial Whatsapp+ client released the Telegram Plus app, later renamed to Plus Messenger, after their original project got a cease-and-desist order from WhatsApp.^[180][181] In September 2015, Samsung released a messaging application based on these APIs.^[182]

Telegram also offers an API that allows developers to create bots, which are accounts controlled by programs.^[183][184] Such bots are used, among other things, to emulate and play old games in the app and inform users about vaccine availability for COVID-19.^[185][186]

In addition, Telegram offers functions for making payments directly within the platform, alongside an external service such as Stripe.

Advertising and monetization

Telegram has stated that the company will never serve advertisements in private chats.^[193] In late 2020, Durov announced that the company was working on its own ad platform, and would integrate non-targeted ads in public one-to-many channels, that already were selling and displaying ads in the form of regular messages.^[194] Ads from Telegram's "Sponsored Messages" platform began to appear in channels with more than 1000 followers in October 2021.

In late 2020, Durov announced that Telegram will consider adding paid features aimed at enterprise clients. According to him, these features will require more bandwidth and the added cost will be covered by the feature prices, in addition to covering some of the costs incurred by regular users.^[195]

Telegram Open Network

In 2017, in an attempt to monetize Telegram without advertising, the company began the development of a blockchain platform dubbed either "The Open Network" or "Telegram Open Network" (TON) and its native cryptocurrency "Gram". The project was announced in mid-December 2017^[197] and its 132-page technical paper became available in January 2018.^[198] The codebase behind TON was developed by Pavel Durov's brother Nikolai Durov, the core developer of Telegram's MTProto protocol.^[199] In January 2018 a 23-page white paper^[198] and a detailed 132-page technical paper^[198] for TON blockchain became available.^[200]

Durov planned to power TON with the existing Telegram user base, and turn it into the largest blockchain and a platform for apps and services akin to a decentralized WeChat, Google Play, and App Store.^[201][202] Besides, the TON had the potential to become a decentralized alternative to Visa and MasterCard due to its ability to scale and support millions of transactions per second.^[203][204] In January and February 2018 the company ran a private sale of futures contracts for Grams,^[205] raising around $1.7 billion.^{[206][207][208][209]} No public offering took place.^[210]

The development of TON took place in a completely isolated manner, and the release was postponed several times.^[211] The test network was launched in January 2019.^[212] The launch of the TON main network was scheduled for 31 October.^[213] On October 30, the U.S. Securities and Exchange Commission obtained a temporary restrictive order to prevent the distribution of Grams to initial purchasers; the regulator considered the legal scheme employed by Telegram as an unregistered securities offering with initial buyers acting as underwriters.^[214]

The judge hearing the Telegram v. SEC case, P. Kevin Castel, ultimately agreed with the SEC's argument^[215] and kept the restrictions on Gram distribution in force. The ban applied to non-U.S.-based purchasers as well, because Telegram could not prevent the re-sale of Grams to U.S. citizens on a secondary market, as the anonymity of users was one of the key features of TON.^{[216][217][218]} Following that, Durov announced the end of Telegram's active involvement with TON. On 26 June, the judge approved the settlement between Telegram and SEC. The company agreed to pay an $18.5 million penalty and return $1.22 billion to Gram purchasers.^[219] In March 2021, Telegram launched a bonds offering to cover the debt and fund further growth of the app.^[189][192]

IRGC

In Iraq and Iran, the Islamic Revolutionary Guard Corps has used groups and channels for doxing citizens and warmongering propaganda.^{[226][227][228][229][230]}

ISIS

In September 2015, in response to a question about the use of Telegram by Islamic State of Iraq and the Levant (ISIS), Pavel Durov stated: "I think that privacy, ultimately, and our right for privacy is more important than our fear of bad things happening, like terrorism."^[231] Durov sarcastically suggested to ban words because terrorists use them for communication.^[232] ISIS recommended Telegram to its supporters and members^{[233][234][235]} and in October 2015 they were able to double the number of followers of their official channel to 9,000.^[236] In November 2015, Telegram announced that it had blocked 78 public channels operated by ISIS for spreading its propaganda and mass communication.^{[237][238][239]} Telegram stated that it would block public channels and bots that are related to terrorism, but it would not honor "politically-motivated censorship" based on "local restrictions on freedom of speech" and that it allowed "peaceful expression of alternative opinions."^[240] ISIS's usage of Telegram reignited the encryption debate and encrypted messaging applications faced new scrutiny.^[241][242]

In August 2016, French anti-terrorism investigators asserted that the two ISIS-directed terrorists who murdered a priest in Saint-Étienne-du-Rouvray in Normandy, France, and videoed the murder, had communicated via Telegram and "used the app to coordinate their plans for the attack". ISIS's media wing subsequently posted a video on Telegram, showing the pair pledging allegiance. A CNN news report stated that Telegram had "become known as a preferred means of communication for the terror group ISIS and was used by the ISIS cell that plotted the Paris terror attacks in November" after the attacks.^[233] Daily Mirror called Telegram a "jihadi messaging app".^[243]

In June 2017, the Russian communications regulator Roskomnadzor hinted at the possibility of a blocking of Telegram in Russia due to its usage by terrorists.^[244]

In July 2017, Director General of Application and Informatics of the Indonesian Ministry of Communication and Informatics, Semuel Abrijani Pangerapan, said eleven Telegram DNS servers were blocked because many channels in the service "promoted radicalism, terrorism, hatred, bomb assembly, civil attack, disturbing images, and other propaganda contrary to Indonesian laws and regulations."^[245] In August 2017, Indonesia lifted the block after countermeasures against negative content were deployed in association with Telegram LLP.^[246]

In November 2019, Telegram participated in Europol's Internet Referral Action Day.^[247] As a result, Telegram expanded and strengthened its terrorist content detection and removal efforts. Over 43,000 terrorist-related bots and channels were removed from Telegram. According to U.S. officials, the crackdown on Telegram was especially effective and seemed to be having lasting impact.^[248] According to Europol, Telegram put considerable effort into removing abusers of its platform.^[247]

Far-right groups

The Anti-Defamation League has called Telegram a white supremacist "safe haven" and a valuable tool for right-wing extremists.^[249] Miro Dittrich, a senior researcher for the Center for Monitoring, Analysis and Strategy (CeMAS), a German extremism monitoring agency, said: "Telegram has been critical for the far-right scene in Germany ever since the Identitarian movement migrated there in 2018, having been kicked off Facebook and Instagram."^[250]

The neo-Nazi white separatist paramilitary hate group The Base switched to Telegram after being blocked on most social media platforms, including Twitter, YouTube and Gab. After a number of arrests of The Base members in January 2020, a note appeared on its official Telegram account warning people to stop posting.^[251] In August 2019, white supremacist Christopher Cantwell posted anti-Semitic comments on Telegram.^[252]

The Anti-Defamation League notes that Telegram was founded by the same two Russian brothers who founded VKontakte (VK), which is known for its lack of moderation when it comes to white supremacy. While Telegram's terms of service prohibit the promotion of violence, they have allowed livestreams of the Christchurch mosque shootings, 2022 Buffalo shooting and the Halle synagogue shooting, all of which were livestreamed by their perpetrators, although other social media platforms had removed them. The League also points to the RapeWaffen Division channel, which openly advocates rape and murder as part of a race war.^[249]

Telegram has also been used by the alt-right organization Proud Boys to coordinate throughout the United States.^[253] In the United Kingdom, Telegram is one of the main platforms for far-right publication TR.news, maintained by Tommy Robinson, and Britain First, whose pages were blocked by major social media platforms.^[254] Weblinks related to these channels received more views on Telegram in 2018 and 2019 than some well-known mainstream news outlets, including The Guardian or the Daily Mail.^[255] However, with a relatively small user base and no algorithmic timeline, such groups struggle to build a larger audience on Telegram.^[255]

In January 2021, Telegram said that it blocked "hundreds" of neo-Nazi and white supremacist channels with tens of thousands of followers for inciting violence.^[256][257] A 2021 Institute for Strategic Dialogue report on the far-right in Ireland found that messages from Irish far-right groups on the app increased from a total of 801 in 2019 to over 60,000 in 2020.^[258]

On 27 August 2021, the U.S. House of Representatives select committee investigating the 2021 United States Capitol attack demanded records from Telegram (alongside 14 other social media companies) going back to the spring of 2020.^[259]

In January 2022, the British anti-disinformation organization Logically reported that Holocaust denial, neo-Nazism and other forms of hate speech were flourishing on the Discord and Telegram groups of the German website Disclose.tv.^[260][250]

On 26 April 2023, Telegram was temporarily suspended throughout Brazil, and the company was fined R$1 million (2023) (US$185,528.76) daily for not complying with a Federal Police investigation into neo-Nazi activities on the platform. The company only partially fulfilled a court request for personal data on two anti-Semitic Telegram groups, which authorities considered an intentional lack of cooperation. The decision was made after a series of violent school attacks, with at least one incident being linked to exchanges on an anti-Semitic group.^[261] The Telegram CEO then said that the requested data was technologically impossible to obtain.^[262] A federal court lifted the suspension three days later, but upheld the daily fine.^[263] Twelve days later, Telegram told its users that the Brazilian Congressional Bill No. 2630 against online disinformation, which was about to be approved, would end freedom of speech in the country.^[264]

Child and teenage pornography

The app has been used for distribution of pornographic material, including child and teenage pornography.^[265][266] Telegram's internal reporting system has an option to report content that contains 'Child Abuse', including specific messages in groups and channels. The company has a verified channel called "Stop Child Abuse", where daily statistics on the number of groups and channels banned for sharing illegal materials are posted. It also provides an email address dedicated to reports of content related to child abuse.^[267][268]

In January 2021, North Macedonian media outlets reported that a now-banned Telegram group, with more than 7,000 members, titled "Public Room" ("Јавна соба") was used to share nude photos of women, often young teenage girls.^[269] Along with the shared photographs, anonymous accounts shared private information of the women, including phone numbers and social media profiles, encouraging members of the group to contact the women and ask for sexual favours.^[270] This was done without prior agreement or knowledge of the women, causing intense public backlash and demand for the group to be shut down. The President of North Macedonia Stevo Pendarovski, along with the Prime Minister of North Macedonia Zoran Zaev, demanded an immediate reaction from Telegram and threatened to completely restrict access to the app in the country if no actions were taken.^[271][272] The group was banned after reports from users and media, although no public statement was made.

Bot abuse

In 2021, a bot was found selling leaked phone numbers from Facebook.^[273]

The chairman of the public organization "Electronic Democracy" Volodymyr Flents on 11 May 2020 announced that a Telegram bot appeared on the Web, which sold the personal data of Ukrainian citizens. It is estimated that the bot contains data from 26 million Ukrainians registered in the Diia application. However, subsequently, deputy prime minister and minister of digital transformation Mykhailo Fedorov denied any data from the app being leaked. The criminal activity of 25 people has already been confirmed and copies of 30 databases were seized.^{[274][275][276]}

A Telegram bot was blocked by Apple in 2020 after posting deepfake pornography.^[277]

Telegram reportedly banned more than 350,000 bots and channels in 2020, including those that contained child abuse and terrorism-related content.^[278]

Myanmar military

Since the 2021 Myanmar coup d'état, pro-junta and pro-military actors, including nationalists and military lobbyists, have exploited Telegram's lax content moderation approach to post violent and misogynistic content against resistance groups, including the National Unity Government, People's Defence Forces, and individuals supporting a return to democracy.^[279][280] The move to Telegram was accelerated by Facebook and Instagram's ban of Myanmar military-linked accounts and ads following the coup.^[281][282] These actors use Telegram to dox women, political and human rights activists, and journalists.^[283][279] The targeted individuals then become a target for physical, sexual, and online harassment.^[279][282] These accounts are used as intelligence sources by the Burmese military to track down and detain such individuals.^[283] These pro-military accounts have also attacked independent media, disseminated military propaganda, and incited violence in the country.^[284][280] In addition, Telegram is also pointed out to be used by fraud gangs in northern Myanmar assisted by the Myanmar military; they use Telegram to communicate and carry out telecommunications fraud for Mandarin speakers and human trafficking for mainland Chinese.^[285]

In March 2023, the Office of the United Nations High Commissioner for Human Rights called on Telegram to allocate resources "to identify, prevent, and mitigate human rights abuses on its platform."^[279] As of March 2023, Telegram had blocked at least 13 pro-military accounts.^[279]

Fraudulent jobs

Telegram has received criticism for its failure to curb fraud on the platform. The most common mode of fraud involves scammers sending messages to unsuspecting users, offering part-time online jobs which comprise a series of tasks. Scammers employ a variety of confidence tricks to entice users into completing "prepaid tasks" in which users deposit money into scammers' accounts with the expectation of receiving high returns.^[286][287]

In July 2023, Hyderabad Police uncovered a fraud wherein 15,000 Indian citizens were duped out of ₹712 crore (US$89 million) in less than a year, all related to "prepaid tasks" on Telegram; a cybercrime police investigation of the money trail revealed that the fraud originated from China and the money was laundered by mules through cryptocurrency wallets.^[288][289]

In September 2023, the Singapore Police stated that more than 6,600 Singaporeans had lost over S$96.8 million (US$72.24 million) to prepaid job scams on Telegram and WhatsApp since the start of the year.^[290]

Security

Telegram's security model has received praise and notable criticism by cryptography experts. They criticized how, unless modified first, the default general security model stores all contacts, messages and media together with their decryption keys on its servers continuously; and that it does not enable end-to-end encryption for messages by default.^[298][299] Pavel Durov has argued that this is because it helps to avoid third-party unsecured backups, and to allow users to access messages and files from any device. Criticisms were also aimed at Telegram's use of a custom-designed encryption protocol.^{[298][300][301][302]} However, in December 2020, a study titled "Automated Symbolic Verification of Telegram's MTProto 2.0" was published, confirming the security of the updated MTProto 2.0 and reviewing it while pointing out several theoretical vulnerabilities.^[303][304] The paper provides "fully automated proof of the soundness of MTProto 2.0's authentication, normal chat, end-to-end encrypted chat, and re-keying mechanisms with respect to several security properties, including authentication, integrity, confidentiality and perfect forward secrecy" and "proves the formal correctness of MTProto 2.0". This partially addresses the concern about the lack of scrutiny while confirming the formal security of the protocol's latest version.^[303][304]

The desktop clients (excluding the macOS client) do not feature options for end-to-end encrypted messages. When the user assigns a local password in the desktop application, data is locally encrypted also. Telegram has defended the lack of ubiquitous end-to-end encryption by claiming the online-backups that do not use client-side encryption are "the most secure solution currently possible".^[305]

In May 2016, critics disputed claims by Telegram that it is "more secure than mass market messengers like WhatsApp and Line",^[78] as WhatsApp claims to apply end-to-end encryption to all of its traffic by default and uses the Signal Protocol, which has been "reviewed and endorsed by leading security experts", while Telegram does neither and stores all messages, media and contacts in their cloud.^[298][299] Since July 2016, Line has also applied end-to-end encryption to all of its messages by default,^[306] though it has also been criticized for being susceptible to replay attacks and the lack of forward secrecy between clients.^[307]

In 2013, an author on the Russian programming website Habr discovered a weakness in the first version of MTProto that would allow an attacker to mount a man-in-the-middle attack and prevent the victim from being alerted by a changed key fingerprint. The bug was fixed on the day of the publication with a $100,000 payout to the author and a statement on Telegram's official blog.^[308]

On 26 February 2014, the German consumer organization Stiftung Warentest evaluated several data-protection aspects of Telegram, along with other popular instant-messaging clients. Among the aspects considered were: the security of the data transmission, the service's terms of use, the accessibility of the source code, and the distribution of the app. Telegram was rated 'problematic' (kritisch) overall. The organization was favorable to Telegram's secure chats and partially free code but criticized the mandatory transfer of contact data to Telegram's servers and the lack of an imprint or address on the service's website. It noted that while the message data is encrypted on the device, it could not analyse the transmission due to a lack of source code.^[309]

The Electronic Frontier Foundation (EFF) listed Telegram on its "Secure Messaging Scorecard" in February 2015. Telegram's default chat function received a score of 4 out of 7 points on the scorecard. It received points for having communications encrypted in transit, having its code open to independent review, having the security design properly documented, and having completed a recent independent security audit. Telegram's default chat function missed points because the communications were not encrypted with keys the provider did not have access to, users could not verify contacts' identities, and past messages were not secure if the encryption keys were stolen. Telegram's optional secret chat function, which provides end-to-end encryption, received a score of 7 out of 7 points on the scorecard.^[310] The EFF said that the results "should not be read as endorsements of individual tools or guarantees of their security", and that they were merely indications that the projects were "on the right track".^[310]

In December 2015, two researchers from Aarhus University published a report in which they demonstrated that MTProto 1.0 did not achieve indistinguishability under chosen-ciphertext attack (IND-CCA) or authenticated encryption.^[311] The researchers stressed that the attack was of a theoretical nature and they "did not see any way of turning the attack into a full plaintext-recovery attack". Nevertheless, they said they saw "no reason why [Telegram] should use a less secure encryption scheme when more secure (and at least as efficient) solutions exist".^[312] The Telegram team responded that the flaw does not affect message security^[313] and that "a future patch would address the concern".^[314] Telegram 4.6, released in December 2017, supports MTProto 2.0, which now satisfied the conditions for IND-CCA.^[299][315] MTProto 2.0 is seen by qualified cryptographers as a vast improvement to Telegram's security.^[299]

In April 2016, the accounts of several Russian opposition members were hijacked by intercepting the SMS messages used for login authorization.^[64] In response, Telegram recommended using the optional two-factor authentication feature.^[64] In May 2016, the Committee to Protect Journalists and Nate Cardozo, senior staff attorney at Electronic Frontier Foundation, recommended against using Telegram because of "its lack of end-to-end encryption [by default] and its use of non-standard MTProto encryption protocol, which has been publicly criticized by cryptography researchers, including Matthew Green".^[298]

On 2 August 2016, Reuters reported that Iranian hackers compromised more than a dozen Telegram accounts and identified the phone numbers of 15 million Iranian users, as well as the associated user IDs. Researchers said the hackers belonged to a group known as Rocket Kitten. Rocket Kitten's attacks were similar to ones attributed to Iran's Islamic Revolutionary Guards Corps. The attackers took advantage of a programming interface built into Telegram. According to Telegram, these mass checks are no longer possible because of limitations introduced into its API earlier in 2016.^[316]

Login SMS messages are known to have been intercepted in Iran, Russia and Germany, possibly in coordination with phone or telecom companies.^{[64][317][318]} Pavel Durov has said that Telegram users in "troubled countries" should enable two-factor authentication by creating passwords in order to prevent this.^[64][317]

In June 2017, Pavel Durov in an interview claimed that U.S. intelligence agencies tried to bribe the company's developers to weaken Telegram's encryption or install a backdoor during their visit to the U.S. in 2016.^[319][320]

In 2018, Telegram sent a message to all Iranian users stating that the Telegram Talai and Hotgram unofficial clients are not secure.^[321]

In March 2014, Telegram promised that "all code will be released eventually", including all the various client applications (Android, iOS, desktop, etc.) and the server-side code.^[322] As of May 2021, Telegram had not published their server-side source code.^[323] In January 2021, Durov explained his rationale for not releasing server-side code, citing reasons such as inability for end-users to verify that the released code is the same code run on servers, and a government that wanted to acquire the server code and make a messaging app that would end competitors.^[324]

On 9 June 2019, The Intercept released leaked Telegram messages exchanged between current Brazilian Minister of Justice and former judge Sérgio Moro and federal prosecutors.^[325] The hypothesis is that either mobile devices were hacked by SIM swap or the targets' computers were compromised.^[326] The Telegram team tweeted that it was either because the user had malware or they were not using two-step verification.^[327]

On 12 June 2019, Telegram confirmed that it suffered a denial-of-service attack which disrupted normal app functionality for approximately one hour. Pavel Durov tweeted that the IP addresses used in the attack mostly came from China.^[328]

In December 2019, multiple Russian businessmen suffered account takeovers that involved bypassing SMS single-factor authentication. Security company Group-IB suggested SS7 mobile signalling protocol weaknesses, illegal usage of surveillance equipment, or telecom insider attacks.^[329][330]

On 30 March 2020, an Elasticsearch database holding 42 million records containing user IDs and phone numbers of Iranian users was exposed online without a password. The accounts were extracted from not Telegram but an unofficial version of Telegram, in what appears to be a possibly government-sanctioned fork. It took 11 days for the database to be taken down, but the researchers say the data was accessed by other parties, including a hacker who reported the information to a specialized forum.^{[331][332][333]}

In September 2020, it was reported that Iran's RampantKitten ran a phishing and surveillance campaign against dissidents on Telegram.^[334] The attack relied on people downloading a malware-infected file from any source, at which point it would replace Telegram files on the device and 'clone' session data. David Wolpoff, a former Department of Defense contractor, has stated that the weak link in the attack was the device itself and not any of the affected apps: "There's no way for a secure communication app to keep a user safe when the end devices are compromised."^[335]

In July 2021, researchers from Royal Holloway, University of London and ETH Zurich published an analysis of the MTProto protocol, concluding that the protocol could provide a "confidential and integrity-protected channel" for communication. They also found that attackers had the theoretical ability to reorder messages coming from the client to the server though the attacker would not be able to see the content of the messages. Several other theoretical vulnerabilities were reported as well, in response to which Telegram released a document stating that the MITM attack on the key exchange was impossible as well as detailing the changes made to the protocol to protect from it in the future. All issues were patched before the paper's publication with a security bounty paid out to the researchers.^{[336][337][338]}

In September 2021, a Russian researcher published details about a bug with the self-destruct feature that allowed the user to recover deleted photos from their own device. The bug was patched prior to publication and Telegram representatives offered a €1,000 bug bounty. The researcher did not sign the NDA that came with the offer and did not receive the award, opting to disclose the bug.^{[339][338][340][341][342]}

In March 2023, the Norwegian National Security Authority (NSM) advised against the use of Telegram and TikTok on business devices (especially the ones used for government related activities), the assessment has been commissioned and supported by the Ministry of Justice and Public Security, Emilie Enger Mehl. Regarding Telegram, the report cites its lack of end-to-end encryption by default, its Russian origins and third-party open source intelligence as major critical points.^[343]

Censorship

Telegram has been blocked temporarily or permanently by some governments including Iran, China, Brazil, and Pakistan. The Russian government blocked Telegram for several years before lifting the ban in 2020.^{[349][350][351]} The company's founder has said he wants the app to have an anti-censorship tool for Iran and China similar to the app's role in fighting censorship in Russia.^[352]