Telegram Launches New Feature Allowing Compromised Users To Nuke Account

Earlier this month, the Iranian government arrested a former BBC journalist, and allegedly took over his account on the popular messaging app Telegram in an attempt to hack his friends and contacts.

Last Friday, roughly eight days after Iranian activists abroad warned of those attempts, Telegram finally disabled the account of the journalist Bahman Daroshafaei, marking the first time the company has taken such an extreme step to protect one of its users, according to its spokesperson Markus Ra. In response to this situation, Telegram is also working on a new feature to protect users in the event they get arrested and need to destroy their accounts.

This incident shows how governments can take advantage of the ever-increasing use of messaging apps, and how these apps now need to be prepared for worst-case scenarios such as police forces impersonating their users.

Ra said in an email that Telegram reached out to "contacts" at BBC Persian as soon as they heard of Daroshafaei's situation in order to "fact check" and verify that he had really been arrested. Then, on Friday Feb. 13, Telegram's BBC contacts sent an "official notice" to Telegram, confirming that Daroshafaei's had been arrested, and that two BBC Persian journalists received messages from someone pretending to be him using the messaging app, according to Ra. (Telegram's BBC contacts did not respond to a request for comment.)

For some, however, Telegram's response came too late.

"Disabling the account now is not helping anyone," Nima Fatemi, an Iranian independent security researcher, told Motherboard. "They gave [Iran's Government's] enough time to do whatever the fuck they wanted."

Amir Rashidi, a researcher at the advocacy group The International Campaign for Human Rights in Iran who reached out to Telegram asking them to disable Daroshafaei's account, added that all of Daroshafaei's friends and contacts blocked him on Telegram shortly after receiving messages that they suspected were coming from his Iranian captors.

Sources confirmed to Fatemi as well as another Iranian activist that Telegram has indeed disabled Daroshafaei's account.

In any case, "the point is that not all Iranians who get arrested have such contacts," Rashidi told me, so Telegram should be prepared to act when others, such as Iranian activists abroad, report suspicious activities or impersonating attempts.

To give users a tool to protect themselves in case of arrest, Ra revealed to Motherboard that Telegram is going to release a new feature, which will allow users to set up an optional "self-destruct" passcode that will delete and disable the account. The code, according to Ra, needs to be input locally, but can be done on the same screen as the regular, and also optional, unlocking passcode.

Ra didn't say exactly when the new feature will be pushed out, but said it'd be included in an upcoming update.

For activists, this is good idea but it might not be enough in cases such as Daroshafaei's. It'd be better to give a trusted contact the option to nuke the account in case his or her friend gets arrested, Rashidi said.

Fatemi is worried about what happens after the user inserts the self-destruct code. "Would it be obvious that they've used that feature?" he told me. "If so, that would get the person in some serious problem […] They can easily label that person as 'spy' for attempting to wipe the info and assume the worst."

Telegram has quickly become one of the most popular apps in Iran, a country where major messaging and social media services, such as Twitter and Viber, are blocked by the government. According to estimates, as many as 20 million Iranians use Telegram, and the app is expected to play an important role in the upcoming elections. Activists, however, are wary of Telegram's rise, noting that initially the Iranian government threatened to block it, but then backed down, raising suspicions that Telegram accepted the government's surveillance and censorship requests. The app is now prominently featured on the front pages of major Iranian news sites, which are using it to spread their articles.

But Pavel Durov, the Russian expat who founded Telegram, has repeatedly said that they have no special agreement with the Iranian government. Ra, Telegram's spokesperson, also told Motherboard that longstanding concerns over Telegram's security are overblown.

Either way, it's clear that Telegram's rising popularity has forced the company to face increased pressure from both governments aspiring to control the internet, and internet freedom activists trying to protect dissidents and journalists on those countries.