Some thoughts on the arrest of Pavel Durov (Telegram CEO)

Pavel Durov, CEO of “Telegram”, a papular social-media app, was arrested [1][2][3], for complicity and negligence involving the crimes that happen on the platform (the usual suspects: drug trafficking, money laundering, terrorism, pedocriminal content, cryptocurrency fraud).

I have some thoughts.

Arrests of tech exec

First of all, the arrest of tech executives is pretty common.

In 2015, France arrested the General Managers of Uber’s French subsidiary for “running an illegal taxi service”. They were eventually convicted and given slap-on-the-wrist fines — no jail time.

According to rumors, this happens so often to Google that they have an executive whose job it is to travel the world and get arrested. Every time a county wants to arrest an executive, they send the guy to the country with a title like “General Manager” or “Managing Director”. The police come and arrest the guy, who then spends a few nights in jail. Everyone’s happy, local prosecutors get to parade how much they’ve hurt Google by arresting a Top Executive, while the local employees are safe from harassment.

These situations are very much different from cryptocurrency executives who deliberately commit money laundering or fraud (e.g. Sam Bankman-Fried) or whose companies have defrauded people (e.g. Wirecard). In those causes, the CEO committed deliberate crimes.

It’s unclear where Pavel Durov falls on this spectrum, accused of actual crimes, or simply being pressured by law enforcement, or simply detained for questioning. French law is weird, news stories say he detained under a search warrant (“un mandat de recherche”), but I’m not sure I know what that actually means. The statement by the authorities says they are actually investigating another (unnamed) person, not Durov.

Anonymity and Cryptocurrencies

One of the reasons given was “content moderation” of Telegram. This has triggered a lot of pundacracy complaining about “censorship” and “free speech rights”.

But while the original story mentioned “moderation”, the focus was actually on “complicity” in crimes. This is confirmed by the French authorities. In the last few hours, the French authorities have issued a press release detailing the charges. They don’t mention “moderation” or “censorship at all”, except for pedocriminal images, which are illegal everywhere.

How is Telegram actually “complicit” in crimes?

Firstly, it provides anonymity. While Telegram theoretically requires a phone number to sign up (identifying the user), in practice it allows people to freely signup with disposable phone numbers. Also, users can pay to create anonymous accounts without any phone number at all. Finally, it’s notorious for not helping governments tracking down IP addresses.

Secondly, Telegram uses cryptocurrency. Telegram has it’s own “wallet” feature supporting Bitoin, Tether, and it’s own currency “Toncoin”. It makes cryptocurrency payments easy — by which I mean anonymous payments for crime.

Law enforcement hates such things, it’s a bigger issue to them than censorship or pedocriminal images.

There is certainly an element of human rights here, but it’s not free-speech, but anonymity and pseudonymity. Governments are busy trying to outlaw anonymous transactions. For example, in the United States, the government can access your credit-card records without a warrant, refuses to issue bills larger than $100, and if the police catch you with a few thousand dollars in cash, they can simply take it under “civil asset forfeiture” even though it’s not technically illegal to carry that much cash.

Telegram isn’t an encrypted messaging app

The listed charges also mention illegal cryptology. It’s unclear whether this means end-to-end encrypted messages or cryptocurrencies or something else.

Telegram describes itself as a “messaging app” with “end-to-end encryption”, but this isn’t really true.

While it’s true Telegram claims to allow “secret” messages that are end-to-end encrypted, this feature is not the default, and most people don’t use it. Twitter also supports encrypted Direct Messages (DMs), but this doesn’t make it an encrypted messaging app, either.

Telegram is an app that supports an end-to-end messaging feature, but is itself not an end-to-end encrypted messaging app like Signal or WhatsApp.

What actually makes Telegram popular is its “group” chat features that make it a social-media platform like Discord, Reddit, or 4chan. It has chatrooms for like-minded people. Telegram cannot encrypt such group chats, and in any case, law enforcement can simply join as a member of the group and see them anyway. So much of law enforcement these days consists of informations that are members of chatting groups.

The cryptology charges

It’s not clear how the cryptology charges actually relate to cryptology. It seems obvious to everyone else, but it’s not obvious to me.

French law states that encryption algorithms/code need to first be declared to the government. The charges state that Telegram failed to do this, providing encryption without having first given the French government details of the algorithm and code.

Everyone assumes these charges refer to the end-to-end messages, but they could refer almost anything. Every app uses encryption, such as SSL to communicate with servers, or AES to encrypt local files on the phone. In 2004, encryption in an app was rare, but in 2024, it’s universal — every app does it.

Conversely, the end-to-end feature isn’t necessary an encryption algorithm. Instead, it uses algorithms like AES or SHA2 or Diffie-Hellman. The feature itself would more precisely be called a protocol. Indeed, Telegram names it “MTProto”. I’m not sure the French law covers just the crypto algorithms or also the protocols.

Maybe instead they are going after the Bitcoin wallet built into Telegram, which is “crypto”. But Bitcoin doesn’t do encryption, it only does integrity checking and authentication. The French law on cryptology explicitly excludes integrity checking and authentication, so seems to explicitly exclude Bitcoin.

The point is simply that I can plainly read the charges and the law and I still have no idea what they mean, especially French law which works different from English/American common law.

Conclusion

I’m clueless here, just a deeper level of cluelessness.

I suspect here is that this is just the French way of coercing Telegram to help them with criminal investigations, that Durov is not facing 20 years in jail for any actual crimes.