According to reports, messaging service Telegram handed over user data to German authorities despite maintaining on its website that it never complied with any such request.
Telegram is a popular cross-platform instant messaging (IM) service best known for its minimal data collection practices and end-to-end encryption (E2EE) qualities that let users communicate without fear of being monitored by authorities.
Citing unnamed sources, German newspaper Der Spiegel reported that, “Contrary to what has been publicly stated so far, the operators of the messenger app Telegram have released user data to the Federal Criminal Police Office (BKA) in several cases. According to SPIEGEL information, this was data from suspects in the areas of child abuse and terrorism. In the case of violations of other criminal offenses, it is still difficult for German investigators to obtain information from Telegram, according to security circles.”
This report conflicts with Telegram’s claims that it has never disclosed user data to any third party.
“To this day, we have disclosed 0 bytes of user data to third parties, including governments,” reads a portion of the company’s FAQ section titled Do you process data requests?
The FAQ then explained why its encryption mechanism is so strong and what it would take for Telegram to surrender any data to authorities.
“To protect the data that is not covered by end-to-end encryption, Telegram uses a distributed infrastructure. Cloud chat data is stored in multiple data centers around the globe that are controlled by different legal entities spread across different jurisdictions. The relevant decryption keys are split into parts and are never kept in the same place as the data they protect. As a result, several court orders from different jurisdictions are required to force us to give up any data.”
The company’s privacy policy also revealed it may reveal a customer’s IP address and phone number to law enforcement if it received a court order relating to terrorism.
“So far, this has never happened,” the privacy policy states. “When it does, we will include it in a semiannual transparency report published at: https://t.me/transparency.”
However, Telegram has not yet published any such report.