For a few hours on June 27, part of what could be considered Ukraine's "digital nervous system" was paralyzed. Without warning or explanation, the Telegram messaging platform deleted at least five top Ukrainian channels specializing in OSINT (Open-Source Intelligence). Channels such as OSINT-бджоли ("OSINT Bees") and OSINT Flow, vital for identifying collaborators, exposing Russian operations, and educating the public on security matters, simply disappeared. Translated with DeepL.com (free version)
Although access was subsequently restored on June 28 at 5 p.m., the incident was perceived by the OSINT analyst community in Ukraine as more than a technical error. They believe they witnessed a brutal demonstration of an uncomfortable reality for Kiev: the information battlefield on which Ukraine relies so heavily is a rented digital space, and the owner of the messaging app, Pavel Durov, has many connections that he cannot explain to the Russian security apparatus.
The reaction of OSINT channels affected by this "communication failure" was immediate. "We are sure that this is not a coincidence, but a targeted attack on Ukrainian analyst communities," said the OSINT-бджоли team, accusing Telegram of "acting in the interests of Russia", according to RBC-Ukraine.
This accusation, which in the past might have seemed like mere speculation in the context of the current Russian war of aggression, now takes on a whole new weight. The blocking of OSINT channels took place in a context in which Telegram founder Pavel Durov is under scrutiny by French law enforcement agencies.
Arrested in France on August 24, 2024, and subsequently released on €5 million bail, Durov is accused of turning his platform into a haven for terrorism, drug trafficking, and other illicit activities.
But Durov's problems in the West pale in comparison to what a recent investigation by the independent publication iStories uncovered. analyzed by the Digital Forensic Team, revealed details about Telegram's infrastructure. Durov's founding myth—that of a digital exile who fled Russia to protect user data—collapses under the weight of evidence presented by iStories.
The investigation shows that Telegram's physical network of servers and IP addresses is managed by companies such as Globalnet and Electrontelecom. These companies are not just any providers, but verified contractors of Russia's Federal Security Service (FSB). Documents show that Electrontelecom was paid by the Russian state to install and maintain systems used in "operational investigative activities." In short, the people who keep Telegram's network running are the same people who build the Kremlin's surveillance tools.
The vulnerability is not only contractual, but also technical. Unlike competitors such as Signal, end-to-end encryption is not implicit on Telegram. But even in "secret chats," the platform's MTProto protocol attaches an unencrypted device identifier (auth_key_id) to each message. For the FSB, which has access to metadata streams from all internet providers in Russia under the SORM law, this is a gold mine. Without breaking any encryption, Russian services can map entire social networks: who is talking to whom, when, and where. It is an industrial-scale surveillance tool.
Leaders in Kiev are fully aware of the risks associated with Ukrainians' free use of Telegram. Kirilo Budanov, head of Ukraine's Main Intelligence Directorate (GUR), named Telegram just last year as "a threat to the national security" of Ukraine.
However, Budanov acknowledges that the authorities in Kyiv are caught in a dilemma. With millions of Ukrainians relying on Telegram as their main source of news, a total ban is technically difficult and politically unpopular. Budanov's proposed solution is regulatory: requiring news channels operating on this platform to register officially, removing their anonymity.
The recent brief episode of OSINT channels being blocked serves as a reminder that using a messaging service with servers in Russia involves many security risks. It was not just an attack on some channels, but a test for Ukraine's entire information architecture in wartime. Soldiers in the trenches, journalists on the front lines, and citizens in bombed cities are using a tool whose infrastructure is maintained by contractors working for the enemy.
For Ukraine, the question is no longer whether Telegram is compromised, but how to operate effectively in a digital environment that must be assumed to be hostile. War is fought with the weapons available, but when the main communication platform is built on a foundation that leads directly to the FSB headquarters on Lubyanka Street, every message sent becomes a calculated risk.
—
By , Cristian Soare, military analyst and expert Digital Forensic Team
