The popular Russian chat and messaging app Telegram is facing renewed scrutiny after an investigation by IStories, an independent online outlet, uncovered that its critical network infrastructure is maintained by a man with close ties to Russian intelligence and security services.

While Telegram founder Pavel Durov has long marketed the app as a secure haven for free speech — boasting over “its privacy-first branding and resistance to government censorship” — the report reveals a serious hidden risk: its technical backend and internet traffic are in the hands of Vladimir Vedeneyev, a 45-year-old Russian network engineer.

Vedeneyev owns companies responsible for assigning Telegram IP addresses and managing its networking equipment.

Telegram, far from safe

Documents obtained by journalists show that Vedeneyev has been given exclusive access to Telegram servers and is even authorized to sign contracts on Telegram’s behalf.

Though there’s no direct evidence that Vedeneyev’s firms handed data to the Russian government, two of his other companies — both of which have also supported Telegram’s infrastructure — are known to have worked with the FSB (Russia’s federal security service), a top-secret presidential computing center involved in war planning, and a state-owned nuclear lab led by a Kremlin insider.

More to read:
Google developer found a vulnerability in Telegram app

“This reporting reveals a dangerous mismatch between Telegram’s public image as a secure, independent platform and the infrastructure reality,” John Scott-Railton, senior researcher at The Citizen Lab told iStories. “People relying on Telegram for safety may be exposing themselves without knowing it.”

Security experts say the structure of Telegram’s encryption allows for potential surveillance if the underlying infrastructure is compromised. While Telegram offers optional end-to-end encryption, most messages travel through unencrypted “cloud” chats that are stored on company-controlled servers.

Moreover, even encrypted messages carry metadata — like device identifiers and IP addresses — that can be used to track users.

“If I can observe the traffic on Telegram’s network, I can link it to a specific device and location,” said Michał Woźniak, a network security expert and former head of infrastructure at OCCRP, the Organized Crime and Corruption Reporting Project.

This kind of surveillance is already in practice in conflict zones. A Ukrainian IT specialist told iStories that after the Russian military captured network infrastructure in Ukraine, they installed surveillance systems to harvest metadata and identify user locations and connections.

Vedeneyev, Durov’s trusted man

The key figure in this infrastructure puzzle is Vedeneyev, owner of Global Network Management (GNM), a company registered in Antigua and Barbuda. GNM leases more than 10,000 IP addresses to Telegram. Court records from Florida show that Vedeneyev’s firm installs and supports Telegram equipment and that he once had power of attorney to act on behalf of both Telegram and Durov.

Vedeneyev’s influence in Russia’s telecom sector runs deep. He founded GlobalNet, a backbone operator managing infrastructure across 24 countries. Until recently, GlobalNet controlled many of Telegram’s IP addresses.

Vladimir Vedeneyev, left, and Roman Venediktov. Credit: iStories

The company also serves some of Russia’s most secretive and sanctioned entities, including:

• GlavNIVTS, the presidential computing center that helped plan the invasion of Ukraine and developed tools for deanonymizing internet users.
   
• Kurchatov Institute, a nuclear research facility headed by Putin ally Mikhail Kovalchuk.
   
• The FSB, for which Electrontelecom — a second Vedeneyev-linked company — provides surveillance equipment in St. Petersburg and the Leningrad region.

GlobalNet implemented Deep Packet Inspection (DPI) monitoring technology shortly after Russia’s 2022 invasion of Ukraine, in compliance with directives from Russia’s internet regulator, Roskomnadzor.

Adding to concerns, Vedeneyev’s former business partner in both GlobalNet and a traffic exchange network called DATAIX was Roman Venediktov, a Russian space forces officer and Mozhaisky Academy graduate.

Despite the strategic sensitivity of these connections, Vedeneev has maintained a low public profile. He declined to make any of his comments public when contacted by IStories.

Durov pretends to be a freedom fighter

Telegram, in turn, dismissed the findings and accuracy of reporting.

Durov’s own narrative as an exiled entrepreneur fighting government surveillance has recently come under question. Though he has claimed to avoid Russia since fleeing in 2014, leaked border control data shows he returned over 50 times between 2015 and 2021.

More to read:
Why Russian police order software for deanonymization of Telegram users

Durov’s past includes clashes with the Kremlin during his time as founder of VKontakte, Russia’s largest social network. After resisting demands to ban opposition groups and hand over Ukrainian protester data, Durov left Russia, selling VKontakte to Kremlin-aligned figures and launching Telegram with his mathematician brother Nikolai.

According to Durov, the app – launched in 2013 – now has over a billion monthly active users around the world.

Novaya Gazeta, another independent outlet, reported earlier that VKontakte has been collaborating with FSB, police, and GRU, the military intelligence, ever since its takeover by the Kremlin in identifying opposition figures and dissent users.

A video version of the iStories investigation was uploaded on YouTube.

The OCCRP published a video teaser on this topic.