As Pavel Durov, the founder of Telegram, landed in France, and walked down the stairs of his private jet into the hands of French police, I’m not sure he recognised how this moment would shift the future of secure messaging apps. What Mr Durov’s arrest makes clear is that the era of centralised messaging apps being able to provide security, privacy and freedom to their users is over. In many ways, Mr Durov’s arrest signposts the beginning of a gradual shift towards decentralised and ownerless messaging protocols.
Concern over the ability of centralised messaging apps to protect users from misinformation and malicious activity has been rising in recent years, with national authorities across the western world threatening to take action. But where previously scrutiny on messaging apps was largely being driven by regulators and national governments, a growing portion of app users are now beginning to shift to alternative platforms where privacy and security are being prioritised.
In early November, the owner of X and CEO of Tesla, Elon Musk, appeared on the Joe Rogan Experience podcast. Among other topics under discussion was the potential for the Signal messaging platform to be compromised through government interference. This threat, they warned, could leave millions of Americans at risk of having their private information and messages exposed to national authorities. Where once encryption was regarded as a safeguard against this danger, governments may now seek to override such protections.
In the case of Mr Durov, for instance, the French authorities pursued charges against him on the basis of failure to comply with a request for user data and enabling criminal activity on the platform. Although he is contesting the charges, some fear he may be forced to hand over Telegram’s encryption keys, giving the authorities access to private user information and messages.
The privacy issues associated with popular messaging apps stems in large part from the use of centralised servers. By holding user data in one place, centralised architectures can be a honeypot for governments and would-be hackers, and increase risks to users by becoming single points of failure. Even in the case of Signal, which employs end-to-end encryption and advanced metadata protections, the platform uses central servers to relay and store user metadata. In theory, this means confidential user information such as IP addresses and phone numbers can all be accessed by third parties.
To minimise the risk of privacy breaches and to protect user data, we urgently need to adopt protocols and networks in support of decentralisation. This means protocols where no single entity can hold overarching control over the network infrastructure or user data, eliminating the threats posed by having a singular owner, developers or companies having special access to user messages or metadata. Early iterations of the internet provided a clear structure for the decentralisation of routing and storage, however at the time content encryption was in its
infancy and incentive systems were underdeveloped. We now have the tools available to deploy end-to-end encryption on scale and to solve decentralised incentive models, ushering in a new wave of decentralised protocols. We must now prioritise these approaches when developing applications which store sensitive user data, for the good of users and in the interest of upholding the fundamental right to privacy, security and digital freedom.
The teams working on Session are committed to building this future, by leveraging the power of decentralisation. In contrast to other messaging platforms, when you use Session, your messages are routed and stored by a network of over 2,200 community operated nodes. In doing so Session dispenses single points of failure and moves the responsibility of data storage and routing to a geographically diverse set of nodes bound by a protocol which ensures data privacy and security. This protocol explicitly removes the need to collect confidential metadata such as phone numbers and IP addresses, so Session users can engage with confidence that their privacy and security will be fully protected at all times.
I want to bring this full circle to where we started: the arrest of Pavel Durov in France. From a personal perspective, witnessing this unfold was both shocking and deeply unsettling. I didn’t think we had yet reached a stage in the devolution of privacy where Western democracies would arrest and imprison developers of open-source software. Clearly, I was wrong. We are at that point. Now, more than ever, we need tools like Session—tools designed to ensure that neither developers nor operators of messaging apps have privileged access to users’ messages or data. I’m happy to be working towards that vision and it’s something which motivates me everyday.
