With over 700 million monthly active users, Telegram is one of the world’s most popular cross-platform cloud-based instant messaging services. However, it’s important to remember that on Telegram, private and group chats are not end-to-end encrypted. This means that your conversations and personal identifiable information could be stored on Telegram’s servers and accessed by third parties. Intruders can also attack individuals and organizations on Telegram, accessing their accounts and the information.
This presents a risk to marginalized groups, particularly activists who may be targeted in restrictive regimes. If an activist’s mobile device is confiscated, authorities could access Telegram and all confidential messages included.
To counteract these threats, Partisan Telegram (P-Telegram) was developed to meet the needs of high-risk users. P-Telegram is intended for use by political dissidents to facilitate coordination using Telegram in regions controlled by hostile forces.
Unlike the normal version of Telegram, P-Telegram has two passcodes instead of one – the real passcode and a false passcode. If a user enters a false fascode, a series of predefined actions are performed. First, the app sends a custom SOS message to family and a trusted contact using SMS (traditional text messaging). The app deletes chats and channels that can be used against the user, logs out of the account on the device, and deletes all other sessions besides the current one. In effect, should a user worry their account may fall into the wrong hands, a user can enter in this secret “false” password to quickly and effectively obfuscate sensitive information that could otherwise be used to justify torture and jail. P-Telegram is also designed to look and feel exactly like the original Telegram as much as possible to protect the end-user.
Ultimately, P-Telegram is intended to be resistant to casual inspection by technically unsophisticated opposition forces, but it is not intended to be resistant against dedicated forensic analysis.
To ensure the ongoing security and safety of such applications, P-Telegram engages in regular audits and ongoing improvements that are essential to maintain control of information security. Recently, P-Telegram engaged Open Technology Fund’s Red Team Lab to conduct an application and operational security assessment. The RIT SAFE Lab performed the security assessment on behalf of the Red Team Lab in early 2022, conducting static and dynamic tests to assess application and operational security of the latest Android version.
The security assessment reported some positive findings. While the assessment observed that P-Telegram occupies significantly more space on disk than the standard version of Telegram, any known digital artifacts related to identifying the existence of P-Telegram on a device would be difficult, if not impossible, to discern by a casual observer with no technical knowledge and no specialized equipment.
Additionally, the assessment observed that the keystore containing the key used to sign official release versions of P-Telegram could be found in two public GitHub repositories. With access to the keystore, it is possible that opposition forces could create a malicious version of P-Telegram and social engineer users into installing it. To counteract this risk, a rotating code signing key is being implemented, as are development processes to ensure that such data is not pushed into public GitHub repositories into the future.
Overall, the security assessment proved positive, showing that significant safety and security considerations were put into the development of the application. These safety features all performed as expected, and no additional application vulnerabilities were found. Several security issues were raised in the assessment, which have been addressed by P-Telegram.
Please understand your threat model before using Telegram or Partisan Telegram. While OTF aids in auditing tools relied upon by activists, we do not recommend any specific tools or applications, and encourage you to base your decisions on your specific threat model. For additional information, please see the “Surveillance Self-Defense” kit from the Electronic Frontier Foundation, which provides tips, tools, and how-tos for safer online communications.
The complete application and operational security assessment on Partisan Telegram can be found here.