Schneier on Security

Clive Robinson • January 5, 2026 11:03 AM

@ K.S.,

With regards,

“Could you explain what makes you say this?”

A number of things some of which I listed up some in my comment.

But as the article I linked to points out sufficient of Telegram is in Russia and like China and the USA anything crossing their networks in plaintext or encrypted gets recorded.

But consider the four list points I give, they indicate beyond reasonable suspicion that Telegram have chosen to make users traffic “insecure by design and default”.

So traffic in china gets “clocked” by the “Great Firewall” then due to the way the US is the spider at the center of the web, the user traffic gets clocked by them on it’s way to the Russian firewalls and networks where it gets clocked again…

The it gets stored for a while on servers in Russia, where they have laws about foreign traffic which I’m assuming Telegram abide by.

I’m curious though why are you onky asking about Russia not China and the US as well?

Look on it this way in all three of these UN Security Council Members the laws and Government behaviours are pretty much one and the same when it comes to,

1, Traffic crossing networks in their jurisdiction.
2, Traffic stored on servers in their jurisdiction.

Similar is also true of a number of European Nations in the West of Europe, especially France, Netherlands (once part of France), Belgium (once part of the Netherlands), and the UK. It would appear more recently Switzerland as well. As for Germany perhaps it’s best not to ask what the US CIA did and still does there.

These are the ones we know about, which is why even encrypted traffic should be treated with both caution and care.

As I’ve said a while in the past I do not use “secure messaging apps” because they are on the same device as the communications end point which implicitly makes them insecure no matter what encryption is used.

A point that should not be lost on anyone now we are moving from the age of “failed Golden Keys” back doors into “client side scanning” and AI that copies the UI to the cloud every few seconds.

As I’ve noted in the past when signal first got talked about with awe,

“The security end point needs to be on a separate device beyond the communications end point.”

Apple showed via their dismal attempt at client side scanning that the E2EE / backdoor / NOBUS Golden Key days, were over and Client Side Scanning was the new war zone.

Kind of making my point for me and confirming things were going that way.

Further long before Microsoft Cop-out became known I’d said that AI was the “most insidious surveillance tool so far” and that Microsoft’s AI Business Plan was,

“Bedazzle, Beguile, Bewitch, Befriend and Betray” To turn all users into their product by stealing the users and their acquaintances privacy.

Something that increasing numbers of people appear to agree with.