For years, the Telegram messaging app was presented by its founder, Pavel Durov, as a bastion of freedom of communication in the digital environment, a safe haven from the prying eyes of authoritarian states.
For millions of journalists, activists, and ordinary citizens, especially in Russia and Ukraine, it was the default tool for secure communication. But over time, Telegram became a preferred platform for far-right activism, conspiracy theories, political propaganda, and disinformation, each with its own target audience.
Pavel Durov, the tech entrepreneur with the air of a libertarian prophet, has built a communications empire valued at over $30 billion on a founding myth: that of the digital exile. His story, which he has repeated in interviews, articles, and social media posts, is one of defiance. A young Russian genius who gave up his first creation, the social network VKontakte, and fled the country to avoid handing over Ukrainian user data to Russia's Federal Security Service (FSB). He then created Telegram, an impenetrable bastion of privacy.
But behind this marketing campaign and his image as a dissident, a series of recent investigations led by the independent publication iStories in collaboration with OCCRP, debunks this myth piece by piece. The reality behind its messaging app is quite different: Telegram's physical infrastructure—its network of servers, routers, and IP addresses—is maintained by companies whose ties not only lead to, but are firmly anchored in, Russia's military-industrial and intelligence complex.
The central figure in this architecture is a phantom character, virtually unknown to the public and even to many within Telegram: Vladimir Vedeneev. Documents from an obscure Florida lawsuit reveal him not only as the owner of Global Network Management (GNM), the Antigua and Barbuda-based company that manages equipment and thousands of IP addresses for Telegram. The same documents identify Vedeneev as Telegram's Chief Financial Officer (CFO), with direct authority from Durov to sign contracts on behalf of the app. This is a level of trust and access that goes far beyond the relationship with a mere supplier.
Here, the connection becomes extremely dangerous. Most of the IP addresses managed by GNM for Telegram previously belonged to telecommunications companies in St. Petersburg, Globalnet and Electrontelecom, both closely linked to Vedeneev. Analysis of public contracts and financial documents is unequivocal: these companies are not just players in the free market. They are verified contractors of the FSB. Electrontelecom, for example, was paid to install and maintain “systems intended for the transmission of classified information... used to carry out operational investigative activities.”
Furthermore, among the clients of these companies is GlavNIVTs, the Main Computing and Research Center of the Russian Presidential Administration. Described as “perhaps the most secretive and least studied special service in Russia,” GlavNIVTs helped plan the invasion of Ukraine and developed digital tools for de-anonymizing internet users. In short: the people who keep the Telegram network running are the same people who build surveillance and cyberwarfare tools for the Kremlin.
This operational symbiosis exploits a fatal technical vulnerability in Telegram's design. Unlike its competitors, end-to-end encryption is not implicit. But even in rare “secret chats,” Telegram's MTProto protocol attaches a unique device identifier, auth_key_id, to each message in unencrypted format. Think of this identifier as a car's license plate number. Even if the windows are tinted and you can't hear what's being discussed inside, you can track the car's every move: where it starts, where it stops, what other cars it encounters, and at what time.
In a country like Russia, where all internet providers are required by law to install SORM (System for Operational Investigative Activities) equipment, the FSB has direct and legal access to this metadata stream. It does not need to break any encryption. It can simply observe these “license plate numbers” to map entire social networks: who is talking to whom, when, and from what physical location. It is a tool for global surveillance on an industrial scale.
Durov's personal narrative completely falls apart in the face of these facts. His alleged “exile” is debunked by FSB border service records, which document over 50 trips he made to Russia after 2014, many coinciding with periods when Telegram was experiencing financial difficulties, followed by the sudden lifting of the app's ban by the Russian authority Roskomnadzor. On the very day the ban was lifted, Durov was in St. Petersburg.
In this context, his recent actions, such as accusing France of attempting to censor “conservative voices” in Romania during the elections, no longer appear to be acts of principle. They fit perfectly into Moscow's hybrid warfare playbook: creating diversions, fueling distrust in Western institutions, and positioning itself as a victim to distract attention from its own vulnerabilities and complicity.
For the millions of users—from activists in Belarus to soldiers in Ukraine—who trusted Telegram's promise of security, the consequences are catastrophic. The app is not just a communication tool, but a theater of operations where Russian intelligence agencies seem to be running rampant. A recent report by the OpenMinds organization shows how 24% of Romanian Telegram channels function as constant vehicles for Russian propaganda, amplifying anti-EU and pro-Kremlin narratives and supporting political actors such as George Simion.
Telegram's official defense—that no contractor has access to data—rings hollow, contradicted by the testimony of its own CFO in court. The question is no longer whether Telegram is compromised, but to what extent and for what purpose this compromise is being used. For the average user, the privacy shield has proven to be an illusion. Telegram is not a fortress, but a glass house built in the backyard of the FSB headquarters on Lubyanka Street in Moscow.
—
By , Cristian Soare, collaborating expert Digital Forensic Team
