Wiretap is a weekly digest of cybersecurity, internet privacy and surveillance news delivered to your inbox. Sign up here to get it delivered to your inbox.
Pavel Durov, founder and CEO of Telegram (Photo by AOP.Press/Corbis via Getty Images).
Corbis via Getty Images
More recently, attention has been focused on the darker side of his Telegram platform following the arrest of CEO and founder Pavel Durov. For years, Telegram has been a repository of the worst content imaginable. This week, the Department of Justice charged Army soldier Seth Herrera with possessing and transmitting child sexual abuse material (CSAM) and using an AI tool that generated images of children. According to the criminal complaint against Herrera, he “created his own public Telegram group to store his CSAM and sent himself video files of crying children being raped.”
Investigators told Forbes that law enforcement is currently finding examples of groups where AI-generated CSAM is being shared on the Telegram platform. “There are chat rooms dedicated to 'nudification' or 'fakeage,' where someone posts a non-exploitative image of a child and someone else in the group can 'nudify' it,” said one federal child exploitation investigator who was not authorized to speak publicly. As Forbes previously reported, such Telegram “nudification” bots were found to be rampant on the app and were promoted on YouTube before the site removed them.
Jim Cole, a recently retired child exploitation investigator for the Department of Homeland Security, said platforms like Telegram have long “put their profits above the safety of their most vulnerable users,” adding that Durov's arrest is significant. “This sends a strong message that this kind of negligence will not be tolerated,” he told Forbes. “It should make others in the tech industry a little uneasy.”
CSAM exists on nearly every other major internet platform, from Facebook to Instagram to X. But Telegram is different, as it has been accused of not responding well to law enforcement requests for user data and not effectively and proactively policing such content on its platform. Unlike Meta, TikTok, and other major social sites, Telegram has not notified the National Center for Missing and Exploited Children when its moderators find CSAM. Even Mega, the encrypted storage service once run by notorious anti-authoritarian Kim Dotcom, regularly supports law enforcement investigations by providing data and tips.
In a search warrant last year, the DHS HSI division stated simply: “In HSI's experience, Telegram has not complied with procedures issued by U.S. law enforcement agencies,” and Telegram's website states that “to date, it has disclosed zero bytes of user data to third parties, including the government.”
But according to the same HSI warrant, Telegram occasionally responds to calls for help: “Telegram does not generally cooperate with law enforcement, but does provide abuse email addresses. In HSI's experience, when child pornography-focused groups are reported to Telegram, Telegram sometimes terminates those groups.”
Telegram spokesperson Remi Vaughn said the app “proactively moderates harmful content on its platform, including child abuse content. Moderators use a combination of active monitoring of the public parts of the platform, AI tools, and user reports to remove content that violates Telegram's terms of service.” According to Telegram's own data, in August alone, Telegram removed more than 45,000 child abuse-related groups and channels.
Was Telegram's response, or lack of response, to law enforcement requests enough reason to charge Durov with any crime? As it stands, no. He has not yet been indicted, but he faces questions about possible complicity in several serious crimes, including conspiracy to “organized distribution, provision, or making available indecent images of minors.”
But the arrest exposed a division in the tech world. Elon Musk and more libertarian thinkers rushed to support Durov, saying he was simply a software platform developer and not a criminal trafficking in CSAM or drugs, while other civil liberties advocates took a more cautious stance, waiting to see what charges, if any, would come from France. By attacking Signal, he “lost a natural ally” in the community, says John Scott-Railton, a digital rights activist and researcher at the University of Toronto's Citizen Lab project. Signal, unlike Telegram, is an end-to-end encrypted app. And unlike Signal, it holds the keys to user data, allowing it to do much more moderation, Scott-Railton adds. With nearly a billion users, there is certainly a lot of data to sift through, and Telegram's critics say a lot of it could be useful in criminal investigations.
Do you have information about surveillance or cybercrime? Contact Signal at +1 929-512-7964.
Meta uncovers Iranian espionage via WhatsApp
(Photo by Nicholas Kamm/AFP via Getty Images)
AFP via Getty Images
The company said it had blocked a “small cluster” of WhatsApp accounts posing as support agents for technology companies, which it said were linked to an Iranian threat group known as APT42. Mehta said the group is known to target foreign politicians, “including those associated with the administrations of President Biden and former President Trump.” The news comes shortly after the Trump campaign was allegedly hacked by Iran.
Stories to read today
A prolific Chinese state-backed hacking group known as Bolt Typhoon exploited a bug in software made by Versa Networks Inc. to hack into four unnamed U.S. internet companies, cybersecurity researchers said Tuesday.
Google has patched the tenth zero-day vulnerability in its Chrome browser exploited in the wild this year, with the latest flaw allowing hackers to execute code on a victim's PC via a malicious web page.
This week's winners
404 Media is celebrating its first anniversary. This fast-growing independent news site has made a lot of noise in just 12 months. Their stories have led to a lawsuit against Nvidia over YouTube scraping, and a lawsuit calling for Google to remove phone tracking company Patternz from its advertising ecosystem. Importantly, the site has shown how independent media like this can thrive with solid, honest journalism, and we wish them continued success in the future.
This week's losers
The US government has joined a lawsuit alleging that Georgia Tech failed to meet cybersecurity requirements related to a Department of Defense contract. One of the most shocking allegations is that Georgia Tech labs “failed to install, update, or run anti-virus or anti-malware tools on lab desktops, laptops, servers, or networks.”
More from Forbes
Forbes 38 Best Colleges for Less Stressful Admissions By Emma WhitfordForbesForbes Top 50 Small Colleges By Emma WhitfordForbes 25 Colleges with the Highest Salaries By Francesca Walton
Source link
