Telegram preferred platform for terrorist acts: Government defends block in court
In an affidavit accessed by India Today TV, the Centre alleged that Telegram is being used for cybercrime, leaked exam papers, child sexual abuse material, terrorism-linked propaganda and financial fraud.
The government has levelled a series of serious allegations against messaging platform Telegram, telling the Delhi High Court that the app has become the "new dark web" and is increasingly being used by criminals, cyber fraudsters, extremist groups and other threat actors to evade law enforcement.
The observations were made in an affidavit filed before the Delhi High Court after Telegram challenged the government's temporary ban on the platform. Defending its position before the court, the Centre detailed what it described as the widespread misuse of Telegram for cybercrime, financial fraud, extremist propaganda and other illegal activities.
The government alleged that Telegram has evolved into a key platform for a wide range of illegal activities, including the circulation of leaked examination papers such as NEET, cyber fraud, terrorism-linked propaganda, child sexual exploitation material, drug trafficking and financial crimes.
"Telegram has become the new dark web, linking threat actors. Criminals have rapidly adopted Telegram to post links on channels that connect to dark web forums through deep web links, making it hard for authorities to track and attribute criminals," the Centre said.
The affidavit states that Telegram's privacy and anonymity features have made it particularly attractive to criminal networks.
According to the Centre, users can conceal identifiers such as phone numbers and Telegram IDs through privacy settings, making it difficult for investigators to establish the real identities behind accounts.
"It has been observed that Telegram is being exploited for illegal activities including drug trafficking, cybercrime, extremism, terrorism, child exploitation, and cyber scams and frauds, primarily due to privacy features," the affidavit said.
The Centre also argued that Telegram's architecture itself creates significant challenges for law-enforcement agencies.
Appearing for the government, Solicitor General Tushar Mehta told the Delhi High Court that inputs from the Indian Cyber Crime Coordination Centre (I4C), a unit under the Ministry of Home Affairs, repeatedly pointed to structural features that make it difficult to curb misuse on the platform.
Mehta said Telegram allows a single account holder to create up to 40 bots, unlike platforms such as WhatsApp where bot creation is far more restricted.
"They say we are doing it manually. MHA has a unit called I4C, they give periodical reports. All lead to a conclusion that their architecture is such that they are unable to do what is required in such circumstances," Mehta told the court.
According to the Centre, the ability to create multiple bots enables rapid proliferation of accounts, allowing fresh bots to emerge even after existing ones are blocked or removed.
"The scale at which it can multiply is only available on Telegram," Mehta said, adding that action against individual bots often provides only temporary relief because similar accounts can quickly reappear under different names and identifiers.
The government further argued that Telegram's cloud-based architecture and privacy settings make it difficult for law-enforcement agencies to identify offenders and trace criminal activity.
Mehta also pointed to Telegram's privacy policy, which provides that deleting an account results in the deletion of all associated messages, media and stored data.
The Centre linked these concerns to national security as well.
Referring to findings cited before the court, Mehta said reports available with the government had identified Telegram as the "most preferred platform" for terrorist activities. He also argued that authorities in several other jurisdictions were facing similar challenges because of the platform's design.
The government also alleged that Telegram groups and channels are being used to spread violent extremist content and material linked to terrorist organisations.
"Extremist violent acts performed by terror organisations and other radical content is being propagated by Telegram groups and channels by entities associated with terrorist organisations to create misinformation or destabilise public order," the affidavit stated.
Among the most serious allegations is the circulation of Child Sexual Exploitative and Abuse Material (CSEAM) through Telegram channels and groups. The Centre said such content remains a major concern for enforcement agencies monitoring online platforms.
The affidavit further alleged that Telegram has become a hub for cybercriminal activity, with fraudsters creating fake accounts using false identities to carry out financial scams, publish data breaches and coordinate cyber offences.
Citing data from the National Cyber Crime Reporting Portal, the Centre said there has been a significant rise in complaints involving the misuse of Telegram as a medium for cyber fraud.
The government also flagged the alleged use of Telegram channels for the sale and purchase of mule bank accounts, which are often used to receive and transfer proceeds of cybercrime and money laundering operations.
According to the affidavit, cyber threat actors, hacker groups and other adversaries use Telegram channels and groups to coordinate attacks, distribute stolen data and share malicious tools.
The Centre claimed that some malicious Android applications use Telegram as a command-and-control platform for exfiltrating victims' data and device information. It also cited examples of Telegram channels allegedly advertising malware services, Google Play Protect bypass tools and malware disguised as financial applications.
In one instance cited by the government, a Telegram channel allegedly promoted tools designed to make malicious APK files appear undetectable to security systems. In another, a channel was allegedly advertising malware impersonating financial and payment-related services.
The affidavit also raised concerns about Telegram bots allegedly facilitating access to citizens' personal data, including mobile numbers, Aadhaar details and other sensitive information sourced from previously leaked databases.
Apart from cybercrime concerns, the Centre alleged that Telegram channels are widely used to distribute pirated movies, web series and other copyrighted content, causing losses to content creators and raising intellectual property concerns.
The affidavit was filed before the Delhi High Court and contains the Centre's assessment of the risks associated with Telegram, along with allegations regarding the platform's alleged misuse by criminal, extremist and cybercrime networks.
The government has levelled a series of serious allegations against messaging platform Telegram, telling the Delhi High Court that the app has become the "new dark web" and is increasingly being used by criminals, cyber fraudsters, extremist groups and other threat actors to evade law enforcement.
The observations were made in an affidavit filed before the Delhi High Court after Telegram challenged the government's temporary ban on the platform. Defending its position before the court, the Centre detailed what it described as the widespread misuse of Telegram for cybercrime, financial fraud, extremist propaganda and other illegal activities.
The government alleged that Telegram has evolved into a key platform for a wide range of illegal activities, including the circulation of leaked examination papers such as NEET, cyber fraud, terrorism-linked propaganda, child sexual exploitation material, drug trafficking and financial crimes.
"Telegram has become the new dark web, linking threat actors. Criminals have rapidly adopted Telegram to post links on channels that connect to dark web forums through deep web links, making it hard for authorities to track and attribute criminals," the Centre said.
The affidavit states that Telegram's privacy and anonymity features have made it particularly attractive to criminal networks.
According to the Centre, users can conceal identifiers such as phone numbers and Telegram IDs through privacy settings, making it difficult for investigators to establish the real identities behind accounts.
"It has been observed that Telegram is being exploited for illegal activities including drug trafficking, cybercrime, extremism, terrorism, child exploitation, and cyber scams and frauds, primarily due to privacy features," the affidavit said.
The Centre also argued that Telegram's architecture itself creates significant challenges for law-enforcement agencies.
Appearing for the government, Solicitor General Tushar Mehta told the Delhi High Court that inputs from the Indian Cyber Crime Coordination Centre (I4C), a unit under the Ministry of Home Affairs, repeatedly pointed to structural features that make it difficult to curb misuse on the platform.
Mehta said Telegram allows a single account holder to create up to 40 bots, unlike platforms such as WhatsApp where bot creation is far more restricted.
"They say we are doing it manually. MHA has a unit called I4C, they give periodical reports. All lead to a conclusion that their architecture is such that they are unable to do what is required in such circumstances," Mehta told the court.
According to the Centre, the ability to create multiple bots enables rapid proliferation of accounts, allowing fresh bots to emerge even after existing ones are blocked or removed.
"The scale at which it can multiply is only available on Telegram," Mehta said, adding that action against individual bots often provides only temporary relief because similar accounts can quickly reappear under different names and identifiers.
The government further argued that Telegram's cloud-based architecture and privacy settings make it difficult for law-enforcement agencies to identify offenders and trace criminal activity.
Mehta also pointed to Telegram's privacy policy, which provides that deleting an account results in the deletion of all associated messages, media and stored data.
The Centre linked these concerns to national security as well.
Referring to findings cited before the court, Mehta said reports available with the government had identified Telegram as the "most preferred platform" for terrorist activities. He also argued that authorities in several other jurisdictions were facing similar challenges because of the platform's design.
The government also alleged that Telegram groups and channels are being used to spread violent extremist content and material linked to terrorist organisations.
"Extremist violent acts performed by terror organisations and other radical content is being propagated by Telegram groups and channels by entities associated with terrorist organisations to create misinformation or destabilise public order," the affidavit stated.
Among the most serious allegations is the circulation of Child Sexual Exploitative and Abuse Material (CSEAM) through Telegram channels and groups. The Centre said such content remains a major concern for enforcement agencies monitoring online platforms.
The affidavit further alleged that Telegram has become a hub for cybercriminal activity, with fraudsters creating fake accounts using false identities to carry out financial scams, publish data breaches and coordinate cyber offences.
Citing data from the National Cyber Crime Reporting Portal, the Centre said there has been a significant rise in complaints involving the misuse of Telegram as a medium for cyber fraud.
The government also flagged the alleged use of Telegram channels for the sale and purchase of mule bank accounts, which are often used to receive and transfer proceeds of cybercrime and money laundering operations.
According to the affidavit, cyber threat actors, hacker groups and other adversaries use Telegram channels and groups to coordinate attacks, distribute stolen data and share malicious tools.
The Centre claimed that some malicious Android applications use Telegram as a command-and-control platform for exfiltrating victims' data and device information. It also cited examples of Telegram channels allegedly advertising malware services, Google Play Protect bypass tools and malware disguised as financial applications.
In one instance cited by the government, a Telegram channel allegedly promoted tools designed to make malicious APK files appear undetectable to security systems. In another, a channel was allegedly advertising malware impersonating financial and payment-related services.
The affidavit also raised concerns about Telegram bots allegedly facilitating access to citizens' personal data, including mobile numbers, Aadhaar details and other sensitive information sourced from previously leaked databases.
Apart from cybercrime concerns, the Centre alleged that Telegram channels are widely used to distribute pirated movies, web series and other copyrighted content, causing losses to content creators and raising intellectual property concerns.
The affidavit was filed before the Delhi High Court and contains the Centre's assessment of the risks associated with Telegram, along with allegations regarding the platform's alleged misuse by criminal, extremist and cybercrime networks.
