Explained | How Telegram became a playground for criminals, extremists and terrorists

For millions of people, Telegram is like any other social media or messaging app.

In Brazil, 167,000 people subscribe to a Telegram channel for news about reality shows and entertainment. More than 1 million users in India prepare for government exams in another channel. And in one called Whale with more than 3 million followers, crypto trading tips are swapped in Persian.

Look deeper, and a dark underbelly emerges.

Uncut lumps of cocaine and shards of crystal meth are for sale on the app. Handguns and stolen checks are widely available. White nationalists use the platform to coordinate fight clubs and plan rallies. Hamas broadcast its Oct. 7 attack on Israel on the site.

Telegram has become a global sewer of criminal activity, disinformation, child sexual abuse material, terrorism and racist incitement, according to a four-month investigation by The New York Times that analysed more than 3.2 million Telegram messages from over 16,000 channels. The company, which offers features that enable criminals, terrorists and grifters to organize at scale and to sidestep scrutiny from the authorities, has looked the other way as illegal and extremist activities have flourished openly on the app.

The degree to which Telegram has been inundated by such content has not been previously reported. The Times investigation found 1,500 channels operated by white supremacists who coordinate activities among almost 1 million people around the world. At least two dozen channels sold weapons. In at least 22 channels with more than 70,000 followers, MDMA, cocaine, heroin and other drugs were advertised for delivery to more than 20 countries.

Hamas, the Islamic State and other militant groups have thrived on Telegram, often amassing large audiences across dozens of channels. The Times analyzed more than 40 channels associated with Hamas, which showed that average viewership surged up to 10 times after the Oct. 7 attacks, garnering more than 400 million views in October.

Telegram is “the most popular place for ill-intentioned, violent actors to congregate,” said Rebecca Weiner, the deputy commissioner for intelligence and counterterrorism at the New York Police Department. “If you’re a bad guy, that’s where you will land.”

Operating like a stateless organization, Telegram has long behaved as if it were above the law — though that may be changing. Pavel Durov, the Russian-born founder of the platform, was arrested and charged in France last month for failure to cooperate with law enforcement and complicity in crimes committed on the service, including the distribution of child sexual abuse material, drug trafficking and fraud.

In many democratic countries, patience with the app is wearing thin. The European Union is exploring new oversight of Telegram under the Digital Services Act, a law that forces large online platforms to police their services more aggressively, two people familiar with the plans said.

Telegram’s tolerance for toxic activities begins with Durov, 39, who runs the company with a devout belief that governments should not interfere in what people say or do online. This year, he wrote on his Telegram channel, “Were it entirely up to us, we would always give our users what they ask for: access to uncensored information and opinions so that they can make their own decisions.”

Telegram has benefited people in authoritarian countries who need ways to freely communicate, but the app has also contributed to real-world harm. Hateful discourse that spread on the platform has played a role in recent riots in Britain and arson at migrant housing centers in Ireland.

A disparate collective on Telegram known as Terrorgram, where neo-fascists share messages and videos encouraging violence, has been linked to attacks, including a shooting in 2022 at an LGBTQ+ bar in Slovakia.

Even as Telegram approaches 1 billion users, it has prided itself on behaving differently from its tech peers. The company, based in Dubai, United Arab Emirates, operates like a startup, with about 60 full-time employees. It has hired just a few hundred contractors to work as moderators, and it steadfastly ignores most requests for assistance from law enforcement agencies.

An email inbox used for inquiries from government agencies is rarely checked, former employees said. When a House committee investigating the Jan. 6, 2021, attack on Capitol Hill sought information from 15 internet platforms, only Telegram did not respond.

In contrast, Instagram, YouTube and TikTok have entire divisions dedicated to complying with law enforcement requests and thousands of moderators scouring their services for illicit and harmful material.

Only Apple and Google, which can expel Telegram from their app stores, have successfully pushed the platform to take down and restrict the spread of harmful material, said analysts, government officials and tech executives. Governments have sometimes turned to the tech giants for help getting Telegram to act.

Hours after the Times sent Telegram a detailed list of questions, Durov on Thursday posted his first comments to his 12 million-plus followers since his arrest. He said claims that Telegram was “some sort of anarchic paradise are absolutely untrue” and that the company removed “millions of harmful posts and channels everyday.”

He attributed the volume of illicit and harmful content to Telegram’s “growing pains,” adding that “that’s why I made it my personal goal to ensure that we significantly improve things in this regard.”

In a statement to the Times, Telegram said that “99.999 per cent of our users” were lawful and that while there was “plenty of work to do,” the platform was making improvements to its features and moderation.

A Marketplace for Crime

In December 2022, Hayden Espinosa began serving a 33-month sentence in federal prison in Louisiana for buying and selling illegal firearms and weapon parts he made with 3D printers. That did not stop his business.

Using cellphones that had been smuggled into prison, Espinosa continued his illicit trade on a Telegram channel, which was named after 3D printing and the Second Amendment right to bear arms, according to an indictment in June by Manhattan District Attorney Alvin Bragg.

One post in the channel’s “shop” offered a menu of prices for weapon parts, including ammunition clips and devices called auto sears, which empty a magazine with a single pull of the trigger. “DM for International Orders,” the post said.

Telegram combines the anonymity of the dark web with the ease of use of an online marketplace. It is easy to search and find channels selling guns, illicit narcotics, prescription drugs and fraudulent ATM cards, called clone cards. Alongside photos and videos of available merchandise, dealers leave information on how to message them directly.

Often they act like salesmen, celebrating successful deliveries and touting discounted prices.

One reason Telegram has become a haven for such activity stems from its unique features, including “channels” and “supergroups,” which rivals such as WhatsApp were slower to add.

Telegram began as a standard text messaging service similar to iMessage or WhatsApp before it began evolving in 2014 by adding broadcasting features. These “channels” are now one of the platform’s best-known tools for sharing text, images, links and videos by news organizations, world leaders and government agencies.

Telegram then introduced “supergroups,” which harked back to an era of unruly AOL chatrooms. These groups attracted new users but also presented risks.

While WhatsApp kept group chat sizes in the hundreds and limited link sharing to blunt the spread of disinformation, Telegram did the opposite and steadily lifted the cap on group sizes. By 2019, a group administrator could run city-size chat groups with as many as 200,000 users.

Initially, this attracted new users interested in cryptocurrencies. In the crypto world, Telegram became a critical tool for talking about new digital coins and cultivating communities dedicated to, and often heavily invested in, particular currencies.

These tools also attracted a less savory group of users, including extremists, disinformation peddlers and sellers of illicit goods.

“I don’t want to paint with a broad brush,” said Bragg, “but I think the combination of a number of things — the encryption, the ability to reach large numbers of people, the ability to set up subgroups and their posture toward law enforcement — creates an environment in which it’s not surprising that criminal activity is occurring.”

Nor has the platform dedicated significant resources to weed this activity out. As Telegram ballooned, its staff barely grew. Today, it has contractors and artificial intelligence tools to proactively monitor the public parts of Telegram, which does not include many groups or individual chats.

The company said it had a moderation process, which includes constantly reviewing content, fielding user complaints and publishing daily reports on child sexual abuse materials.

Even so, the Times found at least 50 channels openly selling contraband, including guns, drugs and fraudulent debit cards. One channel that evoked the Wild West with its name called successful deliveries “touchdowns,” a popular slang in such groups.

Telegram’s features — coupled with its refusal to cooperate with the police — have stymied criminal investigations, increasingly frustrating authorities. The company can gain access to messages unless users select a secret chat option with end-to-end encryption, according to two former employees. On at least two occasions, the company has retrieved the messages of former employees, one person said.

But the company, which denied that employees had access to user data, has refused to share information with governments. France charged Durov with complicity in trafficking child sexual imagery, among other crimes, because of what the chief prosecutor called “an almost total lack of response” to requests for assistance.

Svenja Meininghaus, a state prosecutor focused on illegal hate speech in Germany, said other major social media platforms had developed practices for working with law enforcement. But “we don’t get any cooperation from Telegram at all,” she said, adding, “I can’t recall one case.”

Telegram said it was “now working hard to make sure we can process legitimate requests from democratic countries while still defending the rights of our users elsewhere.”

Espinosa’s gun market on Telegram might never have been uncovered except that one of its members was Payton Gendron, who massacred 10 people at a supermarket in Buffalo, New York, in 2022.

Investigators scouring his life online for motives for the shooting discovered the channel, which also featured racist and extremist views he had shared.

Having stumbled across the channel’s illicit trade in components of untraceable “ghost guns,” an undercover police officer in New York City reached out to Espinosa, 24, and bought a handgun, an assault rifle and two silencers from him in August 2023, according to the indictment. A lawyer for Espinosa with the Legal Aid Society could not be reached for comment.

Live on Telegram, a Terrorist Attack

When Hamas attacked Israel on the morning of Oct. 7, it announced the assault on Telegram.

Within 2 1/2 hours of the first incursions, Hamas began posting grisly videos of the carnage. In the first 72 hours of the war, channels affiliated with the group posted nearly 700 times, receiving more than 54 million views, according to the Times’ analysis.

Telegram became so useful to Hamas that the group turned to the platform more than it did an official Hamas app, the Al-Qassam Brigades Android app, which it had built to communicate with supporters. Content posted to both platforms consistently saw 100 times more reach on Telegram, the Times found.

Hamas capitalized on other Telegram features. After Oct. 7, members of its groups and other supporters easily downloaded videos of the violence and posted them to other platforms with little interference. The effect was a surge of grisly clips across the internet.

After Apple and Google demanded some moderation, Telegram relented — but only a little. In late October, the company restricted access to some Hamas-related content on copies of its app distributed through the official Apple and Google app stores. It also sent some users instructions on how to download another version of the app that did not have the content removed.

“If you wish to continue reading those channels, you can do so using the direct version of Telegram for Android which has the minimum possible restrictions,” said a message sent from an official Telegram account that was reviewed by the Times. It included a link to the unfiltered version of the app.

In contrast, Facebook, Instagram, TikTok and YouTube blocked accounts linked to Hamas, as well as posts that were overtly sympathetic to its cause.

In an Oct. 13 post, Durov defended the availability of Hamas-related content. In one instance, he noted, Hamas had used Telegram to alert Israelis of a coming attack.

This month, Hamas used Telegram to release videos of hostages in Gaza who were later killed. One of the videos, which was viewed more than 1,00,000 times, included English, Arabic and Hebrew subtitles to maximize its audience.

Basem Naim, a Hamas spokesman, declined to comment. After being contacted by the Times, Telegram blocked access to several Hamas channels on Friday.

White Nationalists Unite

Durov, who was born in 1984 in the Soviet Union, became known as Russia’s Mark Zuckerberg after he founded VKontakte, a social network similar to Facebook, in 2006.

As VKontakte took off, Durov said the Kremlin pressured him to remove content and report users, wary of the network’s power to organize anti-government sentiment. That inspired him to start Telegram as a method of keeping communications safe from the government’s prying eyes. The app was released in 2013.

In 2014, Durov left Russia. Since then, he has lived itinerantly, working from Berlin, San Francisco, London and elsewhere before landing in Dubai. Worth an estimated $9 billion, he has become a sort of free speech folk hero.

So on Aug. 24, as news of Durov’s arrest in France ricocheted around the world, the events were debated by a group nearly 5,000 miles away in Montana.

They were members of a local Telegram channel for White Lives Matter, a disparate white nationalist group that adopted the name from the movement formed in 2013 to protest police killings of Black people.

The white nationalist group is inextricably linked to Telegram for communication, recruitment and coordination. On the platform, there are nearly 50 chapters of the movement around the world, in places including Florida, Alabama, New York, Italy, Russia, Germany and the Czech Republic. They share anti-immigration views and commentary and organize protests or other actions, including unfurling racist banners in public spaces, the Times found.

“Join our team, and lets make something good happen for a change!” read a recent post in the Montana channel.

The chapters, which typically have a few hundred members, have been linked to violence. One Ohio member firebombed a church that hosted a drag event in Alliance, Ohio, last year, according to court documents.

The movement takes advantage of Telegram’s features. Known as a hub-and-spoke model, an international channel with more than 21,000 members amplifies broader messages while smaller local groups focus on organizing and recruiting.

Tinier private channels are where activities, sometimes illegal, are planned, experts in extremist movements said. The result was a feedback loop where local actions, such as a vandalism campaign, were amplified globally, which in turn inspired more action elsewhere.

Other far-right nationalist groups have also sprouted on Telegram. In a channel for the American far-right extremist group Proud Boys, acts of political intimidation were planned, including demonstrations outside election centers in 2022 and a campaign this year to steal and damage rainbow LGBTQ+ flags during Pride Month. In Ireland, anti-immigration activists use Telegram to share the locations of immigration centers, some of which were later targeted by arsonists.

Some extremist groups have grown more cautious as scrutiny of Telegram has intensified. Messages pinned to local channels instruct new members on how to stay anonymous.

“Remember: This is a public channel, and not everyone who views it is friendly to people who support WLM,” read a post on one channel. “Write and converse accordingly.”

A new member to one chat was instructed by a group administrator to “please setup a non personal profile picture.” To be invited into more private chats, new recruits must first interact with an automated bot, which connects them with a local chapter after vetting their intentions and background.

“We are here simply because we like what Telegram stands for, uncensored freedom of speech,” an administrator of the channel wrote in response to questions. “Condemning ‘It’s okay to be white’ as hate speech is why we are here and will continue to speak and fight against the anti-white narrative.”

Ahead of the U.S. presidential election in November, security researchers are monitoring Telegram for threats of violence. In many public channels, activists are already making claims of voter fraud, with calls to be prepared to act, said Arie Perliger, a criminology professor at the University of Massachusetts Lowell, whose research is partly funded by the National Institute of Justice, a research agency of the Department of Justice.

If former President Donald Trump loses in November, Perliger said, “we need to understand Telegram will probably be a substantial infrastructure for extremists who want to do something about it.”

Can Telegram Be Brought to Heel?

Several times a year, employees at Apple’s Silicon Valley headquarters send notes to Telegram demanding it remove material that has been flagged as illegal or otherwise harmful.

Apple explains that under its guidelines, the app must have policies to filter out objectionable content and block abusive users, said three people with knowledge of the exchanges who declined to be identified discussing private talks.

Telegram often voices its objections, they said, but it almost always bends to Apple’s demands. Where governments have failed to get the app to act — or even respond — Apple and Google have had some success by using the threat of kicking the service out of their app stores.

With Telegram, the companies are trying to balance the app’s potential harms against its beneficial role as a private communications tool and a critical piece of digital infrastructure in countries such as Ukraine and Russia. They must also consider differing rules about what is classified as illegal speech around the world.

In practice, the most effective way to get Telegram to act is a sort of whisper-down-the-lane approach in which users, advocacy groups, news coverage and sometimes governments draw Apple’s and Google’s attention to the app’s harmful and illegal content. The tech giants in turn notify Telegram to respond.

In addition to Apple’s regular messages to address such content, Google sends requests to Telegram almost weekly, four people with knowledge of the interactions said. Telegram responds quickly when alerted to clearly illegal material like child sexual abuse content, they said, but it is more resistant to demands to address speech-related content that is less clearly unlawful.

Telegram said it abided by Apple’s and Google’s moderation rules. Google and Apple declined to comment on Telegram and said their rules were detailed in developer guidelines.

Durov has grown increasingly antagonistic toward the tech giants. He has called Apple a “trillion-dollar monopoly” and chided the company in April for blocking Telegram on its China app store, writing that “prioritising profits over freedom for users is not a good long-term strategy.”

“The largest pressure toward Telegram is not coming from governments; it’s coming from Apple and Google,” Durov said in an interview this year with Tucker Carlson.