Telegram has provided the German Federal Criminal Police Office with user information in several cases, contradicting the company’s statements about complying with law enforcement.
Telegram, which is not an encrypted messaging application by default, released user data to the Federal Criminal Police Office (BKA) in several cases, according to a report from Spiegel. According to the news outlet, Telegram handed over subscriber information for the suspects in “child abuse and terrorism” investigations.
The company claims that they have disclosed “0 bytes of user data” to law enforcement:
Do you process data requests? “Secret chats use end-to-end encryption, thanks to which we don’t have any data to disclose.”
“To protect the data that is not covered by end-to-end encryption, Telegram uses a distributed infrastructure. Cloud chat data is stored in multiple data centers around the globe that are controlled by different legal entities spread across different jurisdictions. The relevant decryption keys are split into parts and are never kept in the same place as the data they protect. As a result, several court orders from different jurisdictions are required to force us to give up any data.”
“Thanks to this structure, we can ensure that no single government or block of like-minded countries can intrude on people’s privacy and freedom of expression. Telegram can be forced to give up data only if an issue is grave and universal enough to pass the scrutiny of several different legal systems around the world.”
“To this day, we have disclosed 0 bytes of user data to third parties, including governments.”
According to Spiegel, “it is still difficult for German investigators to obtain information from Telegram” when investigating crimes outside of the scope of purported “terrorism” or child abuse. Since 2018, if not earlier, the company has been moving towards a state of functional compliance with various Western governments. A privacy policy change in 2018 allowed for the disclosure of IP addresses and phone numbers if required by a court.
The paragraph below appears under a section titled, “Who Your Personal Data May Be Shared With” in the company’s privacy policy.
Law Enforcement Authorities
“If Telegram receives a court order that confirms you’re a terror suspect, we may disclose your IP address and phone number to the relevant authorities. So far, this has never happened. When it does, we will include it in a semiannual transparency report published at: https://t.me/transparency.”
Governments have historically used the “terrorism loophole” to justify invasive measures. Since the United States spies on Americans for counterterrorism purposes, there is no reason to believe Germany would not use the same excuse.