Дыра в Telegram: как силовики деанонят нас в мессенджере Дурова | Расследование

How Russian Authorities Can Identify Telegram Users

The investigation examines how Russian law-enforcement agencies can identify people who post in public Telegram chats and channels, even without access to all of Telegram’s private correspondence.

Surveillance systems and data sources

Journalist Andrey Zakharov reports on a system called Insider, described in police-related materials and a presentation by its developers. Insider can search public Telegram messages by keyword and link posts to user accounts.

Telegram accounts have persistent numeric IDs. These IDs remain unchanged even if users change their phone numbers, usernames, or profile pictures. The investigation says Insider’s database contained roughly 76–80 million links between Telegram accounts and phone numbers, as well as other personal information, including addresses and email addresses.

According to the report, phone numbers and other identifying details are matched using large collections of leaked personal data. Insider can then use Telegram features and bots to connect a phone number to an account. Zakharov says police departments have bought access to the system, including for cases involving online speech, while similar data-gathering tools are treated as illegal when used by others.

The investigation also describes Vitok-OSINT, a system that combines open-source information with leaked data to map people’s accounts and connections. Its developer, Sarma, is presented as a supplier of digital-surveillance equipment to the FSB. The company’s director says he previously served in the state security service.

What this means for Telegram users

Zakharov stresses that public Telegram comments can expose users to prosecution, just as posts on other social networks can. He says Telegram’s persistent user IDs and integrations with third-party services make public activity easier to collect and analyze. Information already gathered may also be retained even after users delete or change account details.

Limits of the available evidence

The report distinguishes this kind of deanonymization from claims that Russian authorities can read everyone’s private Telegram messages. It cites an investigation by Roman Anin about a Russian IT entrepreneur connected to Telegram’s server infrastructure, but says access to servers alone does not provide the encryption keys needed to read messages. Zakharov says the available evidence does not establish mass access to all correspondence.

In a court proceeding, an FSB representative reportedly said Telegram did not generally cooperate with Russian law enforcement, except by providing information about people facing terrorism-related cases. Zakharov says he has confirmed that information has been obtained from Telegram in targeted cases, though how this was done remains unclear.

Suggested precautions

The investigation concludes that Telegram should not be treated as fully secure: ordinary chats are not end-to-end encrypted by default, and authorities may also use account hacking or physical access to a phone.

Zakharov suggests:

• Deleting an account and old public comments if they could attract prosecution.
• Using a separate account for public political discussions.
• Disabling contact synchronization.
• Limiting who can find an account by phone number.

These measures are not a guarantee, since information may already have been collected.

Presenters and contributors

• Andrey Zakharov — presenter and investigative journalist
• Roman Anin — journalist interviewed about Telegram’s server infrastructure
• Evgeny Venediktov — Insider developer featured in a system presentation