France uses arcane cyber law to charge Telegram CEO

France’s high-stakes arrest of the chief executive of Telegram showed that European investigators aren’t afraid to wield their full powers to stop the sexual abuse of children and drug trafficking online.
But it was two other, less-noticed charges that have caused a ruckus across the tech sector: those charging CEO Pavel Durov for not working with French authorities in running his encrypted messaging tools.
Durov faces a total of six charges, according to his Aug. 28 arrest warrant, two of which accuse the Russian-born tech tycoon of offering encrypted technology services “without certified declaration,” and of importing an encrypted messaging app, also “without prior declaration.”
Unlike the charges of allowing illegal content to spread freely, these two encryption charges seemed to come out of left field for tech applications using encrypted messaging — which include brand names like WhatsApp, Signal and even Apple’s iMessage.
The surprise charges mean encrypted messaging services were left scrambling to make sure they weren’t in breach of France’s law. It also shed light on how, through obscure laws, some Western governments sought to impose controls over people’s private communication online.
“This is economic suicide and is rapidly and permanently changing the perception of founders and investors,” Andy Yen, CEO of the privacy-friendly tech provider Proton, wrote on X shortly after the charges were made public.
At the heart of the cryptography charges is a law obliging any company offering cryptology tools to notify France’s ANSSI cybersecurity agency, and to keep at its disposal “a description of the technical characteristics of the cryptology tool” as well as the source code of the software.
The law is unusual, especially in Western democracies, where government tampering with private communication tends to be seen as an overreach of state power. One prominent example of a law governing encryption is China’s recently revised encryption law — regarded by critics as state surveillance mandated through legal requirements.
The French law has been in place since 2004, but seems never to have been used to charge tech platforms. POLITICO spoke to three legal experts and two industry officials who had studied the charges, none of whom were aware they had been used as charges in the past.
Vincent Bremgarth, a lawyer at Bourdon Associates, said he had never encountered a conviction for a cryptology offence. “To my knowledge, the obligations of the 2004 law had never been the subject of prosecutions of this type,” he said.
Alexandre Lazarègue, a lawyer in digital law, had also not heard of the law being used to convict anyone.
Adding to the tech industry’s nervousness is the eerie silence from the usually outspoken advocates of encryption. It meant there was almost no public debate over these two cryptography charges.
Meredith Whittaker, CEO of the best-in-class end-to-end encrypted messaging app Signal — and a leading defender of the right to confidential digital communication through encrypted chats — has so far said little about the case against Durov.
Signal itself did not respond to a request for comment. Frederic Jacobs, a founding member of the Signal app, wrote on Mastodon that he “fondly” remembered trying to figure out the ANSSI declaration requirements for Signal in 2014.
Meta, which owns end-to-end encrypted chat app WhatsApp, declined a request for comment.
Many have also been surprised by the charges targeting Telegram’s encryption tools, specifically. The app isn’t encrypted by default and critics have argued it even makes it hard to turn on end-to-end encryption for its users.
“The fact that Telegram is not actually an end-to-end encrypted service, despite their misleading marketing, makes their predicament tougher, given they do in fact have access to data which they could use for anti-abuse purposes if they chose,” said Matthew Hodgson, CEO of Element and co-founder of Matrix, two encrypted communications technologies.
Durov’s lawyer, David-Olivier Kaminski, said after the announcement that Telegram conforms with “every aspect of European norms on digital matters.”
Telegram said in a statement last week — its only statement on the case so far — that the company “abides by EU laws, including the Digital Services Act” and that “its moderation is within industry standards and constantly improving.”
“Pavel Durov has nothing to hide,” it added.