Telegram — dossier individuel d’investigation (13 octobre 2026)¶
Registre de preuves — Phase 2
Ce dossier est une pièce de recherche datée. La conclusion canonique est celle du rapport final 1.0. Les synthèses antérieures et renvois à la Phase 3 restent historiques. UNKNOWN reste UNKNOWN.
Périmètre. Telegram est un service cloud centralisé. Sauf indication explicite, « Telegram » ci-dessous signifie Cloud Chats/Groups, et non Secret Chats. Les bots, canaux, mini-apps, Premium et appels ont des frontières et tiers supplémentaires.
| Catégorie | FACT | VENDOR CLAIM | INDEPENDENT EVIDENCE | INFERENCE | UNKNOWN |
|---|---|---|---|---|---|
| 1 Architecture | Service cloud centralisé, pas de fédération/self-hosting; synchronisation depuis le cloud. | Telegram dit utiliser un réseau/datacenters qu’il possède et exploite; la politique évoque une infrastructure de datacenters tiers loués. | FAQ Telegram dit que le code serveur n’est pas publié et qu’il ne serait pas possible de vérifier le code effectivement exécuté. | Centralisation donne au service une vue sur comptes, routage, cloud chats et communautés publiques. | Composition actuelle des régions/backend, sous-traitants et séparation des rôles techniques. |
| 2 Protocole cryptographique | MTProto 2.0; chiffrement client–serveur pour Cloud Chats, Secret Chats E2EE individuels et liés à des appareils; appels ont mécanisme E2EE selon la doc. | Le fournisseur annonce AES-256 et sécurité des Secret Chats; code protocolaire documenté. | Revue académique du protocole existe (p. ex. analyse formelle publiée 2020); elle ne certifie pas serveurs ni déploiement actuel. | MTProto 2.0 ne rend pas les Cloud Chats E2EE: Telegram peut déchiffrer leur contenu dans son architecture. | Version précise des implémentations en production, paramètres effectifs, audit indépendant complet de 2026 et garanties pour tous formats. |
| 3 Création d’identité | Numéro de téléphone requis à l’ouverture; nom/profil et username facultatifs. | Telegram présente le numéro comme identifiant nécessaire au compte, configurable en visibilité. | Politique courante liste phone number/basic account data. | Numéro lie compte/appareil à l’opérateur télécom même si les contacts ne le voient pas. | Identité réellement vérifiée, noms supplémentaires, paiement Premium et identité des numéros virtuels. |
| 4 Contact discovery | Import/synchronisation de contacts optionnelle; recherche username et ajout par numéro; les paramètres contrôlent visibilité. | Télégram affirme que contacts synchronisés sont chiffrés/stockés pour retrouver les amis et peuvent être effacés. | Étude NDSS de discovery a crawlé 10% des numéros US WhatsApp et 100% Signal et relevé API Telegram révélant données sensibles même pour des numéros non inscrits; paper soumis 2021, versions alors mesurées. | Numéro requis et lookup créent un risque d’énumération, mais résultats historiques ne démontrent pas le taux de vulnérabilité en 2026. | Rate limits et champs visibles après protections actuelles; nouveau test autorisé sur comptes contrôlés nécessaire. |
| 5 Métadonnées serveur | Numéro, IP, appareils/apps, changements de username et autres métadonnées anti-abus peuvent être collectés; politique max 12 mois pour cette catégorie lorsqu’elle est collectée. | La politique limite la rétention de métadonnées citées à 12 mois et décrit cloud chats synchronisés. | Politique versionnée fait foi pour la déclaration, non preuve indépendante de la pratique réelle. | La plateforme peut relier graphe de contacts, groupes, sessions et activité via un compte centralisé. | Logs exacts, champs conservés par région, query/search logs, rétention pour messages et groupes. |
| 6 IP utilisateur | Serveur voit l’IP de connexion; politique liste IP comme métadonnée de sécurité. | Fournisseur dit conservation max 12 mois si IP/device metadata collectée; policy annonce possibilité de remise sous ordre valide. | Cour documents US 2025 cite les réponses Telegram aux autorités depuis septembre 2024 comme généralement numéro + IP du login le plus récent. | VPN/Tor masque l’IP d’accès directe mais ne rompt pas le lien avec numéro/compte et timing. | Historique IP par session, durée de conservation actuelle et éventuels logs non inclus dans 12-month wording. |
| 7 IP au correspondant | Réglage P2P d’appel; autorisé, IP directe peut être communiquée au pair; relay forcé l’évite vis-à-vis du pair. | API Telegram documente P2P et réflecteurs; paramètre « Peer-to-Peer Calls ». | Documentation développeur officielle, pas de pcap effectué. | Relais déplace visibilité au service au lieu de supprimer l’IP. | Quel mode est actif par défaut dans versions et si exceptions/régions changent les candidates. |
| 8 Messages | Cloud chat messages/media/files stored and synced; Secret Chat is E2EE and device-specific. | Telegram affirme stockage cloud chiffré; Secret Chat E2EE. | FAQ reconnaît distinction; formal analysis treats MTProto but no broad audit of current app/service. | Cloud text/messages can be available to backend and legal disclosure, while Secret Chat ciphertext should not. | Exact key custody and internal access controls for cloud chats; moderation/AI processing paths per feature. |
| 9 Groupes | Cloud groups/channels are not Secret Chats and not E2EE; very large communities and bots exist. | Telegram describes end-to-end encryption only Secret Chat; public content moderates under policy. | API/FAQ semantics and server-side searchable community support establish backend access. | Membership, public posts, administrator graph and messages in groups can be visible to server. | Detailed history retention, server-side scanning scope and content deletion behavior per group. |
| 10 Appels | 1:1 voice/video calls, peer-to-peer if setting/network allows, relay otherwise. | Telegram claims call encryption and offers IP-hiding P2P setting. | API docs define P2P and reflectors, but no call cryptanalysis or runtime capture in this phase. | Direct call potentially reveals IP to other party; service relay sees session metadata. | Whether all calls share same cryptographic protocol and metadata logging/retention. |
| 11 Fichiers | Files/media in Cloud Chats are retained/synced through service; Secret Chat media follows device-specific chat semantics. | Telegram calls cloud history accessible from devices without third-party backup. | Official FAQ and policy. | Cloud storage allows service-side access/deletion/moderation and legal process; Secret Chat attachment still endpoint-exposed. | Encryption at rest/key management, exact object regions and retention after delete. |
| 12 Multi-device | Cloud Chats synchronized on many sessions; Secret Chats are per device and lost on logout according to FAQ. | Vendor presents cloud sync as feature and secret chat as device local. | Official FAQ documents difference. | Device list links multiple endpoints to one number and creates correlation data. | Device session metadata, history window, linked web clients version and key distribution details. |
| 13 Push | APNs/FCM or other OS push paths are expected on mobile; notification payload behavior may vary. | Public client source and FAQ describe notifications/settings; privacy docs do not completely characterize all payloads. | No live push capture or current build SDK manifest review completed. | Push provider sees token/time and may see message preview if configured/notification content sent. | Per-platform payload encryption, token linkage/retention, current third-party SDKs and notification preview behavior. |
| 14 Stockage local | Test data from Telegram iOS 11.1.1 was found under telegram-data/.../postbox/db/db_sqlite and a media directory; WAL may hold transactions not reflected in the main DB. |
Desktop/mobile apps expose local chat data/cache; vendor describes secret chats as device-specific. | Jaeckel et al. (2025) used UFED Touch full-file-system acquisition and source-guided BLOB decoding; they report the database data they analyzed was not encrypted at the app layer. iOS build, UFED version and phone lock state are unreported. Study PDF. | Shows that endpoint artifacts from that build could be read after extraction; not that locked-device protection is bypassed, nor that deleted data survives. | Current db schema/media/keychain by platform, iOS Data Protection class, lock-state constraints, deletion recovery and present-day UFED/GrayKey/Magnet support. |
| 15 Sauvegardes | Cloud Chats live on Telegram cloud; Secret Chats are not cloud-restored; vendor says default system backups disabled in FAQ. | Telegram says secret chats are not part of backup and phones use cloud sync. | FAQ and client settings; no independent restore test. | A device’s OS backup may differ from in-app cloud storage and build/platform. | Current iCloud/Android backup exclusions, export files, encryption and logout recovery. |
| 16 Analytics / SDK tiers | Product has optional translation; chosen messages may be shared with Google/Microsoft; Telegram claims providers do not retain/use unrelatedly. Voice transcription option documented with provider in product FAQ (exact path/version-dependent). | Policy identifies these optional third-party processing paths. | Public source lets some SDK/client code be reviewed; no installed binary traffic measurement/SDK inventory this phase. | Features selected by a user can expose plaintext beyond Telegram client/server. | Complete analytics/crash SDK list, remote config and actual data payload/retention. |
| 17 Code source | Mobile/desktop clients and TDLib open source; server backend closed; API/protocol docs public. | Telegram offers source and claims client transparency. | GitHub repos are public; FAQ itself states server source cannot prove code execution. | Source allows client review but not confirmation of backend operation. | Every platform/client version current commit and backend code/security controls. |
| 18 Builds reproductibles | Telegram publishes a build verification guide for Android/iOS starting 5.13, calls it experimental. | Vendor says binaries from App Store/Play can be independently compared to GitHub source. | Instructions exist; no reproducible build run or current version comparison done. | Reproducibility is achievable only for exact build/channel/toolchain and does not cover server. | Current verified versions, result per store, differences in encrypted iOS frameworks and signed distribution. |
| 19 Supply chain | Builds require Android SDK/NDK, Docker/toolchains and platform dependencies; signatures/source releases are publicly inspectable. | Telegram calls client apps open source and verifiable. | No independent build artifact comparison completed; published guide explicitly labels workflow experimental. | Third-party libraries, updates/store account and uninspectable backend remain trust surfaces. | Current dependency audit, maintainer activity, signed-tag coverage, SBOM and supply-chain attestations. |
| 20 Infrastructure | Central cloud; policy says for EEA/UK user data stored in leased third-party datacenters in Netherlands, with Telegram owning/operating servers/network. | Official privacy policy. | Policy is source for claim; this review did not query current DNS/ASN/route/hosting logs. | Leased location does not show where all backups, global metadata or support copies live. | Current domains, ASN, CDN, anycast, cloud/region mapping, redundancy and third-party access. |
| 21 Juridiction | Corporate policy names entities/regions; legal reach depends user’s location, processing entity, infrastructure and process. | Telegram identifies operating entities and policies; exact applicant legal entity varies. | Official policy/terms are first-party claims; no contract or cross-border transfer audit. | EEA data storage in NL does not by itself immunize against all external legal process or disclose actual legal control. | Entity for specific account, beneficial control, subprocessors, government-to-government transfer and challenge practice. |
| 22 Demandes policières | Current policy says after valid judicial order confirming a suspect in TOS-violating criminal case, Telegram may disclose IP + phone; transparency available via in-app regional bot. | Policy and legal guide define policy; DOJ affidavit says US requests started being answered around Sep 2024, generally phone + most recent login IP. | DOJ affidavit is sworn case-file description; official transparency bot aggregates count, not data fields per matter. | Cloud-chat content may be technically available under backend control, but statement does not establish routine disclosure of plaintext. | Exact data returned in each US criminal request, contents disclosed, preservation practices, legal rejection rates. |
| 23 Affaires judiciaires connues | Delhi High Court copyright case Neetu Singh v Telegram (2022): Telegram filed a compliance affidavit and sealed data; the Court says it reviewed a chart with administrator names, phone numbers and IP addresses for some channels. Telegram said some channel data was unavailable after statutory retention periods. In Dec. 2023, the plaintiff said the delivered information contained only names and IPs, an unresolved apparent discrepancy. | The policy then published by Telegram described a narrow terrorism-suspect exception; Telegram also argued that Singapore privacy law barred disclosure. Current policy now describes possible phone/IP disclosure under qualifying criminal-case orders. | Delhi High Court orders of 30 Aug. and 24 Nov. 2022 plus follow-up of 1 Dec. 2023; the Nov. order confirms the sealed production and categories the judge observed. 30 Aug. order [accès à vérifier], 24 Nov. compliance order [accès à vérifier], 1 Dec. 2023 follow-up [accès à vérifier]. | Confirms judicially ordered provider production and data actually examined by the Court and supplied to plaintiffs’ counsel; the order permitted—but does not prove—police disclosure. A civil copyright case is not a criminal-prosecution return. | Exact values/accounts and complete field set remain sealed; whether police received the data; criminal-case return fields; ordinary Cloud Chat text supplied in a specific case. |
| 24 Audits | No whole-product independent public audit of current Telegram client+backend located. Academic protocol analyses are not equivalent to product audit. | Telegram says experts are welcome and source/protocol public. | Academic analysis of MTProto 2.0 and client source are independent scrutiny, not release assurance. | Proprietary server makes deployment/data-flow claims harder to verify externally. | Current independent app/backend penetration tests, audit report scope, version/commit, fixes and retest. |
| 25 Vulnérabilités | Client security bugs/third-party advisories may arise; exact currently exploitable findings should be mapped to builds. | Vendor maintains security contact and bug reporting. | No current critical advisory with verified 2026 affected build included in evidence set. | Absence from this search is not evidence of no vulnerabilities. | Complete NVD/GitHub advisory inventory, exploitation evidence and patch rollout. |
| 26 Recherche académique | Work includes MTProto formal analysis, contact discovery/scaling and protocol analyses. | — | All the Numbers are US (NDSS); protocol formal analysis arXiv 2012.03141. Findings are scoped/versioned. | Research on an old API/build can motivate tests but not establish current exploitability. | Full systematic research inventory after MTProto 2.0 implementation revisions. |
| 27 Incidents historiques | 2022 disclosure litigation; 2024 policy shift and 2024–25 US data sharing; Durov arrest/intermediary cases concern company/legal context, not cryptographic break. | Telegram publicly describes policy changes. | Court orders, DOJ affidavits and current privacy policy are primary records; press reports contextualize aggregates. | Do not confuse legal data requests with a breach or E2EE failure. | Any unreported breach, security incident or secret-process disclosure. |
| 28 Gouvernance / société / financement | Private centralized company and founder-led governance; no federation. | Company describes mission and management in public materials. | Corporate registries, official legal terms and policy are separate evidence; independent governance structure is limited. | Concentrated service ownership means company policy, executive decisions and jurisdiction matter. | Audited financials, beneficial ownership, controls, independent oversight and staff access. |
| 29 Résistance à la censure | No federation; central domains, app stores, phone/SMS, network endpoints and payment/Premium can be blocked. | Telegram positions itself as censorship resistant and clients support proxies. | Protocol supports MTProto proxies; no systematic current country-by-country OONI test in this phase. | Proxy option may improve connectivity but relay can observe IP/timing and state may block stores/SMS. | Actual blocking rates and stealth effectiveness by country/ISP/build. |
| 30 Maintenance actuelle | Official clients/releases and API docs continue; version varies by store and platform. | Release notes / app pages. | Repositories, current policy and store listings establish active distribution. | Active development does not answer patch latency/security review. | Release-by-release signed commit and reproducible match; exact versions across regions/stores. |
Telegram — audits, repositories, mobile, forensics et droit¶
- Repository/builds: official Android client
TelegramOrg/Telegram-Androidand iOSTelegramMessenger/Telegram-iOS(fork/repository ownership differs by client); reproducible-build guide says supported from 5.13 and experimental. It prescribes exact release tag/build matching and APK/IPA comparison. No current build was rebuilt here. GitHub source is not a server audit: the official FAQ explicitly says published server code cannot prove what is running. - Activity/dependencies/CI: repository activity, signed tag reach, current dependency inventory and active maintainer count have not been normalized across Android/iOS/web/desktop in this turn; mark unresolved rather than inferring from stars or commits. Client OSS does not cover Bot API backend, cloud server, moderation or hosted file storage.
- Mobile: Google Play listing and Apple listing expose developer-provided Data Safety / App Privacy disclosures. Those are declaration surfaces; the actual manifests, APK SDK list, runtime analytics/crash traffic, FCM/APNs payload, permissions and contact upload were not independently inspected in this phase. Official FAQ says camera is requested upon user actions and describes source-based check, but that remains vendor explanation until build-specific analysis. No assertion here that Firebase/analytics is absent.
- Forensics: a 2025 peer-reviewed DFRWS/FSI paper now documents Cellebrite UFED Touch full-file-system extraction of Telegram iOS 11.1.1 data on iPhone SE/iPhone 7 test devices, followed by decoding of
db_sqlite, WAL and media. It does not report the iOS version, exact UFED build or lock state; it does not demonstrate an unlock bypass, current-build extraction or recovery of deleted data. This replaces the earlier blanket “no versioned tool result found” wording only for this dated test. PDF. Cloud chat also differs: data may be obtainable via Telegram/backend process rather than device bypass. - Law-enforcement evidence ladder: (i) technically available: server-controlled Cloud Chat data, subscriber account and metadata; (ii) officially declared: privacy policy allows phone/IP disclosure upon valid order in a qualifying criminal case; privacy policy says metadata may be retained up to 12 months if collected; (iii) actually documented: in the 2022 Indian civil copyright case, Telegram filed account-identification data under seal and the Court reviewed a chart listing administrator names, phone numbers and IP addresses for some channels; plaintiffs later said only names/IPs were supplied and some information was unavailable. The record permits disclosure to police but does not establish a police transfer. A 2025 U.S. affidavit says Telegram began responding around Sep 2024 with subscriber details, typically phone number and last-login IP, but this is an agent’s description of current practice, not proof of the exact return in that case. 2024 aggregate transparency counts (900 U.S. cases / 2,253 users) were publicly reported from bot output, not itemized returns. No verified case here establishes that Telegram delivered ordinary Cloud Chat plaintext in a criminal matter. Delhi HC order 24 Nov. 2022 [accès à vérifier], follow-up 1 Dec. 2023 [accès à vérifier], DOJ affidavit, filed 31 Jul. 2025.
- Sources: Telegram FAQ, privacy, MTProto, reproducible builds, NDSS contact discovery, Delhi High Court order, 30 Aug. 2022 [accès à vérifier], Delhi High Court compliance order, 24 Nov. 2022 [accès à vérifier], follow-up order, 1 Dec. 2023 [accès à vérifier], US DOJ affidavit, official transparency bot, DOJ/US court case archive, Telegram seizure warrant 2026.
Telegram — matrice des métadonnées¶
| Métadonnée | Fournisseur Telegram | Contact | ISP | Apple / Google | Autorités |
|---|---|---|---|---|---|
| IP | CONFIRMÉ à la connexion; retention policy max 12 months if collected; US legal responses typically last login IP per DOJ affidavit | POSSIBLE appel P2P | CONFIRMÉ | POSSIBLE login/store/network metadata separate | CONFIRMÉ : observée par la Cour pour certains canaux dans la production civile indienne; police effectivement destinataire NON ÉTABLI |
| Téléphone | CONFIRMÉ (account registration) | POSSIBLE selon visibility/privacy setting | NON ACCESSIBLE PAR DESIGN to ISP except carrier/SIM records | POSSIBLE account identity | CONFIRMÉ : noms/numéros figurent dans le tableau scellé examiné par la Cour en 2022; remise à la police NON ÉTABLIE |
| POSSIBLE (optional/recovery) | POSSIBLE profile | NON ACCESSIBLE PAR DESIGN | CONFIRMÉ Apple/Google account separately | POSSIBLE if registered/account metadata | |
| Identifiant | CONFIRMÉ user ID, username changes, device/app metadata | CONFIRMÉ username/profile, groups | POSSIBLE correlation only | POSSIBLE installation account | CONFIRMÉ subscriber/account information if requested |
| Graphe social | PROBABLE cloud contacts/chats/groups/channels/administrators | CONFIRMÉ chats/groups/channel membership | POSSIBLE patterns | NON ACCESSIBLE PAR DESIGN directly from store | POSSIBLE via account records, public channel data, device |
| Timestamps | CONFIRMÉ service processes cloud-chat delivery/session | CONFIRMÉ local message/time | CONFIRMÉ connection/session | POSSIBLE push events | POSSIBLE, scope/retention unknown |
| Volumes | CONFIRMÉ storage/routing sizes, not exact retained logs | CONFIRMÉ content/media size | CONFIRMÉ byte counts | POSSIBLE app activity metrics | POSSIBLE if logs/cloud data retained |
| Groupes | CONFIRMÉ server-maintained Cloud Groups/channels | CONFIRMÉ to members/admins | POSSIBLE by traffic only | NON ACCESSIBLE PAR DESIGN from store alone | POSSIBLE service data/legal process |
| Appareils | CONFIRMÉ sessions/devices/apps metadata | POSSIBLE presence and profile | POSSIBLE fingerprinting | CONFIRMÉ account/device association | POSSIBLE last login/session data |
| Push tokens | PROBABLE/CONFIRMÉ integration-specific backend delivery | NON ACCESSIBLE PAR DESIGN to ordinary contact | NON ACCESSIBLE PAR DESIGN | CONFIRMÉ APNs/FCM token if used | POSSIBLE with provider legal process |