Signaling To Ghost And Telegram: A Good Time To Talk About E2EE

On Tuesday, September 17th, international law enforcement revealed that it had infiltrated and dismantled the Ghost encrypted messaging platform. The crackdown and subsequent arrests come just weeks after the apprehension of Pavel Durov, the founder and CEO of Telegram. Both cases are still unfolding, with updates on Telegram‘s fate coming daily. As the revelations come, a debate over the place of end-to-end encryption (E2EE) and its relationship to numerous messaging platforms has found itself reignited in time for a major legal decision by EU authorities. Is this part of a pattern creating real reason for concern, or is it all tech-libertarian virtue signaling?

E2EE: A Hot Topic In Europe?

To recap: End-to-end encryption is a method of communication where only the sender and the recipient can decrypt and access the content of a message. The technology ensures that even service providers or intermediaries cannot read the message data. This security feature is particularly popular on platforms like Telegram and Signal, which use E2EE to safeguard user privacy.

Supporters of E2EE (I consider myself among them) argue that it is essential for protecting the privacy of journalists, activists, and ordinary citizens, while critics say it enables criminal activities by shielding bad actors from law enforcement. This debate has fueled regulatory pushes in Europe to incorporate frameworks like the ePrivacy Regulation (Abre numa nova janela), which claimed that it sought to reconcile the need for security with the right to privacy​.

E2EE gets thrown around as a particularly contentious issue in Europe (Abre numa nova janela) due to the EU’s perceived increased commitment to protecting privacy via GDPR (the General Data Protection Regulation) (Abre numa nova janela) while having, at-times, more controversial limits on free speech for security in cases like combating extremism and terrorism. France (Abre numa nova janela) and Germany (Abre numa nova janela) in particular catch heat for this.

To an outsider, it feels like a contradiction: the rights of individuals to control their personal information is held with pretty substantial precedent in Europe. This is largely enabled by encryption, including E2EE, which has been coming under attack (Abre numa nova janela) in the name of increasing law enforcement’s capabilities. I’ll note that my personal feelings are that Europe is largely better on these things despite the reputation. After all, the US doesn’t have the greatest history (Abre numa nova janela) on that end, and has become a veritable wild west of data surveillance (Abre numa nova janela).

This conflict is evident in ongoing discussions about encryption backdoors (Abre numa nova janela), where governments seek to have a way to access encrypted data for investigations while maintaining the security integrity of these platforms.

Privacy advocates warn that any such access could open the door to misuse (Abre numa nova janela) and weaken the overall security of encrypted communications. Some advocates, particularly Meredith Whittaker, the CEO of Signal, state that this is simply a matter of simple fact, not just idealism.

Signal messaging application President Meredith Whittaker speaks during the 2022 Web Summit in Lisbon, Portugal, on November 4, 2022. (Photo by Pedro Fiúza/NurPhoto via Getty Images)

“Instead of accepting this fundamental mathematical reality, some European countries continue to play rhetorical games.”
-Meredith Whittaker, CEO of Signal

It needs to be noted that this belief that disabling E2EE is an entirely necessary move for law enforcement is not (Abre numa nova janela) even (Abre numa nova janela) a conclusion (Abre numa nova janela) backed (Abre numa nova janela) by research (Abre numa nova janela). It may even actually harm government and corporate capacity to comply with current GDPR standards. And considering the current state of the EU’s cybersecurity (Abre numa nova janela), I don’t know if lower standards is something that should be accepted.

So there you have it, right? Even if you’re a diehard anarchist, or want what’s best for ‘the system’, E2EE is good? End of discussion?

So Where Does It Stand?

EU legal bodies have maintained a broadly anti-E2EE stance (Abre numa nova janela), but any measures against it have not yet been put in place. There have been differing visions between EU ministers, heads of state, and law enforcement regarding where compromises should lie.

The most current disagreements revolve around an understandable topic (Abre numa nova janela): Child Sexual Abuse Material (CSAM). The assertion is that encryption will keep authorities from acting in time without some form of pre-encryption scanning or other method of checking uploaded material (with an as-of-now nonexistent technology). This has been the driving force of the prevailing arguments.

Most EU Council governments have asked for a backdoor in such cases, with Hungary (surprise) asking for an outright ban on E2EE. Viktor Orbán’s government has been leading the charge on these reforms while they maintain the Presidency role of the EU Council.

Germany, Poland, Austria, Estonia, Slovenia, and Luxembourg are the other countries allegedly still against Hungary’s push (Abre numa nova janela). The stated reason is that there hasn’t been compelling proof that a demonstrable balance can be struck between privacy, technical capabilities, and national security with such rules in place.

This could potentially change, as the EU Ministers will be meeting on the fate of such a “Chat Control” mandate in just a handful of days, on October 10th.

However, The Netherlands, who have been largely agonizing back-and-forth (Abre numa nova janela) on where they stand, suddenly announced on October 1st that they wouldn’t support such a measure (Abre numa nova janela), citing national security concerns.This may be related to the recent data breaches plaguing the Dutch public sector (Abre numa nova janela).

The Netherlands’ EDRi affiliate, Bits of Freedom (Abre numa nova janela), have been instrumental advocates for E2EE

By changing lanes, The Netherlands will essentially couch the plan for another year.

So Then Why Was Ghost Dismantled?

Ghost was originally marketed as a highly secure encrypted communication platform. Unlike freely available protocols and platforms such as Signal, Session, or Tox, it was operated in a for-profit, clandestine manner that marketed specific mobile devices for the purpose. For reference, the “privacy phone” market rarely goes well, and is usually a scam (Abre numa nova janela).

However, law enforcement agencies claimed that the platform was almost exclusively being used by organized crime (Abre numa nova janela) to coordinate illegal activities, including drug trafficking and money laundering. The Ghost app operated on modified smartphones that provided end-to-end encryption, self-destruct messaging, and a closed user group that made monitoring difficult.

Screen cap of the now-defunct Ghost site (thank you Hacker News for the archive link)

The international operation to dismantle Ghost (Abre numa nova janela) involved law enforcement agencies from nine countries, led by Europol. It resulted in the seizure of assets and 51 arrests in Australia, Italy, Ireland, Sweden, and Canada.

According to the Australian Federal Police (AFP) and Europol, law enforcement agencies infiltrated the Ghost platform by compromising the application’s software updates. Australian police technicians, with cryptographic assistance from the French Gendarmerie and US FBI, modified the software updates regularly pushed by Jay Je Yoon Jung (Abre numa nova janela), the alleged creator of Ghost. This allowed them to install backdoors into the devices running Ghost, ultimately leading to the platform’s takedown in what the authorities referred to as “Operation Kraken”.

Image included with official release by the Australian Federal Police (Abre numa nova janela)

The backdoors implemented through the modified updates allowed authorities to collect data directly from the devices using Ghost. This included intercepting messages, video calls, and other communications that were originally believed to be secure. So… spyware?

What’s Happening With Telegram?

Telegram has been under legal pressure in various countries for several years. Germany and France have both gone after the platform for its perceived lack of compliance with local regulations (Abre numa nova janela) and its refusal to provide access to user data. The assertion is that Telegram’s encrypted messaging can be used to promote illegal activities such as hate speech, terrorist recruitment, and the spread of misinformation.

In early 2024, French authorities began investigating the platform’s role in facilitating extremist content, child exploitation material, and drug trafficking activities (Abre numa nova janela). During this time, Telegram implemented minor updates to its terms of service and moderation policies, but these changes did not satisfy regulators.

As a casual user of Telegram, this feels like a half-truth from both parties, as there is sufficiently evident criminal activity taking place on the platform in publicly available, unencrypted chatrooms all of the time. No spyware needed. It’s the de-facto platform for DDoS-for-hire, crypto scams, and illegal data sales. Anyone remotely indoctrinated into the cybersecurity industry would know that, but I’ll get more into that at the end of this piece.

What a deal!

Pavel Durov, its founder and CEO, was arrested on August 24th upon landing in Paris after a trip from Azerbaijan (Abre numa nova janela), a situation I’m sure many are already familiar with.

The arrest was part of a campaign by European authorities to hold tech leaders accountable for platform misuse, particularly in cases where platforms are used for illegal activities such as CSAM–mentioned above.

French officials charged him with enabling criminal activities on the platform due to Telegram’s historical lack of cooperation. Following his arrest, Durov agreed to comply with some of the French legal requests for user data, a heel-turn from his previous positions.

There is a new policy on data sharing (Abre numa nova janela). Telegram now complies with the divulging of user data to authorities when requested through valid judicial orders. The previous policy only allowed for disclosures in cases involving terrorism or extreme violence. The new policy seems to suggest that sharing IP addresses and phone numbers are now on the table.

The platform’s transparency around data requests remains unclear at this point. Such requests used to be able to be placed with its built-in transparency bot. Since the arrest, it has been under maintenance, obscuring compliance details.

The most stolen/re-shared photo of Durov-will link to photo credit ASAP

Cooperation like this can be easily interpreted as a concession under pressure, but there have been some substantial changes happening with Telegram in the meantime, covered extensively by 404 Media. Almost all of this info, they summarize excellently in their recent podcast episode (Abre numa nova janela) and multiple articles (Abre numa nova janela) on the matter.

Russian officials expressed concern over Durov’s arrest, viewing it as a possible attempt by French authorities to gain access to encryption keys and user data. They proposed relocating him to Russia or the UAE (famously not-corrupt, solid defenders of free speech and data sovereignty (Abre numa nova janela)) to avoid compromising the platform’s encrypted communications.

Following the change, many criminal groups and channels on Telegram have begun migrating to other platforms like Signal and Tor-based messaging apps to avoid data-sharing risks.

Has This Happened Before?

Remember EncroChat? Me neither.

Ghost and Telegram are not alone in facing regulatory scrutiny. Other platforms like EncroChat and Sky ECC have also been targeted and dismantled due to accusations of use by criminal networks.

EncroChat, for instance, was compromised in 2020 by law enforcement agencies (Abre numa nova janela), who managed to decrypt the platform’s communications. The operation was spearheaded by French and Dutch police, and resulted in nearly seven thousand arrests over the past four years. EncroChat, as a business model, was also based on a “hardened” Android platform, advertised as “privacy-focused” phones.

After EncroChat was broken up, many of its users moved to Sky ECC (Abre numa nova janela), an encrypted messaging platform that supported cryptocurrency payments. It was taken down in 2021 (Abre numa nova janela) by Europol, and was determined to be facilitating organized crime. Formal racketeering charges were brought to founder Jean-Francois Eap by the US DoJ in 2021 (Abre numa nova janela). Nearly 900 users were arrested within the first year of the Sky crackdown, and thousands of charges are still being litigated.

All of these faced the same scrutiny that Ghost and Telegram do. All of them were broken up in ways identical to Ghost. However, is this indicative of some authoritarian hammer coming down on our chat programs?

Platforms That Are Built Different

Several other encrypted messaging applications—like Signal, Session, and Tox—are also getting extra attention due to the growing governmental scrutiny over E2EE. Should the EU regulations turn against encryption, they’ll be nearly as much outside the law as any of the previously mentioned platforms.

Nearly as outside the law. They’ve all avoided specific legal accusations through some differences in operational principles and organizational structure that will become glaringly obvious in just a few paragraphs.

Signal has taken a proactive stance against new EU regulations, with its employees actively taking part in the campaign for protecting E2EE. That said, Signal’s infrastructure is designed to minimize data storage—collecting only basic metadata like the date of account creation and last active date—making it impossible to fulfill most legal data requests (Abre numa nova janela). While technically in “compliance” with currently existing laws, this is all of the information that Signal can provide when compelled via a court orders.

It should also be noted that Signal is a non-profit (Abre numa nova janela), making most if its money from donations and grants. There is no direct way to monetize on the app, and the company engages in no transactions with the users.

Session takes this a step further. It’s another free platform that offers a unique approach to privacy by not requiring users to link any personal identifiers such as phone numbers or email addresses. By using the Signal Protocol and Onion Routing, Session provides an additional layer of anonymity that traditional E2EE apps lack. There is nothing for Session‘s owners, the Oxen Privacy Tech Foundation (Abre numa nova janela), to hand over if compelled by law. The assumption is that this also makes them compliant by default.

How does Session financially stay afloat? The OPTF supports it through the Oxen cryptocurrency network and donations from users. There is no traditional funding model or money directly poured into the project, and it does not have any method of monetization.

Tox, a lesser-known but highly secure messaging protocol, operates on a decentralized peer-to-peer network, rendering it virtually impossible for any single authority to shut down or monitor.

Tox’s decentralized client, aTox, is developed in a way that lacks central servers, making it resistant to many of the traditional legal tools used to compel companies to provide data.

Since there is no server infrastructure and Tox doesn’t have the widespread adoption of Signal or WhatsApp, it has very little overhead. It operates as a completely free, open-source project (Abre numa nova janela). There is no way to directly monetize over Tox.

So What’s The Takeaway? (Opinion Time)

Okay. So I think there are a few layers to this that need to be unpacked.

The first and foremost, the most dangerous, the thing that should be the most pressing regarding communication platforms and the state of E2EE is that everyone concerned should be watching for the EU Council’s decision next week.

If E2EE is made illegal, or de-fanged in Europe, there will be a precedent set in liberal democracies for surveillance that I don’t think will be undone any time soon.

My fear is that this would be the first of several privacy dominoes to fall around the world. These are the stakes that everyone who is truly an advocate for digital privacy should care about. What’s very heartening is that it seems there are a number of organizations on both sides of the Atlantic (Abre numa nova janela) committed to this cause.

Thankfully, it seems like the worst-case scenario has been avoided for at least another year.

Virtue Signaling

Time to piss some people off.

What if I told you that you could hold multiple thoughts at the same time: that Europe’s attacks on E2EE are bad and we should fight government overreach, but that Pavel Durov and Jay Je Yoon Jung might also be bad? That they’re not deserving of our advocacy as freedom advocates?

This next point is what I think of as the “distraction”. Not the actual case against Telegram, but how Durov’s arrest is being handled in the media. Particularly right-wing media. Particularly in the US.

Give me a fucking break, dude.

The difference between platforms like Signal, Tox, or Session, and operations such as Telegram, Ghost, and the other dismantled services lies not only in their business models, but in their motivations which fundamentally drive their structures. The difference is ideological.

While these for-profit ventures claimed to offer privacy and security, their business models inevitably created opportunities for abuse—both by criminal enterprises and, indirectly, by the founders who profited from the continued use of their platforms.

No Hero

Unlike true encrypted messaging services, Telegram has operated more as a social media network, with opt-in encryption and a reliance on advertising and investor funding that fundamentally changes its relationship with user data.

Whether you fundamentally disagree with it or not, large social media platforms are required to moderate to a certain degree in North America and Europe. Moderation on Telegram is still lackluster, and has previously been non-existent. Almost every one of Telegram‘s 900 million+ user community knows that. That’s why they use it in the first place.

It seems clear to me that this as an example of “ignoring the problem while it still makes you money”. This hands-off approach, and the extremely suspicious deference from the Russian and Belarusian governments (Abre numa nova janela) has only made its user-base explode in its eleven-year run.

Let’s just call a spade a spade: Telegram is a platform that’s great for criminal actors to get outstanding reach on, Durov profited, and pulled the suspiciously familiar-sounding move of claiming he wouldn’t moderate it for “free speech or whatever”. It’s another grift, and it finally bit him in the ass when he got off the plane.

Maybe he once believed in something, but let’s not forget that in his previous life, he was the creator of VKontakte–Russian Facebook. He’s just the Zuckerberg of Russia.

It’s my belief that Durov’s compliance failures don’t stem from some principled place of free speech absolutism, but laziness and greed. This same flaw haunts VK‘s American counterpart (Abre numa nova janela). A refusal to moderate Facebook for monetary reasons enabled horrific crimes throughout the non-English speaking world.

If Telegram were truly developed as a privacy platform, all data would be end-to-end encrypted by default. Durov’s arrest resulted from his refusal to comply with information requests for data that was readily accessible within Telegram’s infrastructure. This supports critiques made by Signal’s Meredith Whittaker, who pointed out that Telegram’s inconsistent encryption standards make it vulnerable to legal and regulatory scrutiny, unlike platforms that prioritize user privacy at a foundational level.

The very nature of Signal, Tox, and Session makes it theoretically impossible for them to serve the same role as Telegram or Ghost in monitoring or profiting from illicit activities. And while there are some legal challenges to their integrity, they’ve so far managed to weather the storm.

They just had to not be greedy.
They just had to believe in something.

But you won’t hear Elon, Tucker, or Candace Owens talking about that.