La Quadrature du Net’s co-founder, Sonntag: “Snowden fell into the trap: the Durov case is a lot more complex”

Together with the non-profit organization La Quadrature Du Net, which he co-founded, he is one of the leading figures in the French public debate against surveillance and against internet censorship and in favor of digital rights. Il Fatto Quotidiano interviewed the French computer engineer and tech entrepreneur, Benjamin Sonntag, a security expert who co-founded La Quadrature, to ask his views on the arrest of Telegram’s CEO, Pavel Durov. To our request to know whether Sonntag has ever operated, worked or consulted for any competitor of Telegram, Sonntag replied that he never has.

According to security expert Michał Woźniak, Telegram is neither secure nor encrypted: only when it is used in the ‘secret chats’ mode does Telegram offer end-to-end encryption, which means that messages exchanged between two people who are chatting are only available to themselves and are not accessible to a third party. However the end-to-end encryption must be enabled for each contact and the ‘secret chats’ are not available for groups or channels. It appears that Telegram is far from ‘secure’ if criminals use it to smuggle drugs, weapons and paedophilic content. Do you agree?

I totally agree. I consider that 99.9% of all messages exchanged via Telegram are sent in a way that make them visible to the Telegram company. Messages are sent encrypted to Telegram servers, sure, so if someone is eavesdropping on the Internet they would not see the messages, but the Telegram company see them in cleartext, on their servers. The fact that the end-to-end encryption must be activated for each chat, and is not the default setting, is a huge deal! Most users don’t touch the default settings. Also, the end-to-end encryption is not available at all to any group chat on Telegram, which is a big use of this social network too.

Durov has been accused of twelve alleged crimes, including “refusal to communicate, at the request of competent authorities, information or documents necessary for carrying out and operating lawful interceptions” and yet according to an investigation by Der Spiegel, Telegram has repeatedly handed over user data to the German Federal Criminal Police Office. Do you think that Durov has been arrested for lack of cooperation with French investigators or do you think that the case could be about something else?

From what I see here, as a network operator – I manage a small internet hosting provider in France – each country has different ways of enforcing its laws. Maybe Germany and India, who both got some data from Telegram some years ago, were more pressing and threatening than France, or their cases were considered legit by Telegram at the time. To me it’s more likely that France never really tried to threaten Telegram before now, or wanted too many data on too many cases and Telegram chose not to comply. I don’t see why there should be something more than just a justice system trying do to its work. Especially since the police in France know that Telegram is not encrypted and therefore they know they could have very interesting information on all those criminal cases… I see that as a very good (and enough) motivation to arrest him for that.

Edward Snowden has been very outspoken: “The arrest of Durov is an assault on basic human rights of speech and association. I am surprised and deeply saddened that Macron has descended to the level of taking hostages as a means for gaining access to private communications”. It is a matter of fact that French authorities do not like encryption and last December, Disclose, our newspaper, Il Fatto Quotidiano, and other media revealed that France, Italy, Finland, Greece, Cyprus, Malta, and Sweden wanted to use spyware to spy on journalists. Do you think the arrest of Durov is part of this cryptowar in France? If so, do you expect a further crackdown on encryption in France?

I found it sad that Edward Snowden fell into the trap, because that case is clearly a lot more complex than that. First, Telegram is not encrypted: 99.9% of it is not, and the 0.1% remaining still leaks who communicates with whom, which is, itself, very interesting for law enforcement. So this case should not be linked to any love or hate of encryption by French authorities, it’s totally irrelevant. Sadly, we also have activists all over the world who are thinking that Telegram is safe: it’s not! In my opinion, yes, fighting for end-to-end encrypted private communication is very important, but Telegram has no relation whatsoever with this fight! And please don’t mix journalist spying issues in that issue: it’s a false flag… Responsible investigative journalists should never use Telegram for anything important. Consider it as safe as SMS or Email which is: not at all! Second, Telegram is not ‘private communications’ in most cases: you have thousands of Telegram ‘group chats’ that can go up to 200,000 people in each. Those could clearly be considered as ‘public place’ and ‘public speech’ and not ‘private communication’ by a judge. As a result, the applicable laws and regulation in most countries are very different from purely private communication. In the case of Durov’s arrest, some criminal cases linked to that arrest are linked to group chats where random people exchanged child porn or other illegal content in those public group chats. So I understand the point of the ministry of justice who would want to stop those. As a conclusion, I’m pretty sure the Durov case has nothing to do with the cryptowar in France. Which doesn’t mean that France likes end-to-end encrypted communication, sure, and people should use those (like Signal) whenever they can, and fight for the right to private communication. But Telegram is clearly not a good guy in this fight…”