Case Summary and Outcome

The Tagansk Court granted the request of the Russian state-controlled communications regulator (Roskomnadzor) to  block  access  to  Telegram, a popular online messaging service, in Russia because the  company  had  not disclosed keys for decrypting messages sent over its network. The Federal Security Services (FSS) contacted Telegram’s London office in April 2017, explaining that it needed to access Telegram messages sent from six mobile numbers and requesting that the company provide it with the keys for decrypting these messages. Telegram refused to comply with the request on the basis that doing so would, among other things, violate the right to privacy of its users. The Russian courts upheld the lawfulness of the FSS’s initial request, and the Roskomnadzor gave the company an additional fifteen days to comply with the request. After Telegram refused to disclose the keys, the Roskomnadzor applied for a court order to block access to Telegram in Russia. The Tagansk Court granted such an order, reasoning that since Telegram operated in Russia it was under an obligation to comply with the laws of the country and that it was under an obligation to provide the Russian federal authorities with the means to decrypt messages sent over its network.

Facts

Telegram is a popular online messaging service. Although it is based in the UK, some six million Russian residents use the service. On April 14, 2017, the Federal Security Services (FSS) of Russia sent a letter to Telegram’s offices in London asking the company to provide it with keys to decrypt messages sent from six mobile numbers over its service. Telegram did not respond to the request. Following the failure to respond, the FSS initiated a lawsuit to penalize Telegram for violating Article 10.1 of the Federal Law “On Information, Information Technologies, and Protection of Information” (Information Law), which purportedly rendered companies liable for failing to provide federal bodies with information necessary to decrypt digital messages sent over their services.

On October 16, 2017, the Moscow Meshansk Regional Court found that Telegram violated the Information Law and imposed a fine of RUB 800,000 (around $13,000). Telegram appealed the decision on the following grounds:

• Telegram had a professional duty to protect the privacy of Russian citizens, particularly when taking into account Article 8 (right to respect for private life) of the European Convention on Human Rights and Article 23 (right to privacy) of the Russian Constitution;
• The FSS failed to demonstrate that its request was made pursuant to a judicial order and, therefore, could not prove its lawfulness;
• The request was disproportionate because it required decryption keys that would give the FSS access to the messages of more than 6 million Russian Telegram users, and would not be confined to the messages of the six mobile numbers specified in the request;
• The FSS had failed to demonstrate how it would safeguard against the decryption keys being misused;
• The FSS contacted Telegram directly, instead of seeking the aid of British law enforcement agencies and in violation of the European Convention on Mutual Assistance in Criminal Matters;
• The Regional Court had no jurisdiction over Telegram since the company was based in the UK; and
• Telegram had no technical capacity to decrypt messages sent over its network because messages were encrypted end-to-end.

Telegram lost the appeal and subsequently brought their case before the Supreme Court of Russia. The company argued, among other things, that the FSS’s request was unlawful because it was based on FSS Order No. 432, which the FSS had no legal authority to make. However, the Supreme Court disagreed. It held that Presidential Order No. 1301 on Prevention of Terrorism and Public Security, issued on July 6, 2016, provided the FSS with the legal authority to regulate the means to decrypt online communications. Furthermore, the Supreme Court found that decryption keys and other information used for decrypting messages were not constitutionally protected as private information and, therefore, requests for their disclosure did not interfere with the right to privacy.

After Telegram lost the Supreme Court appeal, the Roskomnadzor, the state-controlled media regulator, offered Telegram 15 additional days to share the decryption keys. Telegram refused to disclose the keys and, on April 6, 2018, Roskomnadzor filed a request with the Tagansk Court in Moscow to immediately block Telegram in Russia. The request was made under article 15.4(2) of the Information Law, which allows the authorities to block access to online information disseminators pursuant to a court order.

Decision Overview

On April 13, 2018, the Tagansk Court (Court) granted the FSS request to block Telegram in Russia. First, the Court reviewed the relevant facts. On April 14, 2017, the FSS contacted Telegram and requested that it share decryption keys to facilitate access to messages from six mobile numbers. Telegram failed to comply with that request. The FSS subsequently initiated a lawsuit against Telegram.  The Moscow Meshansk Court found Telegram guilty and fined it RUB 800,000. On March 20, 2018, the FSS once again contacted Telegram for the decryption keys and gave the company 15 days to comply. Telegram responded on April 3, 2018, and explained that it was technically impossible for it to provide the FSS with the decryption keys.

The Court then turned to the applicable law. It first established that Presidential Order No. 960, issued on August 11, 2003, authorized the FSS to ensure the security of the Russian Federation. The Court reasoned that the FSS contacted Telegram and requested decryption keys pursuant to this authority. Furthermore, the Russian Government Decree No. 745 “On the Rules of Cooperation between the Federal Security Services and Companies that Disseminate Information over the Internet in order to Supervise Communication, Information Technologies and Mass Communication” set out the rules and regulations pertaining to how the FSS may request decryption information and the obligation of Internet companies to respond to such requests in order to ensure compliance with article 10.1 of the Information Law.

The Court concluded that the FSS complied with the protocol established under the above laws and regulations, unlike Telegram. Furthermore, the Court dismissed Telegram’s claim that it should not have been held administratively liable because it was not technically possible for it to provide the FSS with the means to decrypt messages that were encrypted end-to-end. According to the Court, by operating in Russia, Telegram should have been familiar with the country’s laws and understood that it had an obligation to provide the Russian federal authorities with the means to decrypt messages sent over its network. Additionally, Telegram failed to provide detailed proof that it had no technical capacity to decrypt messages sent over its network.

In light of the above, the Tagansk Court approved the Roskomandzor’s request to block Telegram in Russia. The Court left it to Roskomnadzor to decide the means by which it could ensure that Telegram was blocked in Russia.

Telegram appealed the decision.