Lawyer's Perspective: Reflections on the Arrest of Telegram Founder Pavel Durov

Original Title: “Thoughts on the Durov arrest”

Author: Preston Byrne, Partner at Byrne & Storm Law Firm

Translation: 0xjs, Golden Finance

On August 24, Pavel Durov, the founder of the popular messaging app Telegram, was arrested upon landing in France on his private jet.

Early indications suggest that the arrest stems from Telegram's alleged failure to comply with French requirements regarding content moderation and data disclosure:

Some Legal Background

Most globally influential social media companies outside of China are headquartered in the United States. This is not a coincidence.

In the late 1990s, the U.S. wisely took policy measures to minimize the liability of internet service providers, most notably through the enactment of Section 230 of the Communications Decency Act. This statute essentially states that operators of social media websites are not liable for the tortious or criminal actions of their users. Of course, there are some very narrow exceptions to this rule; for example, illegal pornographic content must be subject to mandatory removal and reporting (see: 18 US Code § 2258A), and the passage of FOSTA-SESTA prohibits operators from providing services related to sex trafficking or prostitution (see: United States v. Lacey et al., 47 US Code § 230(e)(5)).

Beyond that, social media operators are generally not held liable for the tortious or criminal actions of users. If they are merely hosting content passively, they will not be held liable under the aider/abettor theory. (See: Twitter v. Taamneh, 598 US _ (2023) -- at least on this side of the Atlantic in the U.S., civil liability for aiding and abetting requires "knowledge and substantial assistance," while federal criminal liability -- because Section 230 does not apply to state criminal law -- requires specific intent to assist in the crime).

This means that if I use Facebook to organize a drug deal, Facebook (a) has no obligation to scan its services for illegal uses, and (b) has no obligation to restrict that use, and generally will not face civil penalties for my abuse unless Facebook "substantially facilitates" that illegal use, meaning it explicitly encourages that illegal use (e.g., see Force v. Facebook, 934 F.3d 53 (2d Cir. 2019), where Facebook was found not liable under JASTA for civil liability related to the use of Facebook to spread propaganda by Hamas; see also Taamneh, above), and (a) under state law Section 230, and (b) under federal law, as long as Facebook does not knowingly and intentionally assist, abet, encourage, or induce the commission of a crime, under 18 USC § 2, it will not face criminal liability.

Most countries do not have such a lenient system. France is one of them. For example, the "Anti-Hate Speech Law" (Loi Lutte Contra la Haine sur Internet) enacted in 2020 stipulates that global internet companies that fail to limit "hate speech" on their sites (which is considered "protected speech" in the U.S.) can be fined $1.4 million for each instance, with fines reaching up to 4% of their global revenue. Similarly, Germany has its own law, the Network Enforcement Act (sometimes referred to as the "Facebook Law," but commonly known as NetzDG), which mandates the removal of inciting political content, or the government can impose fines exceeding €50 million.

I am not a French lawyer, so it is difficult to ascertain which specific legislative provisions are being invoked here. The indictment or arrest warrant will tell us more once it is made public. I am quite sure that the U.S. will not file a fine lawsuit against Telegram Messenger, Inc. under hate speech laws (such as the EU DSA), because if it were the case, Durov would not have been handcuffed and dragged off the plane. French media outlet TFI Info reporting the news indicated that the charges could be for aiding and abetting, or conspiracy:

The Justice Department believes that the lack of moderation, cooperation with law enforcement, and the tools provided by Telegram (disposable numbers, cryptocurrencies, etc.) make it an accomplice to drug trafficking… and fraud.

More information will be disclosed after the arrest warrant is made public. For example, if it is found that Durov actively helped criminal users access the platform, such as a drug user writing to a support channel saying, "I want to sell drugs on your platform. What should I do?" and Durov responds that he will help, then he would face the same fate in both the U.S. and France.

However, if the French are merely saying that Durov's failure to moderate his users or respond promptly to French document requests constitutes a crime (I suspect this is indeed the case), then this represents a sharp escalation in the war on internet censorship. This means that European countries will attempt to dictate what content foreign companies can host on foreign servers.

If correct, this would starkly contrast with the compliance practices currently adopted by most U.S.-headquartered social companies, which typically dominate the global compliance strategies of most non-Chinese social media companies, including those that fully encrypt their services (such as Telegram, WhatsApp, and Signal). In short, these platforms believe that if they do not intend to use their platforms for criminal purposes, they are unlikely to face criminal charges. Clearly, that is no longer the case.

Telegram is not the only company in the world that has used social media platforms for illegal purposes. It is well known that Facebook's popular encrypted messaging app WhatsApp has been used for years by the Taliban, a former non-state terrorist organization and now the ruling power in Afghanistan. This fact was widely known and reported in the media during the Afghan War, and even reported again last year in The New York Times:

About a month later, security officials, unable to reach their commander during a nighttime operation, reluctantly purchased a new SIM card, set up a new WhatsApp account, and began recovering lost phone numbers and rejoining WhatsApp groups.

In Qayad's police station, a modified container with a handheld radio, he took out his phone and began browsing his new account. He pointed out all the groups he had joined: one for all the police in the jurisdiction, another for former fighters loyal to a single commander, and a third for communicating with headquarters superiors. He said he had joined about 80 WhatsApp groups in total, more than a dozen of which were for official government purposes.

Of course, the Taliban now controls the entire government of Afghanistan -- at all levels -- and Afghanistan is an enemy of the U.S., whose motherland is the U.S. If Facebook really wanted to stop such individuals from using their services, the most effective way would not be to play whack-a-mole with individual government employees, but to ban the entire IP range of Afghanistan and all Afghan phone numbers, and disable domestic app downloads, which Facebook has not done. Facebook has chosen inaction rather than action.

However, Facebook CEO Mark Zuckerberg comfortably resides in a mansion in Hawaii rather than in exile abroad, and presumably no country has issued an arrest warrant for him, whereas Durov clearly has. I concede that Facebook may (even likely, given that Telegram's operating team consists of only 15 engineers and about 100 employees globally) respond to French judicial requests faster than Telegram. However, when you run a globally accessible encrypted platform, it is inevitable -- I repeat, it is inevitable, absolutely certain -- that criminal activities will occur beyond your sight or control.

If Telegram is accused of violating French law for failure to manage (as media reports suggest), then applications like Signal (which clearly cannot respond to law enforcement requests for content data and has similar functionalities to Telegram) would also be guilty, and no U.S. social company providing end-to-end encryption (or its senior executives) is safe. Do we really think that if Meredith Whitaker (President of Signal) decided to go to France, she should be imprisoned?

Image licensed under Pixabay

There are still many questions. Currently, the outlook for the future of interactive web services in Europe is not optimistic. American tech entrepreneurs operating services in accordance with American values (especially through strong encryption to protect freedom of speech and privacy) should not access Europe, should not hire employees in Europe, and should not host infrastructure in Europe until this situation is resolved.

France's Aiding and Abetting Charges

Updated August 26, 2024

Basically, my intuition was correct:

There is a long list of charges. Most of these relate to conspiracy charges in France, which roughly correspond to aiding/abetting liability in the U.S.

What is important here is that in the U.S., aiding/abetting liability requires specific intent to result in a criminal outcome -- that is, the criminal act is the defendant's purpose. The failure of U.S. social media companies to moderate their users does not reach this level, which is why CEOs of U.S. social media companies generally are not arrested by the U.S. government for their users' criminal actions. Specifically, CSAM charges would only rise to the level of a crime in the U.S. if Durov failed to comply with the U.S. notice-and-reporting regime for such content. The mere existence of criminal content without any notice does not trigger criminal liability.

The French government accuses Durov of participating (i.e., aiding and abetting) in criminal activities and of providing "encrypted" software without permission, which must be approved by the government before use in France. The criminal activities he is accused of aiding include offenses roughly analogous to the Anti-Fraud and Corruption Organizations Act, criminal conspiracy, money laundering, drug offenses, hacking, and providing unlicensed encryption technology.

The lack of substantial evidence indicating that Durov and Telegram had a clear intent to commit these crimes or cause these crimes to occur (which is extremely unusual for social media CEOs, especially since these crimes are illegal worldwide, including in the U.S., which has historically been very adept at extraditing criminals) means there is no reason not to bring similar charges against any other social media service provider in France, as long as their moderation practices are inadequate, especially for social media services providing end-to-end encryption.

We need to wait for evidence to emerge before drawing any definitive conclusions on this point. However, my guess is that Durov is not "aiding and abetting" in the way the U.S. understands it; France has decided to use different principles to attempt to regulate a foreign company because it believes these companies' moderation policies are too lax.

To summarize:

Currently, if you operate a social media company, or you provide encrypted messaging services that can be accessed in France, and your headquarters are in the U.S., then you should leave Europe.