The arrest of Pavel Durov and the scope of the Digital Services Act

Pavel Durov, the founder and chief executive of Telegram, landed at Le Bourget on the evening of Saturday 24 August 2024 and was placed in police custody at 8 p.m.[1]. He has held French citizenship since 2021[2]. On Monday 26 August the Paris prosecutor published the list of offences under investigation. On Wednesday 28 August the investigating judges placed him under formal investigation, ordered a bail of EUR 5 million, required him to report to a police station twice a week and barred him from leaving France[3]. A week of commentary has followed. We think the first task is to read the prosecutor's document.

What France alleges

The communiqué of 26 August states that a judicial inquiry was opened on 8 July 2024 against an unnamed person, at the request of the cybercrime section of the Paris prosecutor's office (J3, JUNALCO), with the gendarmerie's cybercrime centre (C3N) and the national anti-fraud office (ONAF) as co-investigators[1]. It lists twelve offences. The first is complicity in running an online platform to enable an illegal transaction by an organised group. The second is refusal to provide information or documents needed for lawful interceptions. The third and fourth concern possession and distribution of child abuse images, the fifth narcotics, the sixth the supply of hacking tools, the seventh organised fraud, the eighth criminal association, the ninth laundering. The last three are cryptology offences: providing a confidentiality cryptology service without a certified declaration, providing a cryptology tool without prior declaration and importing one without prior declaration[1]. Because the offences fall under the organised crime procedure, custody could last 96 hours, until 28 August[1].

Three features of that list matter. First, every substantive count is framed as complicity. The prosecution alleges that the platform enabled others to commit offences and that its owner did not act. Second, the refusal count and the cryptology counts are the only ones that concern Telegram's own conduct as a company. The prosecutor said on 28 August that the authorities had noted a "near total absence of a response" from Telegram to judicial requests and that an investigation had been opened in February 2024[3]. Third, the lead count carries up to ten years' imprisonment and a fine of EUR 500,000[4]. A formal investigation does not mean that a trial will follow.

Telegram answered on 25 August that Durov "has nothing to hide", that it is absurd to hold a platform or its owner responsible for abuse of that platform and that it abides by European law, including the Digital Services Act[5]. President Macron wrote on X on 26 August that the arrest was in no way a political decision and that it was for the judges to rule[3].

What the Digital Services Act does and does not cover

Telegram's defence invokes the Digital Services Act. The Commission's spokesperson said on 26 August that the arrest had nothing to do with Telegram's obligations under that Regulation, because the Regulation does not define illegal content and does not create criminal offences. He said that "criminal prosecution is not among the potential sanctions for a breach of the DSA"[6]. That statement is correct in law. The Regulation organises how intermediaries handle illegal content that other laws define. Article 8 provides that no general obligation to monitor transmitted or stored information, nor actively to seek facts indicating illegal activity, may be imposed on providers[7]. The Regulation therefore does not require Telegram to read its users' messages.

The heaviest obligations apply only to very large online platforms, which Article 33 defines as those with at least 45 million average monthly active recipients in the Union, designated by Commission decision[8]. Telegram declared about 41 million users in the Union in February 2024 and so escaped designation[6]. In May 2024 it appointed a legal representative in Belgium, which makes the Belgian regulator BIPT its supervisor. BIPT says it was not involved in the French investigation, and it is not yet formally empowered by its parliament, which led the Commission to open an infringement procedure against Belgium in July[6]. The Financial Times reported on 29 August that the Commission's Joint Research Centre is checking Telegram's figures, after Telegram declined to give a number and said only that it had "significantly fewer than 45 million" users[9].

The gap between the two legal orders is now visible. The European Regulation governs process, applies through a regulator that is not yet in office and stops at a threshold that Telegram says it sits under. French criminal law governs conduct, applies through investigating judges and reaches the person at the top of the company. French law has required a declaration for the import and supply of encryption tools for two decades, and no Union text harmonises that requirement. A platform that says it complies with the Digital Services Act has answered a question that the prosecutor did not ask.

Our generation grew up on Telegram, WhatsApp and Signal. We want encrypted communication to remain lawful and we want platforms that receive judicial requests about child abuse to answer them. The two wishes are compatible. Telegram's ordinary chats are not encrypted end to end by default, which is why the refusal count can exist at all. The question the French judges will decide is whether a company that holds data and declines to hand it over on judicial request is an accomplice. That is a narrower and older question than the one about free speech.

What we recommend

First, the Commission should publish its own calculation of Telegram's Union user numbers and, if the threshold is met, designate the platform under Article 33 without waiting for Telegram's cooperation, as paragraph 4 of that Article allows. Second, Belgium should adopt the law empowering BIPT before the end of 2024, so that the supervisor of Telegram's compliance exists in law. Third, the Union should state in a Commission communication which national criminal offences remain untouched by the Regulation, so that no platform can again present procedural compliance as a complete defence. Fourth, Member States that still require declarations for encryption tools should say whether they intend to enforce those rules against every messaging service or only against the ones they dislike.