1/ France is once again in the spotlight for unfortunate reasons — this time, the arrest of Telegram’s CEO, Pavel Durov. I’ve done a bit of digging among French sources to figure out what’s happening. A 🧵

PhD in aviation ∩ climate science | Aviator, diver, ETH maxi, nexialist | Host of /diving /ethfinance /eth-staker /geopolitics /science /singapore /thomas

2/ Durov was arrested at Le Bourget airport near Paris last night after flying there from Baku (Azerbaijan) on his business jet. He was accompanied by his bodyguard and personal assistant, and was planning to have dinner in Paris that evening.

3/ The arrest was motivated by an outstanding search warrant against Durov. It is unclear whether Durov was aware of the warrant before deciding to fly to France.

5/ OFMIN is a 40-strong specialized police unit reporting to the Ministry of Interior and created in November 2023 to investigate online crimes against minors.

6/ As far as I can tell, OFMIN is not accusing Durov himself of crimes against minors. Instead, Durov is being accused of either refusing to filter Telegram for child sexual abuse material (CSAM), or refusing to cooperate with French police on specific CSAM investigations involving Telegram, or both.

7/ The CSAM problem is real and widespread. The French OFMIN received 318,000 reports in 2023, up from 227,000 in 2022. Not all those involve Telegram, of course.

8/ 90% of those reports actually originate from the U.S. nonprofit National Center for Missing & Exploited Children (NCMEC), and are forwarded to OFMIN only because either a perpetrator or a victim used an IP geolocated in France.

9/ There are precedents for platform providers attempting to moderate CSAM. Most famously, Apple engineered an iCloud photo scanning tool that detects CSAM.

10/ That project launched in August 2021 and was terminated two years later. Apple determined that there was no way to filter CSAM without making unacceptable tradeoffs to user privacy, and that the latter’s importance trumped the former’s.

11/ It seems that over the years, Durov reached a similar conclusion as Apple and refused to implement moderation tools that would monitor Telegram chats to detect and report CSAM.

12/ It also appears that he refused a French judge’s request to hand over encryption keys (or to use them to decrypt communications from suspects) in one or more CSAM cases, leading to the warrant.

13/ The French media also make references to non-CSAM police cases involving Telegram communications: terrorism, organized crime, drug trafficking, etc. So it is possible that the warrant is also for Durov’s refusal (in his CEO capacity) to comply with those other investigations.

14/ In cypherpunk fashion, you may disagree with laws that require communication providers to hand over to investigators the contents of private communications (encrypted or not) in response to a legal subpoena.

15/ But that happens all the time in many, if not most, countries (and it still beats the state having a backdoor into the encryption). Furthermore, it has little to do with the country being democratic or not.

16/ Democracy is only a mechanism for deciding how laws are passed. It is orthogonal to deciding whether the laws should value privacy more than the so-called public interest or security.

17/ Regardless of your own view on this tradeoff, it’s unlikely that cypherpunks can ever convince states of the absolute sanctity of privacy in communications.

18/ All it takes is one particularly egregious case of terrorism or child trafficking for the public opinion to side again with those who would rather give up privacy for security.

19/ If you believe in the sanctity of privacy as a cornerstone for freedom and government overreach avoidance, then the best remedy is to build, fund, promote, and use…

20/ … auditable, open-source, end-to-end encrypted (E2EE) software whose design doesn’t even offer the possibility of such privacy violations, because no server holds the keys. It also shouldn’t depend on centralized failure points like GitHub (thanks @nicom for that last point).

21/ Unfortunately, Telegram is *not* one such software, and the responsibility for that questionable design lies entirely with Durov. In Telegram, you *can* initiate an E2EE channel, but it takes extra steps and is not intuitive.

22/ By default, chats rely on server-side encryption, which means that Telegram can be subpoenaed or coerced into giving up the keys.

23/ Other software such as Signal or WhatsApp use E2EE by default, so they are technically unable to violate their users’ privacy (except by capturing what happens at the app level, of course). This means that their CEOs cannot be held responsible for not complying with investigations.

24/ The downside, of course, is that some countries prefer to simply ban those apps over which they can exert no control.

25/ At any rate, Durov will now be held in custody (“garde à vue” or GAV) with legal counsel present during questioning. The standard GAV duration is 24 hours extendable to 48.

26/ In exceptional cases involving drug trafficking and terrorism, it can be extended to up to 144 hours. It is unclear whether this extension will apply here.

27/ After that, Durov will either be released and all charges dropped, or presented to a judge who will decide whether he should await trial at home or in jail. I expect we’ll find out more about the warrant and the related investigations shortly. 🎬

Telegram founder Durov arrested in France.

I did a long thread on the background of this situation, Telegram, and why the traditional defender of freedom of speech, France, has now degenerated

https://x.com/moo9000/status/1827651282573644228

Bonus cast: if you want a different take on this, read @moo’s own thread on X

Bonus cast: if you want a different take on this, read @moo’s own thread on X

https://warpcast.com/moo/0xddf8b537

4/ The warrant was issued by a judge based on a request by the “Minors Office” (OFMIN). In that sense, the arrest is neither arbitrary, political, nor unlawful.