Telegram is the hot new source for pirated content

[Len]

Since its launch in 2013, the instant messaging platform Telegram has maintained a special appeal to journalists, activists, and others who care about privacy. On numerous occasions, the platform has boasted about the efforts it has made — such as enforcing “heavy encryption” — to bolster privacy for its users.

But there is one more incentive to use Telegram, which has been an open secret among hundreds of thousands of users. For much of its existence, the platform has served as a haven for online pirates, rivaling the access to illegally shared files provided by the open internet.

The instant messaging platform, which as of last month is used by more than 200 million users, is riddled with thousands of groups and channels whose sole purpose of existence is to share illegally copied movies, music albums, apps, and other content.

Channel admins told The Outline that they have not come across any resistance from Telegram despite the company, along with Apple and Google, maintaining a “zero tolerance” stance on copyright infringement. This permissiveness on Telegram’s part has led to the proliferation of a cottage industry of piracy marketplaces on the service. (Channel owners and members spoke to The Outline on the condition of anonymity.)

These channels, many of which have more than 100,000 members, have been illegally distributing hundreds of movies, television shows, and songs for years, an analysis by The Outline has found. But despite being flooded with sketchy channels, Telegram has yet to acknowledge the scope of the issue and has banned only a handful of the offenders.

To understand the scale of Telegram's piracy issue, look no further than Global Search, a platform feature that is designed to help users discover groups and channels. Looking up innocuous terms such as “movies,” “Hollywood,” “music,” and “Netflix” returns channels that offer content for direct download. For instance, Telegram users who wish to download “Annihilation,” the sci-fi movie that premiered on Netflix earlier this year, can do so by visiting the first channel that appears when they look up “Netflix” in Global Search results.

At the same time, many average Telegram users are unaware of the vast swathes of movies and other freely flowing questionable content on the platform (Global Search, while accessible from the main screen of the app, doesn’t advertise that it provides access to open channels with shared media; a user who doesn’t happen to search the name of a movie or other piece of content might never know it could do that). Some users who have been using Telegram to get their weekly dose of free media content say they don’t publicly talk about it as they believe Telegram would someday ban these channels if the word got out.

Those who have been using Telegram to download media files from the shady channels say they are in awe of the simplicity the service provides. (It feels worth saying at this point that there is no way to know what a file actually contains before inviting it onto your device, which is a flat-out huge risk.) “I think, people love the simplicity of Telegram, it’s akin to the 1990-2000s websites when Internet was really a freedom island for all,” one user Russia-based user said. Instead of linking to annoying, ad-filled file-sharing websites or asking users to install additional software (as is common on torrent websites such as The Pirate Bay and 1337x, and other questionable forums like mobilism.org and mega.co.nz) most channels upload the content directly to Telegram's cloud-based servers. This has enabled users to download a movie or a song directly to their phone or computer with a single tap. (On Telegram, too, there are a few channels that direct users to third-party websites.)

It's actually a challenge to use Telegram and not run into these sketchy groups.

The Outline spoke to 13 administrators and owners of these channels to understand their rationale for using Telegram to distribute pirated content. Most people said that the variety of options Telegram provides to keep their identities private were immensely useful.

Not only can the channel creators on Telegram remain anonymous to the outside world, even channel members cannot know who runs them. This is possible thanks to the bot platform that Telegram introduced in 2015. Aimed at developers, the bot platform offers APIs to control how interactions take place on Telegram. (From a privacy standpoint, this is perhaps a better approach to handle user identity on a platform. Groups on WhatsApp, by contrast, don’t conceal the phone numbers of participating members.)

“Telegram is also very popular here,” a Russia-based channel owner told The Outline. According to analytics firm SensorTower, Telegram is the second most popular iPhone app in Russia, its largest market. “We estimate that the app has been installed more than 32 million times in Russia,” Randy Nelson, Head of Mobile Insights at SensorTower told The Outline. “Downloads in Russia have seen significant growth. Last year, we estimate it was downloaded about 24 million times there, a 118 percent or 2.2 times increase year-over-year from 2016.”

“Facebook frequently bans our groups. Telegram doesn’t police things like them,” said an administrator whose two-year old channel distributes Bollywood titles. India is the second largest market of Telegram, according to SensorTower. Brazil, and the United States are among the top five markets for the service.

Some Telegram channel owners said they also appreciate the enormous amount of free storage they get on the platform. Telegram restricts a user from uploading a file that is larger than 1.5GB in size (a two-hour movie, encoded with HEVC media codec, with a variable bitrate between 400KBps to 2MBps would weigh under 1.5GB, for instance) but there is no limit to the number of files they can upload. This has enabled some channels to share hundreds of gigabytes of content. On other platforms, they would need to pay for the storage. The Bollywood-channel administrator cited above said he has likely distributed more than 10TB of content on the platform.

For several newcomers, Telegram is a goldmine. “The thing is I started my channel to earn money,” owner of a channel, which trades courses of Lynda, Udemy, Masterclass, and The Teaching Company, told The Outline. “All the right audience is here on Telegram,” he said.

A music industry source told The Outline that several content creators have sent takedown notices to Telegram and have expressed "significant displeasure" with Apple for letting the service stay in the iPhone’s and Mac's App Stores. A spokesperson for Recording Industry Association of America said the group was aware of the issue and was looking into it. Apple and Google declined to comment.

In a statement, Telegram spokesperson Markus Ra acknowledged that "new challenges" have mushroomed on the platform as it has grown. "We’re constantly improving our moderation tools for public content,” he said. Ra did not elaborate on the current moderation tools Telegram uses and the improvements it is planning to introduce. For Telegram’s elusive founder Pavel Durov, piracy has not historically been a pressing issue. VK, the Russian social-networking website Durov founded in 2006, has faced issues with illegal trading of movies and music. “Almost everything was illegal,” one user of the site told Motherboard in 2015.

As Internet service providers, search engines, and local government-backed authorities block torrent websites, online pirates are increasingly finding creative ways to illegally distribute movies, television shows, and applications.

For cybercriminals, finding a large audience is a challenge. In the past, one channel owner told The Outline, credentials would have been sold on obscure forums, Alphabay, and other darknet markets. But most potential customers are either unaware of darknet markets or find it too onerous to find them. While some of those operations are still in existence, Telegram has emerged as a hassle-free place to conduct business. Security researcher Ran Levy, who tracks activity on the platform, told The Outline that he has noticed cybercriminals use Telegram when they wish to drive a significant amount of traffic to their offerings.

The Outline discovered several groups and channels on Telegram in which stolen credentials — i.e., the username and password for a website — from Netflix, Spotify, Hulu, HBO, CBS, EA Sports, Lynda, Sling, WWE Network, Mega, India's Hotstar, and dozens of other services were being offered to tens of thousands of members each day.

The Outline sourced nearly three-dozen free credentials from six Telegram channels, all of which worked as advertised. Two group owners said they offered some of their services for free to gain users’ trust and incentivize them to pay for other things (when the credentials are not given away for free, the channel managers take payment via PayPal or other methods).

All the credentials we tested appear to have been compromised in one or more data breaches in the recent years. (We ran the credentials by security researcher Troy Hunt's Have I Been Pwned website, which helps people determine if their account has been compromised in recent security breaches.) Attempts to contact the rightful owner of the compromised accounts were unsuccessful. A Telegram spokesperson did not comment on the instances of illegal trading of credentials on the platform.

These Telegram channels have been widely discussed on Reddit and other social networks. But despite the names of and direct links to the channels being shared in public view, most continue to thrive, seeing hundreds of new users join every few days.

Looking up “Spotify” in Global Search returns three channels (by default; the Global Search feature only returns three popular results to any query), two of which are being used to share and discuss modified versions of Spotify that boast of special “features,” such as no ads for free users (Spotify offers a paid tier with no advertising, so accounts that users don’t pay for and don’t serve ads interfere with Spotify’s business model). In a filing with the SEC last month, Spotify said more than two million users were using modified versions of its service, such as the ones available on Telegram, and that this was making a dent in its revenue.

It is unclear how frequently Telegram squashes piracy-focused groups, but the figure is likely to be lower than Facebook and other services, which take action against piracy groups on a daily basis. Telegram has been a sporadic anti-piracy enforcer at best. Last year, for instance, the company made headlines after it shut down a music channel called @Top_pop. In a statement reviewedby The Outline, Telegram told Anton Vagin, the channel’s owner, that the company had received copyright violation complaints about his channel from Apple and Google. Vagin told The Outline that he is still puzzled why his channel was singled out. “They didn't send any message,” he said. “One moment I just saw that the channel is banned, that’s all.”

In a series of tweets late last year, Durov boasted about the openness of his platform and how his company restricts itself from taking any action on the groups and channels, unless users make public calls for violence or share porn or copyright infringement content.

“And even those limitations we do have,” Durov tweeted on December 31, “are forced on us by the mobile platforms which threaten to kick @Telegram from AppStore/Google Play every once in a while for being too libertarian.” He added, “Realistically, you can't have more freedom than on @Telegram in a mobile app for iOS/Android.” Thousands of online pirates would agree.