The Indicator Guide to using Telegram in digital investigations

Jane Lytvynenko, an award-winning reporter who specializes in digital investigations, spent the past 3.5 years reporting in Ukraine, primarily for the Wall Street Journal’s visual investigations unit and foreign desk. Telegram is critical to her daily work.

Before they go outside, residents of Ukraine's southern city of Kherson check Telegram. They scan channels to see which neighbourhoods enemy quadcopter drones have been spotted in. Meanwhile, pro-Russian channels share videos of successful attacks and post celebratory messages.

Telegram has become a crucial platform for documenting global conflicts — but that’s just one aspect. Organizations such as the Centre for Information Resilience, an OSINT-focused non-profit, and Geoconfirmed, a volunteer-based mapping project, rely on Telegram for on-the-ground imagery. It’s a key platform for investigating war crimes, disinformation, illicit online activity, cryptocurrency, scams, or simply to find sources.

Unlike other social media platforms that have increasingly locked down data, Telegram remains a cornucopia for investigators. It doesn’t strip metadata out of documents, images, or voice memos. Its built-in functionality is conducive to network mapping and analysis. The lack of messaging restrictions means it’s easy to contact potential sources. The lack of moderation means that images and footage that would have been removed by other social media sites remain available. 

Telegram use is also growing. Created by the Durov brothers in Russia in 2013 as a personal messaging platform, Telegram now has more than a billion users. 

There is a tendency among some to look at Telegram as a kind of mirror dark web–a place where bad actors go to connect, conspire, and make money. It can be that. Yet for most users, it’s simply another social platform: a place where neighbourhoods and communities coalesce, a place to read news, somewhere to spend time. As such, investigators need to incorporate Telegram into their workflow, and to understand its broad scope and utility.