Hello everybody. Welcome to the mindplex podcast today. We are here with senior staff attorney and civil liberties director David Green from the EFF Hi, David,
David Greene:Hey Lisa, hi everybody,
Lisa Rein:and we are here to talk about the telegram situation, and David's here to tell us all about it. David let us know, like, why was Pavel drive arrested? What's going on?
David Greene:Yeah, so I should first say that we actually know very little about about what has happened, because the French government has said very little, so there's been a lot of guessing going on. So I'm gonna try and be really careful to
Lisa Rein:Well, that's important if we don't actually know a lot, because people have been saying a lot of different things, and I keep on reading
David Greene:all these articles like, oh, maybe they found something, but they didn't everyone, I think is there's, there's a lot of tea leaves, but not a lot of consistent reading of those tea leaves and so but I can tell you what we do know, which is mostly based on press releases that have been issued by the French government. But I think really importantly, they're just press releases. We don't have any legal documents or anything like that that I think we have a greater confidence in and the other thing I should say is that I am not a French lawyer. I have no expertise at all in French law. I have speak French. I speak it okay, but not as a lot anyway. Just to say that, like all these documents, are originally in French. Some have some English translations. And I we, I've spoken with some French lawyers, you know, to try and but again, there's a lot of reasons for I'll do the best I can. Okay, so we know very little. What we do know is that that Durov was originally arrested under what's called an what's sort of what's in, like an investigatory warrant. And France, and in France, they're allowed to when they're doing a criminal investigation, they believe someone has information about the investigation, they're allowed to detain that person for 48 or 96 hours, depending on the chart, depending on what's being investigated, just so they can try and get information from that person. So that's what happened. He was arrested because they were doing some type of investigation. They thought Dora, I've had information, they ended up using the procedure to get a 96 hour detention. And then what happens at the end of that time is that they're forced to either formally, formally identify him as the subject of an investigation, which then will allow them to put limitations on him going forward, or they have to let you know completely release it. And they did the former. They so he is currently, currently the subject of a formal, the formal subject of investigation, and because of that, he is, he can't leave the country. He's not like incarcerated at the moment, but he he can't leave the country. And there's some other limitations on what he's on, what he's doing. So that's where we're up to so far. And what I don't, I don't think he's he hasn't been charged with a crime, but he is a subject of a formal investigation relating to certain times. And I think maybe the best, maybe I've been told that indicted might be the best English word, but he hasn't actually been charged with a with a crime,
Lisa Rein:so indict. It's not the best word, yeah, well,
David Greene:a lot of the translations have said charge. And again, in my rudimentary French, I saw the phrase misan misle, examine, which I charge? That's you. That's okay. Investigation.
Lisa Rein:In France, they have warrants just to question people, yes, in an investigation, if they're just investigate, if they're just being investigated for a crime, whereas, as here, you if you're not the subject of investigation, they have to make something up to take you in? No, I'm just kidding. Just saying it's harder to question people sometimes because they don't. We don't have a mechanism like this in the United States, correct, right? Well,
David Greene:not, yeah. I mean, we it's you have the ability to bring someone in for questioning, but there you can't detain not. We don't have a warrant for you. We don't have a situation where you have sort of a long term restrictions on somebody because they're formally being, formally being invested. That's not, it's not a procedure we have in the US.
Lisa Rein:Okay, so that's part of the confusion to begin with. Is that people are thinking, you know, and they didn't come pick him up. They got him when he landed at the airport. Yeah,
David Greene:correct. Yeah. Little private airport, I guess, too. Yeah. Yeah.
Lisa Rein:So they knew he was coming there. They were waiting for him, yeah,
David Greene:you know. And some people I, the people I've talked to in France, have said that the idea that that he was under investigation and wanted, they wanted to bring him in, was semi public in July, and he probably should have known it, and he it's, he shouldn't have been surprised that he was actually arrested when he landed, um, in France. But again, it's hard to know what, what he knew, or if he thought he was invincible, or who, or whatever. Who knows?
Lisa Rein:Okay, so we'll never, we never know what really, yeah, what really happens there, until, like, again, there's actual information given. Okay, um, so is this the is this EU related? This? These crimes? Is this about EU violations?
David Greene:It's a good question. It again, we don't know, because we don't know what the actual charges we I mean, we have subject matters, and none of these seem to be related to violations of EU law. They seem to be related to particularities of French law. And I think some of the European EU commissioners have said that there's nothing in the, for example, the Digital Services Act that would compel that, that compels a the thing France is looking into. But again, we know so little about it that it's hard to tell
Lisa Rein:the Digital Services Act. Yeah, the Digital
David Greene:Service Act is the main regulator. It's a huge, enormous regulation that's in effect in the EU that put certain requirements to mitigate risk on on online platforms, they vary by size. I'm not even quite sure which size, if telegram has enough user to be in sort of the biggest category, which has the most requirements or not, okay. But anyway, I think the commissioners have said they don't think this is about the DSA. So do know that are
Lisa Rein:listing, you know, terrorism, lack of content moderation, this that? Yeah, they're just making stuff up at this well. So
David Greene:what we know, what they what they've said, is that there was what they are invest, what the subjects of the investigation would be, a refusal to comply with a request for information, and that information or or or to provide documentation or information in response that that the government believes is necessary to implement a legally authorized interception. So the government was trying to intercept communications. It's unclear what that meant, live interception, like a wiretap, or whether they're trying to get records. It's we all we know that's we don't know any of that detail, and that a telegram refused to comply with that request, so refuse to give them the information. So what that could mean can range from it like the worst case scenario, right is that the government wanted to wiretap and listen in live or read live on the small subset of telegram communications that might be end to end, encrypted like that would be the worst case scenario. The better one could be that, you know, it was one of the, you know, they were interested in the communication that was one of the much lesser protected things, and maybe the ones that are sort of, that aren't and encrypted, but have some encryption in them, but we don't, we don't know, or they could actually just needed help, like looking at the completely public stuff. So, you know. So
Lisa Rein:let's talk about that for a minute. It ranges.
David Greene:The possibilities range from the completely benign, uh, geo two, right? Be really concerning, and we really have no idea where it falls on that scale. We do know they did tell us the the criminal offenses they're investigating. So we know those are child, sexual assault, material, drug trafficking, organized fraud and money laundering. So that's the that's what they think might be happening on that those are the crimes. They're the underlying crimes they're investigating. Okay?
Lisa Rein:And the issue again is though, so if it was an encrypted group chat, it would like signal or WhatsApp, it would be encrypted, and only the people in the group would be able to see what is in it. But Drum roll, please. Telegram group chats are not encrypted, right?
David Greene:They're not end to end encrypted, right? I don't know if they have some layer of encryption on them, but they are, they are, you know, or maybe it's private chats have some layer but unless you're again, well. Code
Lisa Rein:you have to have you unless you turn on the secret chat feature between two people. It only works. Doesn't work for groups. No, I've been looking this up your own. Eva Alpern, so Eva Alpern brings this up in 2022 when she does her harm reduction guide for the Ukraine and Russia, because people involved in that conflict we're using Telegram, thinking that it was encrypted and secure, yeah, by and by default, which a secure messaging app should be, by default, if it wants to call itself a secure messaging app, like, again, like signal and WhatsApp, and so I'm a little if this comes into things, whether or not here in the States, it might be protected speech, if it's in an encrypted, private chat group, as opposed to a public channel or a public Group. Could you explain the difference why? It's because on Telegram, there's either public channels or there's private channels, where it's really easy to fake an invite to like there's videos on YouTube, you just switch out the name in an invite from another group, and you can join any group.
David Greene:Yeah. I think what a lot of people don't understand about telegram is that, you know, a lot of people, especially in the US, think of telegram as a messaging service, but it's more, most commonly used around the world. It's like a social media platform. So there's groups, and people can publish stuff, and you can, you know, there's feeds and things, you know, all the stuff you look at for social media, and a ton of communications obviously happens there. And the groups are very, very active, similar to they, you know, have on, you know, on other things that start as messaging apps that then have groups that then publish stuff broadly, yeah, and so that stuff is mostly, mostly completely public, right? There's, there's no control for that at all. Then when you have one to one communications, each person, if you want to be end to be end to end encrypted, so you don't you don't want telegram to have the content of the communication that's unique for end to end encryption, both people have to turn on the private function. If only one person turns it on, then it might be protected in one direction, but not the other one. And so that, and this is important, because the French government could just be asking Telegram for the unencrypted communications that it has, because the communication wasn't end end encrypted, right? It was only other one end, or it had some level of encryption in transit, but not otherwise. So it could be, they're just saying, We know you have this, give it to us, right? That's one possibility. Um, or again, if it was an end to end encrypted communication, that's completely different. Telegram wouldn't have that. Wouldn't have the con, wouldn't have the conversation,
Lisa Rein:right? Which is the point of the end to end encryption is that the platform itself, even you know, can't, can't look if it, if it wants, because it's it's actually encrypted. Um, so yeah, just to be clear on this point about no encryption, Moxie marlin spike says telegram messages aren't end to end encrypted. And he also brings up that it's a cloud messenger, meaning that all messages live on telegram servers, rather than the user device. Could you explain the significance of that?
David Greene:So, again, this all goes back to, does telegram have information that they're in their possession that they could give to the French government, that, I mean, that they they have the capability of giving to the French government. So, so if the information is stored on their servers, then they have it, right? They have something they could provide to the French, to the French government, the most secure communications, fact, really the only secure communications. The information is not the information may pass through servers, but it's not stored or retained there at all. So, so when there's something like signal, or something as a reliably end to end, encrypted, system. It can, you know the it can exist on your device. You know the records of the communication will exist on your device, but they only pass through other things, and there's no retention at all. And so if that's that again, it creates the possibility that telegram might have information like might actually possess the information that the French government wants and that and so that's why, maybe this request for information pertains to that, you know, if they made a similar request to like signal, you know, then signal say, we don't have anything. So
Lisa Rein:could this sound like something when the the feds, in this case, the French government, are trying to get information about users telegram users, and telegram is just stalling, you know, not giving it to them. Like when, like when our government gives Google. Where it's when it's fishing, you know that kind of thing? Yeah,
David Greene:so we know there was an authorized interception. So we know that, which under French law, I've been told, is not, it's not something that requires, like a court, a court approval. So it's
Lisa Rein:really me an authorized interception. So they listened. They got some data, Telegram data from somewhere
David Greene:they had, they got, they have a government order saying to get it, and that telegraph did part of an investigation, yeah, didn't help them get it right? And so we So, we know, we know that, and so, but we don't know what that means, right? We don't know what that is. And so it but it seems, I think what we I think it's pretty safe to assume that the French government is seeking information about either the actual contents of communications from telegram users, or information about those users or their identities, or something. So it seems like that's what this authorized interception would be about the word interception, as you know, from, again, we're translating from the French, but it's, it's the same way it's, you know, interception in English and interception and in French, that does seem to be like close to a wiretap. Again. There's lots of ways that governments can intercept, and we don't know if it's a real time interception we're trying to get in transit communications as the people are communicating, or if it's something looking for historical
Lisa Rein:record. Okay, so the moral of the story is, if telegram allowed you to do truly end to end, encrypted group chats, then we don't have to worry when the government's asking for this and that, because telegram wouldn't have the ability to hand the data over.
David Greene:Yes, if so, I mean, you know the worst case scenario, right? So, yes, if, if telegram did not possess the data, possess the data because it only uses its stores on its own servers, then we'd be looking at a situation where what the they government would be like, so much like the Apple versus FBI situation, the US right, where what the government tried to do was say, Okay, we know you don't have the data, but why don't you just break all the security on your phone? Yeah? So give us a key. They
Lisa Rein:do it about every four years. Yeah, yeah. Give us a back door. Help. Yeah, that's, that's
David Greene:a possibility here, but it does seem, I think, as Moxie said, that, like, it doesn't seem like that would be necessary here, because it's more likely that, you know, if they're that it's all public anyway. Get, yeah, get the, get the stuff they possess, instead of having to sort of break the bike, you know. And again, there's if they are trying to do something where it said, we need your help in decrypting information, whether that's the key or back door, or a man in the middle, or something like that, like that, would be highly, highly concerning. That's a possibility, but you don't want, yeah, I mean, and that's a possibility, but there's also a lot of other things, so it's hard to know how panicked we should be about this. All right,
Lisa Rein:so, but if you, but if you're trying to have encrypted group chats, you're not going to be doing it on telegram. You not do it on telegram. And in fact, your private channels, it's very easy for anybody to join them. So, so that's, that's good to know, because I didn't know that coming into this I was, you know, was very confused about that. So thank you so much, David. I know you're very busy. I appreciate you coming on and clearing everything up for us, and we'll probably see you soon, maybe in a couple weeks, and do a little update as things develop on this. Yeah, hopefully we'll know more. All right, thanks a lot, David, thanks. Lisa. Bye.