Unsealed court records expose Telegram’s U.S. law enforcement pipeline, including the “non-public” email address at the center of it

For most of its existence, Telegram’s pitch was that governments get nothing. The founders treated their refusal to cooperate with law enforcement as a badge of honor, and journalists, activists, dissidents and criminals all chose the app for that reputation. A letter now sitting in a public federal docket in Louisiana shows how far that has slipped. It contains three lines of user data, a polite sign-off from “The Telegram Team,” and a legal disclaimer that lets the company help American authorities while insisting they have no power over it.

The letter is Exhibit B to an October 15, 2026 filing in United States v. Mahmoud Amin Ya’qub Al-Muhtadi, a terrorism prosecution in the U.S. District Court for the Western District of Louisiana (Case No. 6:25-cr-00285-DCJ-CBW, Document 155-2, PageID #2131). It was first surfaced and reported by 404 Media in collaboration with Court Watch. Below I go through what Telegram disclosed, what that says about its architecture, why the lawyering matters as much as the data, and why the exposure of Telegram’s confidential law enforcement address may be the most dangerous detail in the filing.

The document

The exhibit is a one-page letter on Telegram Messenger Inc. letterhead. It carries the company’s BVI registration number (1968129) and its registered address at Commerce House, Wickhams Cay 1, Road Town, Tortola, British Virgin Islands. It is dated September 4, 2026, addressed to “Dear Sir or Madam,” and the operative content fits in one paragraph:

“For this particular case, the following information was available:
User #7149269705 : +201155664529 [Mahmoud Almohtadi]
IP 184.186.72.239, 8 Oct 2025 2:08:12
We hope this information will be helpful in your investigation.
Kind regards, The Telegram Team”

That is the whole information – a numeric user ID, a phone number in international format, and one IPv4 address tied to a timestamp. There is no message content, no contact list and no session history, which fits Telegram’s long-standing position that it does not produce content. Still, subscriber identity, network address and time are the basic triangle of digital attribution. Together they turn an anonymous handle into a person, a place and a moment.

The rest of the page matters just as much. A legal statement identifies [email protected] as “Telegram’s non-public contact point for requests made by law enforcement or judicial authorities in the United States” and confirms the request arrived by email at that address. Telegram says it is “voluntarily providing this reply and / or the enclosed information” and lists four things it is not doing: “(i) not representing that this is a full and complete response,” “(ii) not conceding that we are subject to U.S. jurisdiction for this or any other request or any purpose,” “(iii) not conceding that we were properly served with this request,” and “(iv) not committing to provide any additional information in response to this request or any other request.” Now that it is docketed, the page works as a compliance product, a jurisdictional shield and an operational security liability all at once.

What three data points reveal

Start with the user ID. Telegram assigns numeric identifiers sequentially at registration, so the size of an ID gives a rough idea of when an account was created, and researchers often use it that way. The ID is also immutable and appears in API objects, so it survives username changes, phone number changes and profile edits. The guidance Telegram gives U.S. authorities makes this explicit, telling officers that “Telegram IDs are unique identifiers that can never be hidden and can always be obtained by law enforcement officers.” In practice the ID is the join key that ties a suspect’s handle in a seized chat export, a channel admin list or an open-source investigation to one account record on Telegram’s side.

The phone number, +201155664529, says more than it first seems to. Telegram requires an SMS- or call-verified number to create an account, so the registered number is the platform’s root identity anchor. The +20 country code is Egypt’s, and the 115 prefix sits in an Egyptian mobile range. That fits the defendant’s documented background as a Gaza-born Palestinian, for whom an Egyptian SIM is a practical necessity. For investigators, a phone number can be served on carriers for subscriber records and cell-site location data, matched against other platforms’ account databases, and correlated with financial and travel records. One number, properly served, can unravel years of movement.

Then there is the IP address, 184.186.72.239, stamped 8 Oct 2025 2:08:12. The format matches Telegram’s server-side connection logs and is almost certainly UTC. Public routing data attributes the 184.186.0.0/15 block to Cox Communications (AS22773), a large U.S. residential broadband provider. Residential cable assignments like this are typically household-level and are not shared carrier-grade NAT pools, which matters a great deal for evidentiary weight. A household-attributable IP logged at a precise second is far stronger than an address behind a mobile gateway with hundreds of concurrent users. Combined with the phone records and the intercepted call transcripts prosecutors filed in September 2026, one login event becomes corroboration, placing an account and presumptively its owner on a specific network in Lafayette, Louisiana at a specific instant.

None of this requires Telegram to decrypt a message. It is all metadata, which courts have repeatedly treated as less protected than content even though it often proves more.

Cooperation without concession

The most legally careful sentence in the exhibit is in the disclaimer, not the data. Telegram says it is providing the information voluntarily, in keeping with “our desire to cooperate with competent authorities when consistent with laws applicable to us.” It expressly concedes nothing on U.S. jurisdiction, proper service, completeness or any duty to respond again. In related filings, Telegram’s counsel has put it more bluntly: “As a BVI company, our client is not subject to the jurisdiction of the statutes/legislation pursuant to which the Letter has purported to have been served.” Counsel urged U.S. authorities to use the Mutual Legal Assistance Treaty (MLAT) channel with the British Virgin Islands instead.

This is a deliberate two-track strategy, and it helps to know the statute Telegram says doesn’t bind it. The Stored Communications Act, as amended by the CLOUD Act of 2018, reaches providers of electronic communication and remote computing services subject to U.S. jurisdiction and requires them to produce records in their possession, custody or control, wherever the data physically sits. Telegram’s position is that a BVI-incorporated company with no U.S. corporate presence falls outside that reach, so a § 2703 order served by email is a nullity. That is why every production is labeled “voluntary.” The label lets Telegram avoid setting a precedent that U.S. courts can compel it directly, keeps its independence narrative intact for users and non-U.S. regulators, and preserves the option to refuse a future request on jurisdictional grounds it never waived.

For U.S. law enforcement the arrangement is practical. An MLAT request to the BVI takes months, while an email to [email protected] returns data in days or weeks. Neither side gains anything by litigating the fiction, so it survives. The user whose data sits in the middle gets no jurisdictional fight fought on their behalf, and no notice that one was skipped.

[email protected] is now public

The detail security professionals will find most alarming is the mailbox itself. Providers keep intake addresses non-public so they can authenticate requests out of band, keep emergency-disclosure volume manageable, and deny attackers a known target. The FBI has described how such a target gets used. A November 4, 2024 IC3 industry alert said cybercriminals were compromising U.S. and foreign government email accounts and using them to send fraudulent emergency data requests to technology companies, and in multiple incidents they got user data. The same tradecraft has shown up for years in impersonation campaigns against social platforms, sometimes through hacked .gov mailboxes, sometimes through forged subpoenas on spoofed domains. In 2021 an actor abused a misconfiguration in the FBI’s own Law Enforcement Enterprise Portal to send fake communications.

Now one of the most valuable mailboxes in the data-request economy is indexed in a public PACER docket, quoted in press coverage and archived on social media. The abuse paths are easy to list: fraudulent § 2703(d)-style orders or invented “exigent circumstance” requests sent to Telegram by someone posing as a U.S. agent, lookalike domains that impersonate Telegram’s law enforcement desk to phish real investigators, and spoofed “Telegram legal response” emails sent to defendants or journalists to make leaked data look authentic. Telegram’s compliance team probably won’t fall for a forgery, since providers verify signatures, callback numbers and requestor identity. But each public exposure of the intake channel raises the number of attempts, and some fraction of attempts always succeeds somewhere. The guidance Telegram gives police makes it worse, because it works as a manual – put phone numbers in international format, include usernames or Telegram IDs, and send everything to the referral address.

This address is live. According to an FBI affidavit in a separate matter, the Bureau served Telegram with a subpoena at this address and got responsive records back in February 2026, and the Al-Muhtadi letter confirms the September 2026 request arrived there by email. It is production infrastructure for state access to user data, and anyone on Earth can now write to it.

The case behind the letter

Mahmoud Amin Ya’qub Al-Muhtadi, 33, is a Gaza-born resident of Lafayette, Louisiana. He was arrested in October 2025 and charged with conspiracy to provide material support to a foreign terrorist organization and with visa fraud. The allegations are that he took part in the October 7, 2023 Hamas-led attacks on Israel, including an assault on a kibbutz near Gaza. The case rests on cell-phone location data placing him at the scene, intercepted phone calls whose transcripts prosecutors filed in September 2026, and Telegram subscriber information, which is the material in Exhibit B. Al-Muhtadi has pleaded not guilty.

The procedural posture says something. Prosecutors moved to admit Telegram’s records under Rule 807, the residual hearsay exception, which usually covers statements that miss the standard business-records rule but carry “equivalent circumstantial guarantees of trustworthiness.” Telegram’s certification language says the disclosed information is a true duplicate of original records, made at or near the time of the events by people with knowledge and kept in the ordinary course of business. It is drafted to track Rules 803(6) and 902(13). Choosing the residual exception suggests the defense is contesting authentication, which makes sense when the custodian is a foreign company producing records by email under a disclaimer that denies the court’s jurisdiction. I expect the exhibit’s hedging language to be read aloud at trial. A cross-examination about a record with no witness, from a provider that says it was never properly served, nearly writes itself.

Whatever the evidentiary outcome, the case shows the modern playbook from start to finish. Physical evidence like cell-site data and intercepted calls gets fused with platform metadata (subscriber ID, phone number, login IP) to turn online anonymity into a physical defendant. Telegram’s contribution was tiny in bytes and large in probative value.

The Stored Communications Act: why metadata takes only a court order

Many readers assume the government needs a warrant for “your data.” The Stored Communications Act of 1986, 18 U.S.C. §§ 2701 to 2713, sets up a three-tier ladder, and Telegram’s disclosure sits on the middle rung.

Under the Stored Communications Act, the type of information law enforcement can obtain depends on the legal process used. A subpoena under 18 U.S.C. § 2703(c)(2) can be used to obtain basic subscriber information, such as a person’s name, address, phone number, subscriber ID, and length of service, without judicial approval for many types of subpoenas. A court order under § 2703(d) requires specific and articulable facts establishing reasonable grounds to believe that the requested records are relevant and material to an ongoing investigation. This process can provide access to non-content records, including session logs, IP connection records, login timestamps, and account activity metadata. To obtain the content of stored communications, such as message bodies, media files, and saved drafts, law enforcement generally needs a search warrant supported by probable cause under § 2703(a) or § 2703(b)(1)(A), issued in accordance with Federal Rule of Criminal Procedure 41.

The middle tier does most of the work in internet investigations. A § 2703(d) order needs no probable cause and no full warrant affidavit. A judge only has to be satisfied by specific and articulable facts, a threshold courts describe as meaningfully lower than probable cause, and it unlocks exactly what Telegram produced – connection history, addresses and timestamps. Content stays behind a warrant, which is why the letter contains no messages and why Telegram can say it has never handed over chat bodies. Producing content would require process the company could contest. Producing metadata is cheap, fast and, as the letter shows, routine.

NOTE: The Supreme Court’s 2018 Carpenter decision recognized a privacy interest in historical cell-site location information, but it hasn’t been extended to displace the § 2703(d) regime for ordinary service metadata. And the CLOUD Act amendment is what makes the jurisdictional argument interesting at all. Congress designed the statute to follow control of data, not the location of servers, so Telegram’s BVI incorporation is a corporate-structure defense and not a data-location defense. Its “voluntary” productions amount to CLOUD Act compliance without CLOUD Act accountability.

The Durov arrest and the September 2024 policy change

None of this cooperation predates August 24, 2024. That day French police arrested Telegram founder and CEO Pavel Durov at Le Bourget airport outside Paris and placed him under investigation on charges including complicity in administering an online platform that enabled illegal transactions, refusal to cooperate with authorities, and complicity in distributing child sexual abuse material. A company that had treated law enforcement requests as optional learned that its executives could be personally liable for what happens on the platform.

The policy response came within weeks. On September 23, 2024, Telegram rewrote Section 8.3 of its privacy policy. The old text promised disclosure only where “a court order confirms you’re a terror suspect.” The new text says that on “a valid order from the relevant judicial authorities that confirms you’re a suspect in a case involving criminal activities that violate the Telegram Terms of Service,” Telegram “will perform a legal analysis of the request and may disclose your IP address and phone number to the relevant authorities.” Replacing terrorism with any criminal activity that violates the Terms of Service widened the disclosure universe enormously. Fraud, drug sales, cybercrime, sanctions evasion and ordinary ToS-adjacent offenses all fall inside it. Durov defended the change publicly, saying “the IP addresses and phone numbers of those who violate our rules can be disclosed to relevant authorities in response to valid legal requests.” The data suggests it was less a clarification than a switch being thrown.

Telegram’s transparency figures show the change. Between January 1 and September 30, 2024, it fulfilled 14 U.S. requests affecting 108 users. For full-year 2024 it fulfilled 900 U.S. requests affecting 2,253 users, so most of that year’s compliance came in the quarter after the policy change. In Q1 2025 Telegram complied with more than 5,000 requests globally and disclosed data on 22,777 users, nearly four times the 5,826 affected in Q1 2024. India led with 9,197 requests touching 9,941 users, followed by Germany (1,311 requests, 3,777 users) and France (668, 1,425). The United States accounted for 576 requests covering 1,664 users. By mid-2025 the trend had settled at industrial scale. The company that once published transparency reports as proof of resistance now publishes them as proof of normalcy, and the Al-Muhtadi letter is what one row of that data looks like when it lands on a real person.

What Telegram can hand over that Signal can’t

The disclosure also settles a technical argument that has run for a decade. Telegram is not end-to-end encrypted the way its marketing implies. Default “cloud chats” use MTProto 2.0 client-server encryption, so messages are encrypted in transit and at rest but the keys live on Telegram’s infrastructure, which means the company can read the plaintext by design. Only manually started “Secret Chats” use true end-to-end encryption. They exist between two devices only, they don’t sync, and groups and channels, the core of Telegram’s social graph, have never supported E2EE. Signal encrypts everything by default and keeps almost nothing beyond account creation and last-connection dates. An order served on Signal returns an almost empty page, and the same order served on Telegram returns the identity triangle in Exhibit B.

Telegram’s defenders correctly note that the company has never produced message content and that its servers spread storage across jurisdictions. Both are true, and neither changes the outcome. The metadata Telegram does retain (registered phone number, immutable user ID, connection IPs with timestamps) is enough for attribution in most investigations, and prosecutors usually need attribution first. “We cannot read your messages” and “we cannot identify you” are different claims, and only the second ever mattered for anonymity.

The criminals stayed

The policy change was sold partly as a cleanup of Telegram’s underworld, where channels have long hosted stolen-data markets, initial-access brokers, malware command-and-control chatter and fraud operations. The 2025 moderation numbers are large. Telegram blocked more than 43 million channels and groups, about 2.7 times the 2024 figure. Daily takedowns rose from a baseline of 10,000 to 30,000 to between 80,000 and 140,000, and peak days such as mid-November 2025 exceeded 500,000 removals in 24 hours.

The underworld still didn’t move. Threat intelligence assessments published three months after the policy change found no measurable drop in daily threat-actor activity on Telegram and no successful migration to alternatives. Later research reached the same conclusion in more depth. Criminal ecosystems depend on scale, because recruitment, reputation, distribution and monetization all need visibility, and no rival platform matches Telegram’s reach. So actors adapted in place. They gated channels behind join requests to starve automated moderation crawlers, put performative compliance disclaimers in channel bios, bundled pre-positioned backup channels into private communities so they could return within a week of a takedown, and split functions, keeping broadcast and recruitment on Telegram while moving negotiations and transactions to smaller venues. Security teams now treat the result as normal. Telegram is more cooperative with governments and more heavily moderated than ever, and it is still the best open-source intelligence feed on cybercrime because the criminals never left.

The threat model

For ordinary users, the right response is proper app selection. If you only want to keep chats away from ad networks and casual snooping, Telegram’s cloud chats are fine. If your threat model includes state adversaries, civil litigation, or criminals with subpoena-adjacent resources, know what stands between you and disclosure: a judge’s signature on a § 2703(d) order, an email to an address now printed in court records, and a compliance team that answers in days. Secret Chats protect content from Telegram but not metadata. Telegram still knows your phone number, your user ID and where your device last connected from, and none of that is end-to-end encrypted.

A few concrete steps to follow from this:

• Use Signal, or another messenger with default end-to-end encryption and minimal metadata retention, for anything whose exposure would be catastrophic.
• Treat Telegram channels and groups as public broadcast media, because technically they are.
• Assume any account created with your real phone number is permanently attributable to you. Porting or deleting the number doesn’t reliably cut the historical record.
• Be skeptical of VPNs on Telegram. A VPN changes the IP Telegram logs, but it moves your data onto a provider that may keep its own logs and face its own legal process.

Journalists and activists under authoritarian governments face one more asymmetry. Telegram’s cooperation is now global and request-driven, with India, Germany, France and Kazakhstan all posting substantial fulfilled-request counts in 2025. Its role as a censorship-circumvention lifeline now sits alongside its role as a responsive data partner to states of every kind.

For defenders, detection engineers and threat intelligence analysts, keep monitoring Telegram closely, since the criminal record of the platform is still being written there daily. Build detections that survive channel churn, such as entity graphs, admin-identity linkage and payment-trail correlation. Static channel URLs will be erased by takedown automation within the week.

Conclusion

Exhibit B is one page long. It shows the post-Durov arrangement in short. A foreign-incorporated platform that is legally defiant and operationally compliant, sending subscriber metadata to U.S. authorities through a mailbox it tried to keep secret, in a terrorism case where the metadata may matter more than the messages, under a statute written in 1986 for a different internet. Telegram’s privacy promises were never absolute, but before August 2024 they were at least expensive to break. Now they are broken routinely, reported quarterly in the company’s own transparency bot, and certified into evidence under the residual hearsay rule.

Telegram can no longer credibly claim that governments get nothing. What replaced that claim is more ordinary. A global messaging company that behaves like any other platform under legal pressure, and keeps its letterhead disclaimers and BVI incorporation as paperwork to say otherwise.

Frequently asked questions

Does Telegram share message content with law enforcement?
No verified instance of Telegram producing cloud-chat or Secret Chat content to any government has been made public. Its productions, including the one in Exhibit B, consist of subscriber metadata: phone number, user ID, and IP addresses with timestamps. Content would require a warrant, which Telegram could contest and historically has.

What legal standard lets U.S. authorities obtain this data?
A court order under 18 U.S.C. § 2703(d) of the Stored Communications Act. It requires “specific and articulable facts” that the records are relevant and material to an ongoing investigation, a lower bar than the probable cause needed for a warrant on content.

Why is [email protected] a security problem?
It was Telegram’s non-public intake channel for U.S. law enforcement requests. Public exposure invites fraudulent emergency data requests and impersonation attacks like the ones the FBI warned the industry about in November 2024, where criminals used compromised government mailboxes to trick platforms into disclosing user data.

Did Telegram’s cooperation increase after Pavel Durov’s arrest?
Yes, sharply. Fulfilled U.S. requests went from 14 (affecting 108 users) in the first nine months of 2024 to 900 (affecting 2,253 users) for the full year, after the September 2024 privacy policy change that followed Durov’s August 2024 arrest in France.

Is Telegram end-to-end encrypted?
Not by default. Standard cloud chats, groups and channels use client-server encryption with keys held by Telegram. Only manually enabled one-to-one Secret Chats are end-to-end encrypted, and they don’t sync across devices.

Can Telegram users hide their identity from legal requests?
Only partly. Usernames and profile details can change, but the registered phone number, the immutable numeric user ID and connection IP logs are kept server-side and fall within what Telegram discloses under valid orders. The guidance it gives police says Telegram IDs “can never be hidden.”