Der Spiegel Says Telegram Gave User Data to German Police in Fight against Terrorism, Child Abuse

Messaging service Telegram has reportedly surrendered user data to German authorities despite maintaining on its website that it never ceded to such requests.

Telegram is a cross-platform instant messaging (IM) service best known for its minimal data collection practices and end-to-end encryption (E2EE) qualities that let users communicate without fear of eavesdropping by authorities. Until this report claimed otherwise.

Prominent German newsmagazine  Der Spiegel reported, citing unnamed sources, that (Google translated):

Contrary to what has been publicly stated so far, the operators of the messenger app Telegram have released user data to the Federal Criminal Police Office (BKA) in several cases. According to SPIEGEL information, this was data from suspects in the areas of child abuse and terrorism. In the case of violations of other criminal offenses, it is still difficult for German investigators to obtain information from Telegram, according to security circles.

While the news is certainly welcome from an ethical standpoint, the report sits at odds with Telegram’s claims that it has never disclosed user data to any third party.

“To this day, we have disclosed 0 bytes of user data to third parties, including governments,” reads a portion of the FAQ section titled Do you process data requests?

The FAQ goes on to explain why its encryption mechanism is so strong and what it would take for Telegram to actually surrender any data:

“To protect the data that is not covered by end-to-end encryption, Telegram uses a distributed infrastructure. Cloud chat data is stored in multiple data centers around the globe that are controlled by different legal entities spread across different jurisdictions. The relevant decryption keys are split into parts and are never kept in the same place as the data they protect. As a result, several court orders from different jurisdictions are required to force us to give up any data.”

The company’s privacy policy also reveals that, if it receives a court order in relation to terrorism, it may disclose the suspect’s IP address and phone number to the relevant authorities.

“So far, this has never happened,” the privacy policy states. “When it does, we will include it in a semiannual transparency report published at: https://t.me/transparency.”

Telegram has yet to publish any such report.

Telegram is blocked by some governments, including Iran, China and Pakistan. Russia notably blocked Telegram for years before lifting the ban in 2020.

The service has more than 500 million monthly active users as of January 2021. It is thought to be the most downloaded app worldwide, with 1 billion downloads globally as of late August 2021.