The Telegram Crackdown: Why India's 'New Dark Web' is Being Put on Notice

On 18 June 2026, India's Ministry of Electronics and Information Technology issued an order that removed one of the world's most popular messaging apps from every network in the country for four days. The stated cause was narrow: seventeen Telegram channels were selling, or claiming to sell, leaked question papers for the NEET-UG 2026 medical entrance re-examination scheduled for 21 June. But the legal brief the government filed in the Delhi High Court, which heard a challenge to the block the following morning, reached well beyond that specific incident. In its counter-affidavit, the Centre described Telegram as having "become the new dark web, linking threat actors across the country, making it hard for authorities to track and attribute criminals." That phrase appears not in a press release or ministerial speech but in a sworn court document, and it arrived at the end of two years of accelerating legal pressure on a platform whose design choices have made it core infrastructure for organized cybercrime.

The 72-hour block: what India actually did

The MeitY order invoked Section 69A of the Information Technology Act 2000, the provision that authorizes the government to restrict online content in the interest of the sovereignty and integrity of India, the defence of India, the security of the State, friendly relations with foreign States, or public order, or for preventing incitement to the commission of any cognizable offence relating to those grounds. The restriction ran from 18 through 22 June 2026. The National Testing Agency had written to MeitY twice, on 21 May 2026 and again on 15 June 2026, flagging seventeen channels by name, including "Re-NEET 2026," "NEET PAPER LEAKED," and "NEET Mafia," associated with roughly 1.46 lakh accounts and advertising claimed leaked papers at prices ranging from a few thousand to several lakh rupees. MeitY's order extended beyond blocking access: it also directed Telegram to disable message-editing on all existing posts across the platform until 30 June 2026, aimed at preventing channels from scrubbing incriminating content after the examination had passed.

Telegram challenged the block in the Delhi High Court the very next day, arguing that it "cannot change platform architecture for one jurisdiction." The court, on 19 June 2026, upheld the block, finding it "least restrictive and proportionate." What made the ruling significant was the evidentiary record before the court: as reported by The Print, the Centre told the High Court it had sent Telegram at least 35 compliance requests since October 2024. This block was not a first response; it was a documented endpoint.

"The new dark web": the government's words, and the court's

The phrase "new dark web" has circulated in Indian cybersecurity discourse for several years, but it acquired formal legal weight when the Centre included it in its counter-affidavit before the Delhi High Court in June 2026. The government's sworn submission stated that Telegram "has become the new dark web, linking threat actors across the country, making it hard for authorities to track and attribute criminals." An affidavit in adversarial constitutional litigation carries evidentiary weight that a press briefing does not. The government chose that forum deliberately.

The analogy has a technical basis. Traditional dark-web services require Tor or specialized software to access; Telegram requires only an app that more than a billion people already have on their phones (Durov said the platform passed one billion monthly users in March 2025). The functional characteristics, however, overlap significantly: operators communicate pseudonymously, channel administrators are not publicly disclosed, encryption is available, and the combination of unlimited channel size and in-app payment capability means criminal networks can recruit, distribute content, transact, and move proceeds without leaving the application. The dark web was always defined by function rather than by URL scheme. On that measure, the affidavit's comparison is technically defensible, not rhetorical overreach.

Why Telegram became the pipe

The scale of Telegram's use for cybercrime in India is documented in figures submitted by I4C, the Indian Cyber Crime Coordination Centre, directly to the Delhi High Court in June 2026. These are formal evidentiary submissions in live constitutional litigation, not an annual report or a research estimate.

Four design decisions explain why Telegram became the preferred channel. First, mega-channels with unlimited subscribers and one-way broadcast architecture: criminal networks can reach millions of people simultaneously while keeping operator identities concealed, a structural advantage that is impossible on WhatsApp, which caps groups at 1,024 members. Second, frictionless anonymity: registration requires only a phone number, bots can be created without identity verification, and channel administrators are not publicly disclosed. Third, crypto-native payments: an in-app wallet (Wallet in Telegram, a third-party service integrated as a Telegram mini-app) supports USDT on the TON blockchain, letting proceeds move without leaving the app ecosystem, a feature no major Western messaging platform offers at comparable integration depth. Fourth, historically minimal proactive moderation: until the policy shift described in a later section, Telegram moderated almost exclusively for terrorism-related child sexual abuse material and very little else.

The combination matters for specific fraud categories. Exam-leak operations rely on mass anonymous distribution to paying strangers. Investment fraud promoters, who construct elaborate fake trading environments to deceive victims, use Telegram both to recruit targets and to coordinate operations across criminal teams. For a detailed breakdown of how the investment-fraud model works, see pig-butchering investment scams. Mule-account recruitment, the first link in most money-laundering chains, also runs heavily on Telegram job-advertisement channels. Each use case exploits a different element of the same architecture.

The Durov turning point

For most of Telegram's history, the company operated as though sovereign law applied to it optionally. It moved from Russia to Berlin to Dubai, structured itself without a clear legal presence in any major jurisdiction, and cooperated with law enforcement at a rate that security researchers found negligible. That posture ended abruptly on 24 August 2024, when Pavel Durov was arrested at Paris-Le Bourget airport. On 28 August 2024, JUNALCO (the National Jurisdiction against Organized Crime) and Paris prosecutor Laure Beccuau formally indicted Durov on six charges: complicity in administering a platform enabling illegal transactions by an organized group; complicity in the distribution of child sexual abuse material; complicity in drug trafficking; complicity in organized fraud; money laundering; and refusing to provide information to authorities for lawful interception. Bail was set at €5 million. Durov's travel ban was fully lifted on 13 November 2025; the criminal investigation in Paris remains open with no trial date set as of June 2026.

What the arrest produced within weeks was a policy reversal. On 23–24 September 2024, Telegram rewrote its privacy policy: where it had previously disclosed user data only in response to confirmed terrorist content, it would now provide IP addresses and phone numbers to any authority presenting a valid judicial order in cases violating Telegram's terms of service. Disclosures would be logged in quarterly transparency reports. Durov announced the change himself. The causal sequence requires no interpretation.

The global dragnet

India is the largest single theater by complaint volume, but legal pressure on Telegram spans the major democracies and the EU. The table below maps confirmed government actions on their own terms, separated so the differences in motive and legal basis are visible alongside the pattern.

The Russia entry appears in this table for completeness, not equivalence. Roskomnadzor's 2026 throttling is partly motivated by competition from a Kremlin-preferred app and by Telegram's refusal to store servers on Russian soil. Russia also blocked Telegram entirely from April 2018 to June 2020 before lifting the ban after admitting the technical failure. Authoritarian suppression of a platform and rule-of-law accountability for that same platform are different instruments pointing in the same direction, and conflating them weakens the case for the latter.

The data-sharing surge

The most concrete measure of the September 2024 policy change comes from Telegram's own transparency data, compiled from the platform's @transparency bot by security researcher Etienne Maynier and reported by TechCrunch in January 2025. The numbers show a step-change whose timing maps directly onto Durov's arrest and the policy revision.

India's position at the top of the global compliance chart reflects the volume and seriousness of its law-enforcement requests. It also underlines a structural irony: the platform that processed negligible disclosures for years now counts its largest single-country cooperation engagement with the government that was simultaneously seeking a court order to enforce a block. The transparency surge is evidence of what changed after Paris. It is not evidence of a proactively safe platform; it is evidence of a platform that began cooperating when the alternative was criminal prosecution of its founder.

The counter-argument

Accountability is the right frame for the Telegram crackdown, but proportionality is a legitimate test of how that accountability is exercised. The Internet Freedom Foundation's analysis of the Delhi High Court ruling acknowledged that the exam-leak justification was factually grounded, while raising the structural concern that Section 69A allows blocking orders with limited procedural transparency for the affected platform or its users. IFF's concern is not that this specific block was wrong but that the same legal architecture has been used, and can again be used, for orders affecting political journalism, dissent, or whistleblowing. That concern is well-documented and serious. Telegram's own argument to the court, that it cannot re-architect the platform for one jurisdiction, also deserves a fair reading. Jurisdiction-specific moderation requirements at the infrastructure level are technically difficult, and mandated architectural changes in one country create precedent for demands from governments with far weaker rule-of-law records. These are not bad-faith arguments; they are the reasons organizations like the Electronic Frontier Foundation consistently resist mandatory platform re-engineering rather than behavioral regulation.

These concerns do not, however, dissolve the underlying record: 2.76 lakh cybercrime complaints in a single year, documented exam-leak infrastructure operating for weeks after NTA's first warning letter, and a platform that produced barely meaningful law-enforcement disclosures until its CEO was detained at a French airport. The argument for proportionality is a test of the mechanism used to impose accountability, not a reason to withhold it. A temporary block, time-limited to a four-day window, challenged by the affected platform, and upheld by a constitutional court after full adversarial argument, is materially different from an indefinite shutdown issued by administrative decree. The Delhi HC applied the proportionality test. It passed.

How to spot exam-leak and investment-fraud channels

1. Check the channel's age relative to its subscriber count. A channel created days before an examination with tens of thousands of subscribers is a clear warning sign. Legitimate coaching and preparation communities grow over months. Telegram displays channel creation dates in the channel info screen.
2. Treat any "leaked paper" offer as a criminal operation, not a shortcut. Purchasing or distributing a paper claimed to be leaked is an offence under the Public Examinations (Prevention of Unfair Means) Act 2024 in India. The paper being sold is frequently fabricated to extract payment before the seller disappears.
3. Verify investment channels against official registrar lists before engaging. In India, check the SEBI-registered investment adviser list at sebi.gov.in. In the US, use the SEC's Investment Adviser Public Disclosure database. Any channel promising guaranteed or high-fixed returns is unregistered by definition under the securities laws of every major jurisdiction.
4. Never send a "release fee" or "verification deposit" to unlock a withdrawal. The defining final move of Telegram-based investment fraud is a demand framed as a tax, fee, or compliance deposit, placed just before a promised payout. Sending it is the last transaction; the channel goes dark immediately after.
5. Report the channel. Inside Telegram: long-press a message and tap Report. In India: file at cybercrime.gov.in or call 1930. For a full step-by-step process, see how to report cybercrime in India and recover your money.

Frequently asked questions

Was this a permanent ban on Telegram in India? No. The MeitY order under Section 69A ran from 18 to 22 June 2026, a four-day window bracketing the NEET-UG re-examination on 21 June. The Delhi High Court upheld it specifically as a time-limited and proportionate measure, not as a template for indefinite restriction.

What are the six charges against Pavel Durov? JUNALCO, the Paris organized-crime prosecutor's office, charged Durov with complicity in: administering a platform enabling illegal transactions by an organized group; distributing child sexual abuse material; drug trafficking; organized fraud; money laundering; and refusing to provide information for lawful interception. The travel ban was lifted in November 2025; the investigation is ongoing with no trial date.

Did Telegram's September 2024 policy change actually produce results? Yes, measurably. Global user disclosures to law enforcement rose from 5,826 users in Q1 2024 to 22,777 in Q1 2025, a near-quadrupling. India alone logged 9,197 fulfilled requests disclosing 9,941 users' data in Q1 2025, topping the global chart. The numbers come from Telegram's own @transparency bot, compiled independently by security researcher Etienne Maynier.

Is Russia's Telegram block comparable to India's? No. Russia's 2026 throttling is partly motivated by promoting a state-affiliated messaging app and by Telegram's refusal to host servers in Russia. Russia also attempted a full block in 2018–2020 and lifted it after the technical failure became embarrassing. The Indian block was challenged in and upheld by an independent constitutional court after full adversarial argument. These are structurally different acts with different legal bases and different accountability mechanisms.

Should I stop using Telegram? The platform's end-to-end encrypted "secret chats" remain technically sound for private one-to-one communication. The documented harms are concentrated in public channels and large groups, which use Telegram's server-client encryption (Telegram holds the keys) and operate under different privacy conditions than secret chats. The practical advice: do not engage with channels offering deals that cannot be verified through official sources, and do not send money to any account you have not independently confirmed through a channel outside Telegram itself.

Sources

• Bar and Bench, "Telegram the new dark web, hub of criminals, terrorists": Centre justifies temporary ban before Delhi HC
• Internet Freedom Foundation, The Delhi High Court upholds the temporary ban on Telegram
• The Print, Telegram ban upheld: govt told HC it sent 35 compliance requests, CEO's post corroborated misuse
• JUNALCO / Paris prosecutor's office, official press release on the Durov indictment (28 Aug 2024)
• France24, France lifts travel ban on Telegram founder Durov (Nov 2025)
• Engadget, Telegram will now provide IP addresses and phone numbers in response to legal requests (Sept 2024)
• TechCrunch, Telegram reports spike in sharing user data with law enforcement (Jan 2025)
• Te-k / Etienne Maynier, telegram-transparency (GitHub, primary data for disclosure statistics)
• Euronews, Belgian watchdog BIPT checking Telegram for EU anti-terror compliance (Jun 2025)
• Euronews, Spain's high court orders block on Telegram, halted within days (Mar 2024)
• Meduza, Russia blocks Telegram two weeks ahead of its own schedule (Mar 2026)
• MeitY, Information Technology Act 2000 (Section 69A text)