Endless Thread - A Reasonable Expectation of Privacy

Episode Date: September 13, 2024

When the founder of the messaging and social media app Telegram, Pavel Durov, was arrested in France, it exposed something: many of Telegram's millions of users believe the app is much more secure than it actually is. Some of those people use the app for crime; others to communicate about sensitive political topics in war zones. Media outlets (including, we must admit, Endless Thread) have often described Telegram as an encrypted app, but that's not quite right. Telegram, and who knows who else, can access most of what's said and shared on the platform. There are crucial differences between apps like Telegram, and other services known for encryption, including WhatsApp and Signal, and many people using the apps don't understand the differences. Do we need to? Wired's Andy Greenberg, Natalia Krapiva at Access Now, and  Matthew Green, a professor at Johns Hopkins, say absolutely. This week, we look at the anarchist, googler, and billionaire moguls behind the tech that millions of people around the world use for basic communication. And we imagine what it looks like when an app actually protects your conversations from prying eyes? We also ask: why should you care, even if you think you have nothing to hide? Show notes: "What is Telegram and why was its CEO arrested in Paris?" (The Associated Press) "Is Telegram really an encrypted messaging app?" (A Few Thoughts on Cryptography Engineering) "Signal is more than encrypted messaging. Under Meredith Whittaker, it's out to prove surveillance capitalism wrong." (Wired) "Eugene from Ukraine." (Endless Thread) Credits: This episode was produced by Grace Tatter. Mix and sound design by Emily Jankowski. It was written and hosted by Ben Brock Johnson. It was edited by our managing producer, Samata Joshi.

Support for endless thread comes from Mathworks, creator of MATLAB and Simulink Software, to design and develop engineered systems, accelerating the pace of discovery in engineering and science. Learn more at Mathworks.com. Support for WBUR comes from Is Business Broken, a podcast from the Marotra Institute at Boston University that explores questions like, why is innovation in healthcare so hard? Is ESG just greenwashing? of course, is business broken? Listen, wherever you get your podcasts. WBUR Podcasts, Boston. It's one of those news stories that reminds you we are living in strange times. Pavel Durov, he was detained on Saturday when his private jet arrived in Paris from Azerbaijan. The authorities say they're looking into money laundering, drug trafficking, and child pornography by not really... Pavel Durov is someone who, unless... you care about cryptography or encryption, you may have never heard of.

Senior writer at Wired Magazine, Andy Greenberg, has heard of him for sure. I know that he has really great apps that he shows off on his Instagram a lot. You know, he looks great, he's clearly doing very well for himself until he was thrown in jail. Natalia Kripiva has heard of Pavel Durav too. Duraev is famous for his philosophy of not compliant. with any government orders. Even if you're not Natalia Kripiva or Andy Greenberg and have never heard of Pavl Dorov,

you might have heard of Telegram, the messaging and social channel app. You might have heard about it on this show, like when we interviewed a Ukrainian named Eugene at the start of Russia's war with Ukraine. He suggests that I download Telegram so that he can give me links to channels that are sharing picks and videos of the violence.

that's happening in Ukraine? I don't know, Telegram. Is this a new? It's an encrypted messaging app. Except it's not that simple. I'll come back to why. First, a little more about Pavel Durov. The 39-year-old billionaire dubbed Russia's Mark Zuckerberg. He left Russia a decade ago.

Dorov has sort of become this champion of free speech. The film was 100% owned by myself, which is, like I said, quite unusual. Part of our living in strange times is that whether we are talking about human marble Roman statue with dead eyes Mark Zuckerberg or insanely wealthy Manosphere meme generating Muppet Elon Musk, we seem to be in an era of vaguely superhero or supervillain super rich tech people who are impacting our collective fate, perhaps into a dystopia that is at least not boring and abtas. Pavl Durav, Russian billionaire tech guy who now lives in the Arab Emirates, fits right in. This case is extremely unusual. But it goes beyond not born. He runs an app that boasts a reported 950 million users and hosts intense war footage channels and even more concerning content. In South Korea, a large number of online chat rooms have been found to be sharing sexually explicit deep

fake images of women. There were some big Reddit posts in recent weeks about that South Korea story regarding thousands of women's images used for fake pornography and shared widely. The story got big enough that country leaders in recent weeks called for Pavoldurov to be held to account, begging questions like, How do you balance free speech with protecting users and avoiding illegal activity happening on your platforms. And hey, Russian billionaire tech moguls

who spend their time talking to Tucker Carlson and getting pulled off of planes for illegal drug trafficking and child pornography might seem to have nothing to do with your life or mine. And that would be a good thing. Except this stuff does have something to do with our lives. Because whether you're a Redditor or a Normie boomer on Facebook or a TikTok thought or whatever,

What happened to Telegram's co-founder a few days back is actually about this debate that we've been having since the beginning of the internet. Should we be able to have full-on privacy in our communications online or not? Privacy enables people to do bad things, but it is, I think, necessary to avoid a kind of dystopian future. It's Ben Brock Johnson. Amory is on vacation, and I'm Roland Solo with you this week. unless you count my encrypted producer co-pilot, Grace Tatter. Shh. Yeah, I'm here too. And you're listening to Endless Threat.

Coming to you end to end from WBUR's NPR messaging app, today's episode, a reasonable expectation of privacy. By the time you hear this, the news will have moved. Peck, it was moving while we were trying to decide whether or not to talk about it. Durov was detained on Saturday and has now been released on bail of nearly six million We wanted to talk about this on the show today because Endless Thread is all about unsolved mysteries, untold histories, and other wild stories from the internet, also the blurred lines between online communities and real life. And we felt like there's a sprinkle of all of that in the

telegram story. I've been using apps and devices and services that aim to protect my privacy for years. Delete me, Duck Duck Go, or the Onion router, Incognito mode. But I don't know. that my operational security when it comes to protecting my own privacy as a regular user is great. And it doesn't need to be. I'm not a superhero. I'm not a democratic activist, at least not yet in America. And I'm not a drug dealer. Unless you count this podcast, you're smoking right now. So for me, it's always been about adding a little chaos into the mix for anyone who might be trying to, number one, make money off of my data right now. Or number two, infringe on my freedoms in the future. My life in the future is much more exciting. But Natalia,

her life is exciting right now. I'm seeing your tech legal counsel at Access Now. We work on digital rights, basically human rights in the internet space, and we have offices internationally, including in New York. You must be busy. Yes. Natalia knows a good amount about issues, other countries are dealing with right now when it comes to privacy online. And she knows that sometimes you have to protect yourself with encryption, especially when it comes to communication. There are generally speaking three messaging apps people think of when it comes to encrypted messages, Telegram, WhatsApp, and Signal. They are pretty different in how they use or don't use what is called end-to-end encryption. But before we contrast them, let's keep it very basic. Can you

define as you would define what end-to-end encryption is? Basically, it's a way of communicating where the access to the content of your communication is only available to you and whoever you're talking to. Now, the problem with this and the problem with even covering stories like this is that understanding encryption is no small feat. So here's Wired Senior Writer Andy Greenberg explaining the same thing Natalia just did in a slightly different way.

You can generate a key on your phone to decrypt messages and people can encrypt messages to you that only you can decrypt and nobody in between can possibly read them and you don't even have to worry about how you get the key to the phone. Like nobody else could steal the key in transit while you're getting all this set up.

Only the phone ever has the key on it. It's truly like a kind of of cone of silence and only the people in the two ends can read the messages. So about that cone of silence, here's an example of where a cone of silence gets out of the theoretical and gets real, the war between Ukraine and Russia. A few minutes ago, you heard a snippet from our episode about Ukraine. We'd found a Ukrainian guy, Eugene, on Reddit. He was living in Kiev right when the war started with his mom.

And it was incredibly difficult to get real life. information about what was happening, even as explosions were starting to rock the city around him. Telegram was where Eugene found information about the war. There were chats and channels full of footage, information about locations of attacking Russian military units, and eventually channels with pro-Ukrainian propaganda. In the years since, it has become even more clear how the war is affecting the region. It's something Natalia is thinking about and working on. We also see in countries like Belarus where even being a part of a certain telegram channel can also mean a prison sentence because in Belarus they actually designate telegram channels as extremist channels and then any member of that channel can be tried as an extremist. And with really high prison terms and in some cases we know that unfortunately individuals don't survive in prison because of the very harsh conditions.

So for them, the stakes are really, really high. And so we believe that companies like Telegram and others, they really have a high responsibility to protect these users. Part of the reason there is so much Russian and former Soviet Union content on Telegram, maybe because the app's owner and founder, who may in fact be the only person with all the keys to the Telegram kingdom, started out in Russia. Telegram's origin story is that Pavl Dorov left Russia, as he says, because he's a kind of Russian dissidents. Durav was born in St. Petersburg into what is reportedly an intellectual family. By 2006, he had started a social media company called V-Contacta, referred to as the Russian Facebook, the sale of which would eventually bring him $300 million. Then in 2013, he started working on an app that would become Telegram.

Here's Duraev talking to Tucker Carlson, of all people. The idea for Telegram came when we were still based in Russia, because at some point we had this very stressful situation where armed policemen would come to my house, tried to break in. This was back in 2014, the same year Russia invaded Crimea. It seems to have been a character-forming moment in Duraub's life. And I realized there is no secure means of communication. Every tool to communicate I could use was not really secure, not encrypted.

It was not safe to use them. So he resigns as the leader of V-Contacta and leaves Russia. A few years later, Duraev has become this kind of symbol for anti-authoritarianism in that country while running Telegram and its operations from Dubai. Durav's Instagram blows up for making things. fun of Vladimir Putin poking at the shirtless Putin memes all while posting his own shirtless photos and photos of yachts and other lifestyles of the rich and famous kinds of shots. When it comes to Telegram, Duraub's very public about his motivations to protect users' privacy.

I mean, he's got personal experience with the Russian government putting the squeeze on it. But some people have questioned those motivations, wondered about double agentry. Sometimes because of this dissonance between the reputation, of Telegram as an encrypted messaging app and how it actually functions. Majority of the communications on Telegram, including like group chats, there's no option available to fully encrypt the messages. You can only have encrypted messaging in separate one-on-one conversations. And even then, it's hard to turn on.

Matthew Green is a professor of computer science at Johns Hopkins and an expert in the science of encryption. You have to click four times. You have to press one button to see, you know, that your friend's profile page. Then there's kind of a hidden menu. And inside that hidden menu, it says start encrypted secret chat. You click on that. It says, do you want to do this?

Are you sure? And even then if the friend you want to message securely doesn't have the app open, you can't actually send the message. It's just four clicks. But that extra four clicks and that a lot of people don't know about are really the difference between 99% of people using encryption and 99% not using encryption. Oh, and by the way, even if you are part of the probably small percentage of Telegram users opting into end-to-end encryption on the app, Matthew Green isn't impressed with that either. It's like you got a bunch of pretty bright mathematical geniuses who have never done anything with cryptography, and you told them to invent cryptography from scratch.

And they kind of, you know, did the best they could. And it's not great. So why do people bother with Telegram at all? It is just like this kind of very rogue app that mostly is used almost like Twitter. I mean, people set up public channels where they broadcast information. But unlike Twitter or Facebook or any of these things, it just doesn't comply with law enforcement. That's like it's superpower. Except, you know, when law enforcement forces Pavoldurov to comply.

After all, he did kind of flee Russia and get pushed out of his last tech company, seemingly part of why he brought Telegram to Dubai. And then again, at the end of August, when he was forced off the plane in Paris. Pavl Dorov's problem, the reason that he was arrested in France is not because he created this ultra-secure, ultra-private's app and that that, you know, bothers governments and that they can't stand how encrypted, how private it is. It's the opposite, which is that people can see what's going on and they don't like it. Exactly. Everybody can see what's happening on Telegram. It's obviously, that it's just rife with criminal behavior.

Right. And Pavl Durav won't help, nonetheless, with any of the investigations into those crimes. People like Matthew and Natalia used to think, okay, telegram isn't perfect and has a lot of vulnerabilities, but surely the people running Telegram want it to be secure, right? Matthew would go back and forth with Durav on Twitter about how to improve the app.

And spicy, as his takes may have been with spicy responses from the Russian billionaire, Matthew thought Duraev was engaging in good faith. But that thought has been forced from Matthew's mind. Now I've kind of come to a different conclusion. The conclusion is that Telegram has been very happy to advertise that they have encryption and they're a secure messenger. But the difference between that advertising and what's actually real in Telegram is so big that I almost kind of feel like they're trying to draw users in with the promise of encryption

that doesn't really exist. Natalia has reached out to Telegram with feedback over and over again as well. But to no avail. Telegram doesn't really collaborate with researchers like Matthew. It doesn't share its policies about what data it collects

or who it shares it with for people like Natalia, who work with dissidents and journalists whose lives sometimes depend on private communication. It sort of then creates a room for a lot of rumors, and speculations, and especially after this recent incident, people are really concerned about where is their data stored, who has access to it, and whether Dura might be able to be sort of coerced into not just by French government, but perhaps by other governments involved

and sort of by this to also request access to people's communications. So, to recap, Telegram is not really encrypted unless you opt into a pretty tricky feature in the app and keep doing that over and over. In fact, you're perhaps more safe when it comes to privacy if you're using WhatsApp, because WhatsApp uses encryption technology, really a protocol from an organization and app called Signal. And Signal is what everyone we talk to refers to as a kind of gold standard. The app signal. This thing called Signal.

Our helpline, our digital security helpline does recommend Signal. Does Signal also have at its tippy top super. villain or superhero leaders who also make us remember we're living in strange times? Kind of. Yeah. More on that in a hot second. At Radio Lab, we love nothing more than nerding out about science. Neuroscience, chemistry.

But we do also like to get into other kinds of stories. Stories about policing or politics. Country music. Hockey. Sex. Of bugs. Regardless of whether we're looking at science or not science, we bring a rigorous. to get you the answers.

And hopefully make you see the world anew. Radio Lab, adventures on the edge of what we think we know. Wherever you get your podcasts. There is something powerful about the sound of the human voice. Beautifully produced audio has the unique power to connect and inspire. Tell your organization's story with a custom podcast from City Space Productions, the creative studio from WBUR's business partnerships team. Become a thought leader.

recruit new talent, reach new audiences, whatever your goal, we can help. Discover how the magic is made at WBUR.org slash creative studio. You've already heard a bit from senior wired writer and author Andy Greenberg. And Andy has recently been talking to and writing about some of the leaders of the app Signal. Before calling them up for this story, Andy and I hadn't talked for a long time. Hey, man. How are you? Good to talk. It's been a while. Almost 10 years ago, Andy and I had explored the dark web together for a story about Silk Road,

the dark web marketplace that let users like us poke around to find illicit products, which we did with an appropriate username. The last time we talked, one of us was Dank Nugs, I think. That's right. Since then, Andy Greenberg has been writing about hackers, and that includes the person who started Signal. The first time I met the creator of Signal was at a hacker conference, I think in 2008. Is this Moxie Marlin Spike?

That's right, Moxie Marlin Spike. And I was kind of like, who is this incredibly like rail, thin, tall, blonde, like, hacker with dreads, who is basically like an anarchist? And he seemed really brilliant. But what kind of name is Moxie Marlin Spike? anyway. And then I kind of followed his work for a few years, and then eventually he launched these two apps called Red Phone and Text Secure, which offered encrypted calling and texting, respectively. And then in 2014, those merged into this thing called Signal, which did seem, even at

the time, kind of remarkable. Like, what is this one app that can end-to-end encrypt all of your communications so that even the people running Signal can't access them? and it's free and it's incredibly simple to use. Like it basically is as simple as like the calling and texting buttons on your smartphone already. So, you know, I was interested in Signal from truly before it even launched and I've been following it ever since. What was your read on his motivation and philosophy? Well, Moxie is a super interesting person and he is a real crypto anarchist.

Like he is an actual just anarchist. He believes and will tell you that the reason that he built signal is to help people break the law, which is a remarkable thing that most privacy people would never say out loud. But Moxie believes that gay marriage would never have been legalized if it had not been possible for people to have private conversations with their gay lover, that marijuana, you know, kind of harmless drugs would also maybe have never been legalized in certain parts of the U.S. if there hadn't been ways for people to evade law enforcement and buy and sell those things and communicate about them, that privacy helps to kind of test the borders of what is acceptable in society and allows us to evolve as a civilization. So Moxie Marlin's Spike starts Signal and then some other people get involved,

including someone who helps start another messaging app and Meredith Whitaker, who worked at Google. how does Signal become a frequently used and stable company financially? Yeah, I mean, what Signal has done is so unique. I mean, Signal now has been downloaded hundreds of millions of times. Its encryption protocol has actually been adopted by WhatsApp. What's so remarkable about it is that it remains a nonprofit. And that is really unique. I mean, there's nothing that I can think of of Signal's size

with these hundreds of millions of users that doesn't have a profit motive, that doesn't collect any data, that doesn't do any ads or ad tracking or surveillance of any kind. It got some grants initially, I believe, from the State Department as a kind of international free speech,

free expression project, you know, as the State Department sometimes funds in the hopes of like helping dissidents and activists and journalists and other parts of the world. In 2018, the co-founder of WhatsApp, Brian Acton, decided to leave WhatsApp and become the president and CEO of the Signal Foundation.

He gave $50 million to Signal. And I think that was the beginning of new era for Signal where it became more sustainable as a nonprofit and it can scale up. And so far it's sustainable, but it is like a totally unique experiment. There's an interesting tension point that pops up in my mind when you describe Signal as getting some of its early funding from the State Department. It's very weird for sure. And it's become the source of a lot of conspiracy theories, like Signal must have a backdoor, must be this trap for users created by the U.S. government. I don't believe that.

I think the U.S. government is just very complicated. But Moxie Marlon Spike, when he created Signal, certainly imagined it being used not just by Americans, but in other countries. So this is an area where Moxie the anarchists and the State Department, I think, have some aligned interests or did, you know, 12 years ago. But the thing about Signal is that you don't have to imagine some conspiracy necessarily because it's an open source app. Anyone can look at the code. Anyone can audit its encryption. Look to see if there is a backdoor.

And there's been no evidence of that. I mean, people have probed Signal and its security properties really carefully for the last decade now. And it has been adopted by like all these Silicon Valley firms who really believe in it. And I think that most people who really care about security do too. How would you describe Signal as different from Telegram when it comes to messaging? It's kind of hard to even describe what's the same about them. I mean, I as a reporter who talks to a lot of hackers join these channels and follow hackers who are just like dumping stolen information on Telegram. It's used for buying and selling drugs.

It's definitely used for child sexual abuse materials to some degree. And this is not because the stuff is super encrypted and private. It's because Telegram does not comply with law enforcement requests to take down information or hand over information about users to the cops. For instance, I'm following like a Russian hacktivist group right now that is called the Cyber Army of Russia Reborn. They are constantly hacking Ukrainian and European targets, trying to cause as much mayhem as possible, posting their wins to telegram. talking about all their activities, sometimes posting stolen data from their victims to Telegram. And that is very common.

Telegram, it's like a free-for-all. And I get like push notifications from this telegram group every day about what this one Russian hacker group is doing, and the destruction and damage and mayhem that they're inflicting on their victims. But unlike Twitter or Facebook or any of these things, it just doesn't comply with law enforcement. That's like it's superpower. And this is what I'm curious about, though, because just as much bad stuff could be happening on Signal, it's just the key difference is we don't know. Absolutely. I mean, that is kind of the nature of privacy, right? I mean, it's dark. Like, things happen in the dark that are good and bad. And that is sort of, like, priced in to what Signal is offering the world. Absolutely criminal things are happening on Signal.

So is journalism and activism and really important communications in repressive regimes that keep people alive and help them not be thrown in prison by the whatever Iranian, Chinese, Russian governments. But, you know, that is the bargain when you offer a truly private tool. Your recent interview with the president of Signal, Meredith Whitaker, had this headline on it that, she is out to prove surveillance capitalism wrong. I know reporters don't always write the headlines, but tell me more about what that means. I think I'm on board with that headline. I mean, I've always thought of Signal as just, like,

the most well-reputed end-end encrypted messenger, but it has grown into something more than that, something bigger, which is that it's now been downloaded by hundreds of millions of people, and it is really like the only non-profits app of its kind. of that scale that truly is no profit motive that doesn't show any ads that is free. And I think that is really Meredith Whitaker's focus is creating a model and signal of a large-scale communications platform of an actual tech company that does not surveil users for money,

which is actually incredibly rare. Our modern tech world is basically fueled by surveillance. It's like that is how these things are run. It's how they make money. It's how the people who create them get rich is by collecting data on all of us to show ads for the most part. And that is this kind of like intertwining of surveillance and spying that we've all come to accept as the reason we have nice things on the internet. So that is what Meredith, I think, is now focused on is creating in signal a model for a different. way of creating internet technologies. Like, I think that there's something perhaps happening here,

where companies are realizing that maybe privacy is an area of technology where you can create services without a profit motive, and that that's the most sustainable way to do it. In your interview with the president, Meredith Whitaker, she talks about how she considers AI totally inextricable from the discourse around this kind of mass surveillance business model that we're all living and swimming around in, where tech companies profit off of the data they collect on users. Can you talk a little bit more about the connection that she makes there? Yeah, I mean, before Meredith became the president of Signal,

she was a kind of skeptic of AI at Google, where she worked, and then created the AI Now Institute as kind of an AI watchdog. I, going into this interview, was almost thinking, like, why does Meredith this encryption and privacy person in her professional life talk so much about AI all the time? And she was the one who explained to me. And I think would just say more broadly that AI and surveillance are kind of inherently intertwined. And in the sense that AI is made possible by massive amounts of data. And of course, all of these companies that create AI tools are scraping billions and, I'm

I don't even know quadrillions of data points. Much of it from people's rather private things, like on the internet, their texts and posts and communications in many cases. But then also to run an AI company, you have to have massive computing power. And the companies that have that are the same Silicon Valley giants with their profit motives and their surveillance business models. So she's basically saying that in the world we live in, that surveillance is kind of like the precondition of running,

AI in the way that our capitalist society works. And then also that AI tools are then used for really nasty forms of surveillance. One of the reasons that she left Google was that Google was engaged in contracts with the Department of Defense. And, you know, the use of AI and military applications is something for missile targeting, as we've seen in Gaza. The IDF is using AI to choose targets in Gaza. And with all of its fallibility, and deadly consequences. Her point, and I agree with this, is that AI is both fueled by surveillance

and then it's used for surveillance with really dangerous consequences. All of this, to me, gets at this really fundamental question about the Internet. I feel like we're always talking about in a way, and we've been talking about since the beginning. Can we, should we, be able to be anonymous

or not. Yeah, I mean, I would say it's like not just anonymous or not anonymous in this case, because Signal for a long time required you to even have a phone number. To register with a phone number, you showed your phone number, actually, to everybody you communicated with.

So it was not anonymous. It was private. What you were saying, and even who you talked to, because Signal doesn't share that with anyone, doesn't collect it, was all private. But I think that the question

you're getting at, is privacy good? Like, should it be possible to have truly secret stuff on the internet? Truly secret data and communications. And that will always be a double-edged sword, you know, like that will always contain good and evil. Andy Greenberg, author and senior writer at Wired Magazine,

thank you very much, man. Thank you, Ben. Good to talk. So, dear listeners, Redditor, with wacky screen names, everybody participating in online communication and communities who listens to this show on a regular basis. We've interrupted your regular programming as we head into a national election where both sides accuse the other of fascism and government control. No false equivalencies here. I'm just stating the facts. This long PSA is to remind us all that what we do and say online is private, precious rarely.

And there's a lot of complexity and nuance, even between apps that we assume are in the same category. So think about the people in charge of technology. Think about the non-boring dystopia you want to see in the near future and spend your time, that hugely valuable thing that all of these tech companies want and sell, and the places that suggest the future you want. Food for thought.

Also, please stop asking me to post my abs on Instagram. It's not going to happen. This episode was produced end to end by Grace Tatter. It was edited by Summata Joshi and sound designed by American hacker Emily Jankowski. Our messages to Amory Sebertsin while she's on vacation are the pinwheel of death. Dean Russell is also in the channel, but this week he's a lurker. Big thank you to the hugely informative and detailed Reddit posts of users Mayfly 42, Okam and Dark Alman, which inspired our own swan dive into the encrypted app rabbit hole.

Endless Thread is a show about the blurring lines between online communities and a Russian billionaire living in Dubai. If you have an unsolved mystery, untold history, or other wild story from the internet you want us to tell, hit us up, Endless Thread at WBUR.org.org. And yes, we are happy to continue our communications on Signal. Thanks for listening.