Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Encryption Communications Government Privacy Security The Courts

Telegram Loses Supreme Court Appeal In Russia, Must Hand Over Encryption Keys (bloomberg.com) 217

Posted by BeauHD from the cough-it-up dept.
Telegram has lost a bid before Russia's Supreme Court to block security services from getting access to users' data, giving President Vladimir Putin a victory in his effort to keep tabs on electronic communications. Bloomberg reports: Supreme Court Judge Alla Nazarova on Tuesday rejected Telegram's appeal against the Federal Security Service, the successor to the KGB spy agency which last year asked the company to share its encryption keys. Telegram declined to comply and was hit with a fine of $14,000. Communications regulator Roskomnadzor said Telegram now has 15 days to provide the encryption keys. Telegram, which is in the middle of an initial coin offering of as much as $2.55 billion, plans to appeal the ruling in a process that may last into the summer, according to the company's lawyer, Ramil Akhmetgaliev. Any decision to block the service would require a separate court ruling, the lawyer said.

Putin signed laws in 2016 on fighting terrorism, which included a requirement for messaging services to provide the authorities with means to decrypt user correspondence. Telegram challenged an auxiliary order by the Federal Security Service, claiming that the procedure doesn't involve a court order and breaches constitutional rights for privacy, according to documents. The security agency, known as the FSB, argued in court that obtaining the encryption keys doesn't violate users' privacy because the keys by themselves aren't considered information of restricted access. Collecting data on particular suspects using the encryption would still require a court order, the agency said.
This discussion has been archived. No new comments can be posted.

Telegram Loses Supreme Court Appeal In Russia, Must Hand Over Encryption Keys More

Telegram Loses Supreme Court Appeal In Russia, Must Hand Over Encryption Keys

Comments Filter:

  • This is chilling... (Score:5, Insightful)

    by ChodaBoyUSA ( 2532764 ) on Tuesday March 20, 2018 @07:58PM (#56294691)
    If I had any friends, and used Telegram, and lived in Russia, I would be frightened. Since I have no friends, only use SMS, and live in the USA, I already gave up any pretense of privacy.

    • Telegram wasn't properly secure anyway. (Score:2, Interesting)

      by Anonymous Coward

      Telegram is not secure by default, but requires you to start a secure chat separately. Which requires both users to be online and enable it at the same time. Something that I never got going with anyone. So it was already pretty useless, as compared to Signal.
      Also, its own custom security protocol was more than a little sketchy to me. I don't trust any random person to get security properly right. There are far too many caveats for me to trust somebody with their custom solution. It would have to be proper

      • Re: Telegram wasn't properly secure anyway. (Score:2, Insightful)

        by Anonymous Coward

        Signal is no more secure.

        Still passes through their servers, controlled by them, single point of failure, single target to ddos, single target to take hack and inject mitm.

        We need decentralization. It's actually quite easy to do with cryptographic whitelists, and offline methods for keysharing.

        Been working on my own solution to this problem over the past year or so.

        • Wrong. Signal is the gold standard (Score:5, Insightful)

          by Anonymous Coward on Wednesday March 21, 2018 @12:16AM (#56295479)

          To say Signal is equal to default Telegram is ridiculous. Telegram uses a master key by default; Signal uses ephemeral keys and forward secrecy.

          Saying that it is not secure because it "passes through their servers" is like saying Tor isn't secure because it passes through someone's servers. Everything passes through someone's servers; that's how the internet works. The point of having FOSS in your client and encryption protocol is so that it doesn't matter that it's passing through someone else's servers.

          You are confusing encryption/security with centralization/federation; they are NOT the same thing.

          Everyone should use Signal.

          • Everything passes through someone's servers; that's how the internet works.
            That is nonsense.
            The only "server" would perhaps be a DNS request.

            You are confusing encryption/security with centralization/federation; they are NOT the same thing.
            That is correct.

          • Re: (Score:2)

            by pnutjam ( 523990 )
            I think keybase has the best solution out there right now, security wise, for a hosted solution. Although I tend to favor Matrix / Riot [cryptoaustralia.org.au] with your own server.

        • Re: Telegram wasn't properly secure anyway. (Score:4, Funny)

          by war4peace ( 1628283 ) on Wednesday March 21, 2018 @03:14AM (#56295757)

          Blockchain! Blockchain! Blockchain!

          • Re: (Score:1)

            by Anonymous Coward

            Congratulations, you just invented a chain of blockchains. I suggest you name it blockchainchain.

        • I'm not a security or encryption expert so I seek the advice of those who I trust. Bruce Schneier and Edward Snowden recommend Signal. That seems to indicate that Signal is as good as it gets for consumer privacy.

    • You still have to worry, even outside of Russia.

      How long until Telegram users start to receive messages offering _not_ to expose the messages they thought were private to their [boss/partner/police] in exchange for a small sum? Don't have those sorts of message? For only as little extra you do, now.

      • Re: (Score:3)

        by rtb61 ( 674572 )

        So you trust a private for profit corporation, with it's for profit executive team and the cheapest staff they can possibly find, more than the Russia government, kinda of foolish don't you think. At least you sort of know where you stand with the Russian government, although the world has never experienced a technocracy before and it should be interesting (democratic among the technocrats, not quite so democratic for the rest, Putin and Co created it, most of the corruption was in local government and less

        • So you trust a private for profit corporation

          Who? Telegram is a non-profit company.

        • So you trust a private for profit corporation

          Where in anything I said, did I say or even imply that?

          I warned friends off Telegram from the outset, because a) messages went through their servers and b) their closed source encryption and/or implementation was home grown. Private company or government run, centralised and closed source are deal breakers if what you want is an encrypted communication tool. I pointed out that it would be too easy for old messages to be recovered and decrypted, either by a third party or the company itself, should it go thr

  • Assumed immunity (Score:2, Interesting)

    by evolutionary ( 933064 )
    It's interesting how people in power assume that they are immune to the negative consequences of the same mechanisms they create or force to subdue others. It will be interested to see what happens when all these backdoor backfire on Putin's regime and how they try to downplay it when it happens.

    • Re: (Score:1, Insightful)

      by sehlat ( 180760 )

      Lord Acton almost got it right.

      Impunity corrupts, and absolute impunity corrupts absolutely.

    • Re: (Score:1, Insightful)

      by Anonymous Coward
      It won't backfire because anyone who would think about leveraging it against Putin would be found with two self-inflicted bullet wounds to the back of the head.

    • Re:Assumed immunity (Score:5, Interesting)

      by nnull ( 1148259 ) on Tuesday March 20, 2018 @08:29PM (#56294831)
      All this is doing is pushing for better crypto and security.

      • Not with Telegram or its current implementation. It's a cloud based IM which has a single encryption key. All your data is stored in the cloud. P2P chats in Telegram are ostensibly end-to-end encrypted but they are so inconvenient, few people actually use them. You cannot backup them, you cannot save them.

  • Next Step (Score:5, Informative)

    by SPopulisQR ( 4972769 ) on Tuesday March 20, 2018 @08:03PM (#56294713)
    Telegram has been launched by brothers Durov's, Nikolai and Pavel. They previously launched Russian FB equivalent VK, which was "socialized" by the owners that are supporters of Putin. As a response, secure and private Telegram has been launched. So, they lost a case in Russia, and now privacy is compromised. I have to make a bet that their next product will be the developement of decentralized communication protocols that cant be subpoenaed or litigated. Such protocols already exist, albeit not yet well scalable. However, at the very moment brothers Durovs are putting the company for IPO, and it will be interesting to see how will they handle the situation.

    • Remember Blackberry? (Score:1)

      by Anonymous Coward

      Looking at what Paypal and Facebook are doing, you wonder if the brothers haven't already sold it many many times over in private. There seems to be a big market in private data and no consequences for selling it.

      Remember Blackberry and it's FBI friendly backdoor into its own encryption?

      In their heads they thought the good guys would only get access for catching terrorists. Yet here Putin gets it for catching protestors, witnesses, interfering in elections worldwide, finding the location of people to nerve

    • Seems like they're kind of late for that. there are some decent options out there like TOX and many others.

    • You do know that they have been doing hush hush "ICO" valuing telegram around 2 billion right?

  • Our president just congratulated Putin (Score:5, Interesting)

    by rsilvergun ( 571051 ) on Tuesday March 20, 2018 @08:05PM (#56294721)
    on his election 'victory'. I don't like McCain, but at least he called Trump out on it. [cnn.com]

    It genuinely frightens me that we're so quick to support dictatorships. Everybody's looking the other way because they want Russia's gas & oil. Then again I've got to drive to work every day the same as everybody else...
    • Make sure your next car is an electric car. Or see about car pooling to work until then, or taking public transit. This not only reduces oil consumption from countries like Russia and Saudi Arabia, it will save you money and help the environment.

    • Re: (Score:2, Troll)

      by youngone ( 975102 )

      It genuinely frightens me that we're so quick to support dictatorships

      Ever since the US began empire building in the 19th century, your government has been creating and supporting dictatorships, because they're easier to manage.
      Have a quick read up on the history of Guatamala, the country where it was illegal for local people to own land, in case it interfered with the profits of United Fruit.
      Then the CIA overthrew the democratically elected government in 1954 because they gave unused land to peasants to farm, which smelt like communism to Ike.

    • Re: (Score:2)

      by jrumney ( 197329 )
      Trump has sympathy for Putin, as just like Trump, Putin has to deal with Russians meddling in his election too.

    • Re: (Score:1)

      by Anonymous Coward

      Then again I've got to drive to work every day the same as everybody else...

      Two things:
      1) The biggest oil and gas suppliers to the usa are: https://www.eia.gov/dnav/pet/pet_move_impcus_a2_nus_epc0_im0_mbblpd_a.htm [eia.gov]
      I'll save you some time and tell you that its saudi arabia, canada and mexico :P the two countries you are currently trying to start shit with. Russian does not make the top 10.

      2) As a Canadian, I pay $1.55/L for gas today and i still drive, the world didn't end, etc.

      Gas in your car has nothing to

    • It genuinely frightens me that we're so quick to support dictatorships....

      Yes #metoo. You guys voted in Trump. And you seem to have given your president the power to kick out everyone in his government that disagrees with him or his views, and replace them with others more to his liking.

      In most western countries, if the prime minister/president/supreme overlord would kick out ministers and other people in the government because he does not like their opinions, or they disagree with him, or whatever, and nominate his pals instead, iterate until happy, well people might say that lo

      • Re: (Score:2)

        by Maritz ( 1829006 )

        It genuinely frightens me that we're so quick to support dictatorships....

        Yes #metoo. You guys voted in Trump. And you seem to have given your president the power to kick out everyone in his government that disagrees with him or his views, and replace them with others more to his liking.

        In most western countries, if the prime minister/president/supreme overlord would kick out ministers and other people in the government because he does not like their opinions, or they disagree with him, or whatever, and nominate his pals instead, iterate until happy, well people might say that looks a lot like dictatorship.

        Trump can be voted out. Putin can't be voted out. You don't get the difference?

        • Re: (Score:2)

          by AmiMoJo ( 196126 )

          Trump can be voted out.

          Maybe. But what happens when the next election comes up, Trump calls his opponent a crook, claims the whole election is rigged and most Democrat voters are undocumented immigrants etc.

          Be very, very vigilant.

        • Trump can't be voted out.

          He can lose the next election, just like Putin can. And thats it.

      • It genuinely frightens me that we're so quick to support dictatorships....

        Yes #metoo. You guys voted in Trump. And you seem to have given your president the power to kick out everyone in his government that disagrees with him or his views, and replace them with others more to his liking.

        In most western countries, if the prime minister/president/supreme overlord would kick out ministers and other people in the government because he does not like their opinions, or they disagree with him, or whatever, and nominate his pals instead, iterate until happy, well people might say that looks a lot like dictatorship.

        I'm no big fan of the American government system, but this isn't equivalent at all. Most western countries don't have the strict branches separation that the US has, so the POTUS shaping his team (badly) as he sees fit is not affecting the other branches, which if they had a backbone, could stand up to it. Other countries have internal teams that are shaped by the guy in charge too, the US executive is just very visible.

      • Re: (Score:2)

        by nasch ( 598556 )

        How does it work in a parliamentary system? The prime minister can't hire and fire as he pleases? On a side note, there is exactly one person in the executive branch who the president cannot fire, and that is the vice president.

    • Re:Our president just congratulated Putin (Score:4, Interesting)

      by dnaumov ( 453672 ) on Wednesday March 21, 2018 @02:52AM (#56295709)

      Where was your outrage when Obama did the exact same thing?

      • Re: (Score:2, Flamebait)

        by Maritz ( 1829006 )

        Where was your outrage when Obama did the exact same thing?

        That was before the invasion and annexing of Crimea, as well as other aggressive acts from Putin. That's not going to matter to you of course, because you're a dickhead incapable of nuanced thought.

    • Only, it's not a dictatorship. Not yet.
      The election wasn't rigged, the results truly represent what the average Russian believes in and voted for. Does it suck? of course it does. Is there anything you can do to change it? Nope. I mean, hell, look at the other candidates. Jirinovski is an extremist nutcase. Ksenia is a run-of-the-mill TV-star-turned-politician using the election process and her candidacy for further boosting her personal career, everything-be-damned.

      You really need to research and find out

      • The election was obviously rigged, just as the previous one. There are enough videos that show it.
        There is no doubt that Putin would have won the election either way, but the real numbers wouldn't be nearly as impressive.

        There is actually a Russian meme about election rigging, called "146%", which was the voter turnout for the Rostov region for the 2011 parliament elections. A few other regions also had their voter turnout higher than 100%.

        • Re: (Score:1)

          by qaz123 ( 2841887 )
          What does it mean "enough videos"? How can you measure it? There are almost 100000 polling stations in Russia. Around 80% of them have cameras. Everyone could watch them via the Internet (as well as capture the video stream). And there are only 10 or several tens of such videos.
      • From Russian perspective? That's redundant. There can be no valid non-Russian perspective on this matter.

    • It genuinely frightens me that we're so quick to support dictatorships. Everybody's looking the other way because they want Russia's gas & oil.

      Congratulating someone on their victory does not equate to support. That's the kind of thing people who hate each other do in public to give the pretense that everything is okay. The USA doesn't give a shit about Russia's oil and gas. They have their own. What the USA (and much of the rest of the world who congratulated Putin on his farce yesterday) does give a shit about is not souring relationships with a large foreign power. The world is better for fake smiles than it was from the 50s to the 90s.

      That is

    • http://foreignpolicy.com/2012/... [foreignpolicy.com]

      That's what Presidents do. You don't burn bridges unnecessarily.

    • Comment removed based on user account deletion

  • This is why perfect forward secrecy is needed (Score:5, Insightful)

    by BitterOak ( 537666 ) on Tuesday March 20, 2018 @08:08PM (#56294743)
    This is why perfect forward secrecy is needed in secure messaging apps. There's no reason the service provider should be able to hand over keys that can be used to decrypt users' messages. A properly designed secure messaging app would make this impossible. The protocols to implement this are not difficult.

    • Re: (Score:2)

      by AHuxley ( 892839 )
      That was attempted by better app brands in the USA. The FBI demands all the keys to the back door, trap door and front door.
  • "Telegram has lost a bid before Russia's Supreme Court to block security services from getting access to users' data, giving President Vladimir Putin a victory in his effort to keep tabs on electronic communications. Bloomberg reports"

    Is this anything like the FBI taking Apple to court to hack a suspects iphone. The whole thing being most probably a scam as the FBI already has a backdoor into Apple and Microsoft and Dell :)

    • That's what I'm thinking. The FBI makes this big show of going to court in an effort to secure the right to do what? Get access to Apple's key? No, to try to force Apple to build decryption tools. The FBI said it could ask for Apple's signing key... but they didn't. Obviously they already have that? Why would you assume Apple can keep their key secret from agencies that can put insane pressure on any employee they decide to?

      No. Assume that all the three letter agencies already have the keys, they just don't

    • The whole thing was a marketing scam by Apple. "Look, we have secure phones. The FBI rants about them."

    • I'm pretty sure that Apple and Microsoft do comply with such court requests unlike Telegram. In fact EULAs tend to spell out that any user's data can be shared given valid court order. The problem here is that Telegram has such a key that could decrypt private messages in the first place. Meaning that not only they could use it to comply with court orders but also that they could grep private communications for stuff like credit card numbers, login credentials and material for blackmail. In order to achieve

  • Telegram has lost a bid before Russia's Supreme Court to block security services from getting access to users' data, giving President Vladimir Putin a victory in his effort to keep tabs on electronic communications. Bloomberg reports

    This is Putin's victory, because of course, Putin took care of the case on its own. Perhaps he even did it without an attorney.

    • Re: (Score:2)

      by Maritz ( 1829006 )
      I was going to say you should try arguing against real points of view and not pathetic strawmen, but that'd be a complete waste of time, wouldn't it?

      • I was going to say you should try arguing against real points of view

        Well, I tried to point with some irony that we are presenting a whole country as being just its leader, which is of course evil

        When an allied country win over its opponents in court, we do not call it a < insert leader's name > victory.

  • Hand me the keys, you F**king c**ksucker

  • Distributed messengers is the way to go (Score:5, Insightful)

    by jdoeii ( 468503 ) on Tuesday March 20, 2018 @09:42PM (#56295065)

    Most (all?) commercial messengers have a problem of being centralized. Block a few servers and the messenger is dead. Compare Telegram or Whatapp to generic email. A dictator can easily block messengers, but can't block email in general. It can block can block say Gmail or Yahoo mail but blocking individual email servers is much harder. Messengers need to move to the same model. We need something like https://github.com/tinode/chat [github.com] to run our own servers. We need 1000s of telegrams and whatsapps running a distributed federated messaging network.

    • Re: (Score:1)

      by Anonymous Coward

      XMPP [wikipedia.org] looked like it was going to be that for a while. Then Google decided to stop federation. There's also Matrix [wikipedia.org] which is a newer project trying to do that. Both support a concept of bridging to other protocols so you can use XMPP/Matrix on your side and set it up to log into your accounts on other IM systems to make the transition smoother (i.e. you don't have to convince all of your contacts to switch at once). Of course, you can also do that part with multi-protocol IM clients like Pidgin [wikipedia.org] to log into mu

      • Just because Google and others are too stupid to use it, does not mean we have to be. I force my family to use XMPP apps (there are many) and GPG. They complain. I don't care.

        Recently my XMPP service provider disappointed me, so I just moved my domain to a different provider, just like I can do with email. Bam. Done.

    • blocking individual email servers is much harder

      Really? Like blocking TCP port 25? Tell us another joke.

      • And how exactly can the government or anyone else block the port 25 on your computer or phone?
        Idiot ...

        • Re: (Score:2)

          by flink ( 18449 )

          The can force ISP and cell providers to block it at the router level.

          • Based on which law?

            And you do know that ports are kinda arbitrary?

            • Re: (Score:2)

              by flink ( 18449 )

              Based on which law?

              And you do know that ports are kinda arbitrary?

              Your original questions was: "And how exactly can the government or anyone else block the port 25 on your computer or phone?" The answer is the government would pass a law banning the port (or protocol): that's how governments ask people to do things.

              • And then I move to another port ... like everyone else.
                And that would anyway only affect the country where that government is ruling over.

                So no: no one can simply block and arbitrary port on the internet.

                • Well said. People making laws often have no clue about the technical details, so some stupid laws get made (thus we have sites everywhere with a "we use cookies" overlay.)

                  I have decided that the best way to explain to people how difficult it is to control the internet is to point out that people in China use The Pirate Bay. If you can't block a site that most countries want to block even in a country that firewalls their whole internet, the likelihood that your local congress critter or equivalent can fix a

      • Re: (Score:2)

        by jdoeii ( 468503 )

        Do you know of any country which successfully blocked email short of closing down all of internet, like North Korea? I know quite a few countries which blocked WhatsApp, and FB, and YouTube.

        Email works on a specific port (25 or 465 or 587) because changing it is a hassle, not because it's technically difficult. Nothing prevents a new protocol from working on a a random port like torrents or to be tunnelled through HTTP(S).

        My point is that instant messaging should move away from proprietary walled gardens.

    • Comment removed based on user account deletion

  • If the British confirm that Kremlin was behind the poisoning of the Russian ex-spy double-agent, I am afraid the CIA will have to poison Snowden in retaliation

  • can they now crack all messages way back? (Score:3, Interesting)

    by hraponssi ( 1939850 ) on Wednesday March 21, 2018 @02:48AM (#56295705)

    So assuming the Russians are like the NSA and have recorded much of the traffic for the past few years. How would that go for everyone who discussed Putin and his friends in the past over Telegram "secure" chat? How does Telegram handle the keys, can Putin and friends now just go and get the keys for all the past conversations and send in some accidents to everyone who disagrees with anything?

Slashdot Top Deals

Disc space -- the final frontier!

Close