Minutes after Slovakia’s Russia-friendly Prime Minister Robert Fico was shot, social media was awash with conspiracy theories.
The attacker’s wife was a refugee from Ukraine. He was linked to a high-profile government critic. And Fico’s security guard was plotting against the premier.
All those rumours were later rebutted by Slovak authorities. But not before they’d gone viral on Telegram.
The messaging app has become a key weapon for pro-Kremlin accounts to spread disinformation aimed at undermining support for Ukraine. More recently, Russian intelligence officers have used it to recruit petty criminals to carry out acts of sabotage across European capitals.
These incidents trade off Telegram’s key advantage: it’s largely unaccountable. That’s what most antagonises European officials who’ve made the fight against fake news a top priority ahead of continent-wide elections in June. For all their new powers to regulate information online, they are largely powerless to rein in Telegram.
“Disinformation is spreading openly and completely unchecked on Telegram,” Estonian Prime Minister Kaja Kallas told Bloomberg.
Requests to remove disturbing content frequently go unanswered, she said: “We know that other member states have similar problems.”
A typical pro-Russian propaganda campaign relies on a barrage of online techniques. These include social media posts, stories on state media outlets, fabricated news stories designed to mimic the look of legitimate websites, and anonymous comments on real ones.
Telegram functions as a central node in that ecosystem, a kind of bridge that propaganda groups use to blast their content into active social communities, with the goal of amplifying their narratives to a wider audience.
“Telegram is popular among various pro-Russian actors as well as individuals who have been spreading disinformation for a long time because there is almost no content moderation,” said Daniel Milo, the former director of the Center for Countering Hybrid Threats at the Slovak Interior Ministry. “The rules of Telegram in this regard are very, very lax.”
The EU recently sharpened its powers to deal with illegal and harmful content, in an attempt to thwart malicious actors from spreading misinformation ahead of European elections.
But when it comes to Telegram, these measures aren’t very effective – the tools with real bite apply only to platforms with over 45 million active users in Europe. Telegram, its owners say, has 41 million.
According to Kallas, these numbers don’t tell the whole story and “the European Commission should conduct an independent evaluation”, she said. The commission didn’t respond to a request for comment.
All the same, Telegram’s numbers put it below the threshold required to trigger a set of stringent obligations under the EU’s flagship Digital Services Act, which came into full effect in February.
For large platforms, the EU can levy fines of as much as 6% of annual sales if it finds violations – or ban repeat offenders from the EU. Those rules cover Meta Platforms Inc’s Facebook, Alphabet Inc’s YouTube and ByteDance Ltd’s TikTok, among others.
Smaller platforms fall under the national agencies where the firms have legal representation. That’s Belgium, in Telegram’s case. Yet national authorities have limited powers to take action over content on the service, a spokesman for the Belgian Institute of Post and Telecommunications said in an emailed answer to questions.
“Calls for violence or damage of property are explicitly forbidden on Telegram,” a spokesperson for the company said in response to questions. They added that moderators monitor public parts of the platform in order to remove content that breaches its terms of service.
Were Telegram to be designated a ‘very large online platform’ under the DSA it would be obliged to take measures against the spread of disinformation and put in place tougher content moderation protocols, Kallas said. “It would also ensure a level playing field within the internal market, as other platforms have taken significant efforts to comply with the Digital Services Act,” the Estonian prime minister added.
The main themes of Russia’s disinformation efforts include its war against Ukraine, the conflict in the Middle East, immigration, climate change and the upcoming European parliament elections, according to an internal EU assessment seen by Bloomberg.
On those five topics, the number of items from unverified sources across all platforms had more than doubled by the beginning of May, compared with fewer than 20,000 pieces a day at the start of the year, the assessment shows. The Kremlin has repeatedly denied involvement in disinformation and sabotage operations.
The Kremlin has not always been so amenable to Telegram. A Russian court in 2018 ordered the app to be blocked for refusing to turn over its encryption keys to the security services, although efforts to prevent its use failed. In 2020, Russia’s communications watchdog dropped its efforts to block it. Telegram has also been used by protesters, including in Hong Kong and Iran, to organise and evade surveillance.
Pavel Durov, its founder, owner and CEO, left Russia in 2014 after losing control of his previous company for refusing to hand over the data of Ukrainian protesters to security agencies. Based in Dubai, the company passed 700 million monthly active users last year.
Doppleganger sites
Nevertheless, when the French foreign-disinformation watchdog Viginum announced in February that it had detected preparations for a massive disinformation campaign involving a network of nearly 200 websites across several European countries it found that content from Telegram was central to that campaign.
After the attempted assassination in Slovakia, a Telegram channel with nearly 50,000 subscribers shared a long post from a website that falsely claimed to be the Daily Telegraph, a prominent British publication.
The text asserted without evidence that pro-Ukrainian forces were responsible for the shooting of Prime Minister Fico. That came during a time when authorities in Slovakia were asserting the motive for the incident remained under investigation.
The suspect, identified as 71-year-old Juraj C., later told investigators that he had acted alone and that he was motivated by his opposition to a range of Fico’s policies, including the decision to halt military support for Ukraine, according to a court document seen by Bloomberg. Fico, who remains hospitalised, was shot four times at close range.
Masquerading as local news outlets has been the work of a disinformation outfit that researchers have named “Doppelganger”, which is notorious for using Telegram to push fake content which purports to be from mainstream media.
The same operation, which is the focus of an EU investigation into Meta, has used more than 2,000 inauthentic social media accounts, according to the cybersecurity firm Recorded Future Inc. Those personas have sought to undermine faith in Ukraine’s military effort by posing as news organisations, or targeting German audiences to weaken confidence in their lawmakers. The group has also spread videos that falsely claim to be from Al Jazeera and EuroNews.
To infiltrate social media discourse, Doppelganger uses tactics that are more advanced than simply blasting false information through social media channels.
The group uses cheap domain name services that are often hosted on Russian services, according to the security firm Sekoia, a tactic that makes it difficult for Western agencies to take the sites offline. From there Doppelganger spreads the links containing false information to Telegram, where the goal is to create user engagement in multiple channels and ultimately go viral elsewhere on social media, with smaller countries especially vulnerable.
“Nearly a third of the content on Slovak Telegram accounts originates from or is directly taken from various Russian sources,” Milo said, citing a Slovak government study. “Telegram plays a key role in spreading Russian narratives.” – Bloomberg