Terrorists’ love for Telegram, explained

Ahmet Yayla cited in Vox article

By Rebecca Tan

Terrorism and intelligence experts have known for years that the encrypted messaging application Telegram is now the “app of choice” for terrorists, and specifically for ISIS.

The ISIS members behind the 2015 Paris attacks used Telegram to spread propaganda. ISIS also used the app to recruit the perpetrators of the Christmas market attack in Berlin last year and claim credit for the massacre. More recently, a Turkish prosecutor found that the shooter behind the New Year’s Eve attack at the Reina nightclub in Istanbul used Telegram to receive directions for it from an ISIS leader in Raqqa.

Despite all this, the app hasn’t faced any formal pressure to crack down on the terrorist groups on its platform — until now.

On Wednesday, Telegram founder and CEO Pavel Durov, who is from Russia, agreed to provide basic information about the company to the Russian government after it threatened to ban Telegram for enabling terrorist attacks. This came days after Russia’s main security agency, the FSB, said it had “reliable information” that terrorists used Telegram to plan the deadly St. Petersburg attack that killed 15 people in April.

The Russian government seems appeased for now, but the debate surrounding Telegram’s role in terrorism isn’t going away. Government agencies are going to continue demanding that Telegram release more of its user information or provide a “back door” for intelligence agencies to access encrypted messages, and Telegram is going to continue fighting them.

On Wednesday, Durov emphasized that the company wouldn’t share confidential user data with anyone even though it’s passing over some basic information about Telegram to the Russian government. This is because privacy isn’t just one of Telegram’s features; it’s Telegram’s brand.

Launched in 2013, the company has marketed the app as a secure messaging platform in a world where all other forms of digital communication seem trackable. It has arguably become the most popular app of its kind — garnering more than 100 million monthly active users as of 2016 — by promising features such as end-to-end encryption (which prevents anyone except the sender and receiver from accessing a message), secret chatrooms, and self-destructing messages.

“Its reputation is as the medium that can’t be decrypted,” says Ahmet S. Yayla, a counterterrorism expert from George Mason University who has spent two years tracking ISIS on social media. “People love the idea of privacy.”

Durov isn’t about to give up that branding. The deal he signed with the Russian government on Wednesday shows that he’s willing to compromise somewhat if it means keeping the 6 million Telegram users in Russia, but not that he’s backing down from maintaining the app’s reputation.

Telegram’s unique features will continue to attract and be used by those who value secrecy, and, at least for now, that includes terrorists.

Telegram did not respond to multiple requests for comment on this article.

Secret chats and open channels in one platform

Government agencies tend to get preoccupied with Telegram’s encryption technology, but that in itself isn’t what draws terrorists to the app, says Jade Parker, a senior research associate at the TAPSTRI research group who specializes in terrorists’ use of the internet.

Users on Telegram can communicate in channels, groups, private messages, or secret chats. While channels are open to anyone to join (and thus used by terrorist groups to disseminate propaganda), secret chats are virtually impossible to crack because they’re protected by a sophisticated form of encryption.

The combination of these different functions in a single platform is why groups like ISIS use Telegram as a “command and control center,” Parker says. “They congregate on Telegram, then they go to different platforms. The information starts in the app, then spreads to Twitter, Facebook.”

It’s the fact that the app integrates several important functions into one platform that draws groups like ISIS to it, Parker explains. But this isn’t something government agencies see. Instead, they tend to zoom in on just one of Telegram’s functions: its secret chats.

Secret chats are protected by end-to-end encryption. How this works is that every user is given a unique digital key when they send out a message. To access that message, the receiver has to have a key that matches the sender’s exactly, so that messages from any one user can only be read by the intended recipient. This makes it almost impossible for middlemen such as police or intelligence agencies to access the flow of information between the sender and receiver.

Even if police can identify who is speaking to whom, and from where, they have no way of knowing whatthey’re saying to each other. In fact, because the encryption happens directly between the two users, even Telegram itself has no way of knowing what’s in these messages.

Telegram isn’t the only messaging app that uses end-to-end encryption (others include WhatsApp and Viber), but the app takes its commitment to security one step further with snazzy functions such as a self-destruct timer. Before a user sends a message in a secret chat, they can choose to set a self-destruct timer on it, which means that some time after the message has been read, it automatically and permanently disappears from both devices.

And as Parker pointed out, it’s not just the security that terrorist groups like. It’s that this security comes coupled with other functions. Terrorist groups are rapidly expanding organizations, and that means it’s incredibly useful to be able to receive a confirmation video from an attack through a secret chat and immediately blast it out to more than 1,000 followers in a channel as propaganda.

It’s really easy to join the app — and stay on it

Compared with other social media platforms, Telegram has extremely low barriers to entry. All users have to do to set up an account is provide is a cellphone number, to which the app then sends an access code. According to both Yayla and Parker, it’s common practice for terrorists to supply one cellphone number to set up their account but use another to actually operate the account.

“The SIM card you use to open your Telegram account and the SIM card you actually use on the phone with the application don’t have to the same,” Yayla explained. “So you can be the fakest person in the world.”

Not only does this make it harder for law enforcement officials to track down terrorists through Telegram, it also makes it easier for terrorists to set up a new account once they discover their previous one has been exposed to the police.

Another attractive feature of the app is that it’s really quite hard to get booted off it.

Two years ago, ISIS’s preferred social media platform was Twitter, not Telegram, says Todd Helmus, an expert on terrorism and social media at the RAND Corporation. But Twitter, along with other mainstream platforms like Facebook and Instagram, has since gone out of its way to take down ISIS accounts, pushing the group out of the app. In August 2016, Twitter said it had taken down 360,000 terrorist-related accounts in the past year alone.

While Telegram has also cracked down on ISIS-operated channels — it shut 78 down in the wake of the 2015 Paris attacks, and has since taken down hundreds more — its efforts don’t seem to compare to those of other platforms, which some experts think is driving terrorists toward the app.

Our policy is simple: privacy is paramount. Public channels, however, have nothing to do with privacy. ISIS public channels will be blocked.— Pavel Durov (@durov) November 19, 2015

“Telegram is not very reliable in shutting down these [ISIS-operated] channels,” says Yayla, who has spent the past two years joining and tracking these channels on Telegram. While Telegram has said that terrorist-run channels are taken down within hours, Yayla says he is currently following an ISIS-run channel that has been operating freely for the past two weeks.

This isn’t necessarily because Telegram isn’t working as hard to counter terrorist material, but because the nature of the app makes it much more difficult to selectively prohibit users, Parker says. Telegram can go after ISIS-related channels, but it rarely ever shuts down anyone’s account (and even if it did, it would take a user mere seconds to set up another one).

This means that when ISIS’s propaganda channels are shut down, they can easily set up a bunch of other replacement channels — which, in fact, is exactly how they’ve been responding to crackdowns.

“You can create a new channel within 30 seconds. So now, instead of opening three channels, [ISIS] opens 50 channels to spread propaganda,” she notes. “Deleting their channels doesn’t put a dent in their activity.”

Going after Telegram isn’t the solution

To Yayla, there’s no doubt that Telegram needs to do more, though he doesn’t think that banning the app, or threatening to do so, is the right way forward.

“If Telegram is blocked in Russia, terrorists will be able to find another applications in just one or two days,” he says. “Yes, it will be inconvenient, but it won’t stop them.”

Telegram representatives make the same argument. In a blog post titled “Don’t Shoot The Messenger,” Telegram spokesperson Markus Ra said banning Telegram or forcing the app to remove its encryption service will only push terrorists to source out other alternatives, many of which are readily available. In fact, ISIS members are already using other encrypted messaging apps such as Chat Secure and Jabber along with Telegram, and they’re on the lookout for more, says Parker.

“Shutting down Telegram … ISIS is just going to move somewhere else,” Parker says, adding that the recent buzz around Telegram has already prompted ISIS leaders to look into moving some of their social media presence onto a San Francisco-based application called Baaz.

This, of course, doesn’t mean that nothing should be done. It just means that the threat Russia issued to Telegram earlier this week is a simplistic reaction to a really complicated problem. Governments do need to find a way to stop terrorist organizations from abusing some of the powerful functions in these applications, but blustering to ban these apps isn’t going to do it.