Pavel Durov, Telegram — Letter from the Select Subcommittee on the Coronavirus Crisis, December 1, 2021

Summary

In a December 1, 2021 letter to Pavel Durov of Telegram, the Select Subcommittee on the Coronavirus Crisis says it is investigating waste, fraud, and abuse in pandemic relief programs. The letter says it is troubled by reports that Telegram has served as a platform for facilitating fraud against programs including the Paycheck Protection Program (PPP), Economic Injury Disaster Loan (EIDL) program, unemployment insurance, and the Restaurant Revitalization Fund (RRF), and that instructions on Telegram may have enabled criminals to commit large-scale fraud. It requests documents and written responses by December 15, 2021, and asks for a response by December 8, 2021 to confirm cooperation. The signature block names Chairman James E. Clyburn.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Date: 2021-12-01

Cite this document

“Pavel Durov, Telegram — Letter from the Select Subcommittee on the Coronavirus Crisis, December 1, 2021.” Dated 2021-12-01. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2021-12-01-clyburn-to-durov-re-ppp-eidl-fraud-383f671fb760-05924309dd/, SHA-256 383f671fb760d8441fa8b93f8ed70537b9fbeb2e2c0ad04954e1f73b55d801d8.

Full text

December 1, 2021

Mr. Pavel Durov Mr. Pavel Durov
Telegram FZ-LLC c/o Alexander C. Drylewski
Business Central Towers Skadden, Arps, Slate, Meagher & Flom LLP
Tower A, Office 1003/1004 One Manhattan West
Dubai, United Arab Emirates New York, New York 10001-8602

Mr. Pavel Durov
Telegram Group Inc.
c/o Jordans Trust Company (BVI) Ltd
Geneva Place, Waterfront Drive
P.O. Box 3469
Road Town, Tortola, VG1110
Virgin Islands, British

Dear Mr. Durov:

The Select Subcommittee on the Coronavirus Crisis is investigating waste, fraud, and
abuse in pandemic relief programs. I am deeply troubled by reports indicating that Telegram has
served as a platform for facilitating fraud against vital pandemic relief programs, including the
Paycheck Protection Program (PPP), Economic Injury Disaster Loan (EIDL) program,
unemployment insurance, and the Restaurant Revitalization Fund (RRF), by allowing extensive
dissemination of instructions for evading program fraud controls. The availability of these
instructions on Telegram may have enabled criminals to commit large-scale fraud. I am writing
to request documents and information necessary for the Select Subcommittee to understand how
guidance for evading pandemic relief program fraud controls have been disseminated through
Telegram’s platform and whether the company has undertaken any serious efforts to prevent its
platform from being used to enable large-scale fraud against programs intended to aid Americans
harmed by the coronavirus pandemic.

Telegram’s platform has served as a hub for people to discuss ways to commit large-scale
criminal fraud against numerous federal and state relief programs.1 Individuals have used

1
How Unemployment Insurance Fraud Exploded During the Pandemic, ProPublica (July 26, 2021) (online
at www.propublica.org/article/how-unemployment-insurance-fraud-exploded-during-the-pandemic) (discussing the
use of Telegram to disseminate methods for submitting fraudulent unemployment insurance claims); An Avalanche
of Fraud Buried a Small Business Relief Program, Bloomberg (Oct. 29, 2020) (online at
www.bloomberg.com/news/features/2020-10-29/small-business-administration-10-000-grant-fraud-went-viral-
Mr. Pavel Durov
Page 2

Telegram channels to advertise the sale of detailed instructions—often referred to as “methods”
or “sauces”—for successfully submitting fraudulent relief claims to numerous relief programs.2
These channels—which can reach thousands of members at a time—have been used to
disseminate what some reports have called “step-by-step playbook[s]” that scammers follow to
commit fraud.3 The dissemination of such guides for evading relief program fraud controls is
consistent with reports that a substantial share of misallocated pandemic relief program funds has
been illicitly obtained by criminals committing fraud on a large scale, rather than individuals
submitting isolated applications for benefits they were not eligible for. The Department of
Justice has prosecuted numerous cases where individuals submitted dozens or hundreds of
fraudulent applications for loans or other relief worth millions of dollars, demonstrating that the
damage caused by distributing “playbooks” for evading fraud controls to committed criminals
can be substantial.4

Telegram channels have also included discussion of using stolen identities—referred to
as “fullz”—to aid in the commission of pandemic relief fraud, and some users have advertised
the sale of such stolen personal information.5 This is particularly concerning because people
whose stolen identities have been used to apply for pandemic aid, like unemployment insurance,
will subsequently face great difficulty in lawfully obtaining such aid for themselves.6 Data

hurting-program); Is Womply Getting Whomped with PPP Fraud?, FrankonFraud (May 2, 2021) (online at
https://frankonfraud.com/fraud-trends/is-womply-getting-whomped-with-ppp-fraud/); Fraudsters Targeting New
SBA Restaurant Fund, FrankonFraud (May 28, 2021) (online at https://frankonfraud.com/fraud-trends/fraudsters-
targeting-sbas-restaurant-fund/) .
2
How Unemployment Insurance Fraud Exploded During the Pandemic, ProPublica (July 26, 2021) (online
at www.propublica.org/article/how-unemployment-insurance-fraud-exploded-during-the-pandemic).
3
How Scammers Siphoned $36B in Fraudulent Unemployment Payments from US, USA Today (Jan. 26,
2021) (online at www.usatoday.com/in-depth/news/investigations/2020/12/30/unemployment-fraud-how-
international-scammers-took-36-b-us/3960263001/).
4
See, e.g., Complaint, United States v. Ayvazyan, Case No. 20-cr-579-SVW (C.D. Cal., filed Oct. 20, 2020)
ECF No. 1 (Alleging defendants conspired to submit more than 150 fraudulent PPP and EIDL applications worth
over $20 million using stolen identities); Complaint, United States v. Arnett, Case No. 21-mj-30522 (E.D. Mich.,
filed Nov. 5, 2021) (Alleging two defendants submitted over 500 fraudulent unemployment insurance claims worth
over $4 million in large-scale, multistate fraud scheme); Complaint, United States v. Carter, Case No. 21-mj-9734
(S.D.N.Y., filed Oct. 11, 2021) (Alleging four defendants submitted over 1,000 fraudulent EIDL applications
seeking at least $10 million); Information, United States v. Blotnick, Case No. 21-cr-796-BRM (D.N.J., filed Oct.
13, 2021) (Alleging defendant submitted at least 21 fraudulent PPP applications seeking over $6.8 million).
5
How Unemployment Insurance Fraud Exploded During the Pandemic, ProPublica (July 26, 2021) (online
at www.propublica.org/article/how-unemployment-insurance-fraud-exploded-during-the-pandemic); How Scammers
Siphoned $36B in Fraudulent Unemployment Payments from US, USA Today (Jan. 26, 2021) (online at
www.usatoday.com/in-depth/news/investigations/2020/12/30/unemployment-fraud-how-international-scammers-
took-36-b-us/3960263001/).
6
See, e.g., ‘Easy money’: How International Scam Artists Pulled off an Epic Theft of Covid Benefits, NBC
News (Aug. 15, 2021) (online at www.nbcnews.com/news/us-news/easy-money-how-international-scam-artists-
pulled-epic-theft-covid-n1276789); Identity Thieves Target New Yorkers’ Unemployment Benefits, New York Daily
News (Feb. 20, 2021) (online at www.nydailynews.com/new-york/ny-identity-theft-unemployment-20210220-
3jlamauylba7nkuyjmdf3akplu-story.html).
Mr. Pavel Durov
Page 3

suggests that hundreds of thousands of Americans have been harmed by the use of stolen
identities to apply for pandemic aid. The Federal Trade Commission reported that it received
nearly 400,000 complaints of identity theft related to government benefits in 2020—a 2,920
percent increase in such complaints from 2019.7

Although Telegram reportedly took down some channels devoted to pandemic relief
fraud following a prominent news report, channels with thousands of members that contain
numerous messages soliciting methods for committing fraud against pandemic relief programs
remain on the platform.8 The names of these channels and discussions within them are still
easily identified, located, and accessed. For example, one channel with thousands of members is
plainly named “BLACK MARKET,” and another channel notes the lack of software used to
prevent identity theft in a prominent relief program in its title.9 The discussions in these
channels also include numerous indications that they were intended to facilitate fraudulent
applications for pandemic relief.

The extensive use of Telegram to discuss and market ways to commit fraud against relief
programs—even after news reports have highlighted this fact—raises serious concerns about
whether Telegram has undertaken sufficient efforts to prevent its platform from being used to
facilitate fraud. Public reports suggest that the company has raised over $1 billion in financing
and is growing rapidly in significance, with over 500 million regular users and a possible
valuation of over $30 billion.10 Given the company’s substantial resources, Telegram has the
capacity to effectively monitor its platform’s use for committing and promoting illegal activities.
Telegram’s growing reach increases the importance that the company act responsibly to prevent
its platform from being used for illegal activity.

Telegram’s strikingly limited terms of service and recent track record raise further
concerns that the company does not intend to undertake serious efforts to prevent its platform
from being used for illegal activity. Telegram’s very brief terms of service only prohibit users
from “scam[ming]” other Telegram users, appearing to permit the use of the platform to conspire
to commit fraud against others.11 These terms only bar users from promoting violence on

7
Federal Trade Commission, Consumer Sentinel Network, Data Book 2020 (Feb. 2021) (online at
www.ftc.gov/system/files/documents/reports/consumer-sentinel-network-data-book-
2020/csn_annual_data_book_2020.pdf).
8
How Unemployment Insurance Fraud Exploded During the Pandemic, ProPublica (July 26, 2021) (online
at www.propublica.org/article/how-unemployment-insurance-fraud-exploded-during-the-pandemic).
9
Telegram, BLACK MARKET (accessed November 17, 2021); Telegram, CASHOUT ARENA #swipe
(accessed November 17, 2021); Telegram, BIG LIMIT SBA ID.ME (accessed November 17, 2021).
10
Update: Telegram Raises $1BN+, Including $150M from Mubadala and Abu Dhabi CP via Pre-IPO
Convertible Bonds, TechCrunch (Mar. 23, 2021) (online at techcrunch.com/2021/03/23/telegram-raises-150m-from-
mubadala-and-abu-dhabi-cp-via-pre-ipo-convertible-bonds/); Telegram, Approaching 500 Million Users, to Begin
Monetizing the App, TechCrunch (Dec. 23, 2020) (online at techcrunch.com/2020/12/23/telegram-to-launch-an-ad-
platform-as-it-approaches-500-million-users/).
11
Telegram, Terms of Service (online at https://telegram.org/tos) (accessed Nov. 15, 2021).
Mr. Pavel Durov
Page 4

“publicly viewable” channels, even though “private” channels are often far from private,
permitting up to 200,000 users. The company explicitly says it “do[es] not process any requests
related to [illegal content on “private” group chats].”12 Telegram’s lax content moderation has
reportedly led to its use by extremist groups advocating for political violence.13

To help the Select Subcommittee better understand the ways in which your platform was
used to facilitate such pandemic relief fraud, please produce the following documents and
information by December 15, 2021.

1. All assessments, reviews, reports, analyses, data, and/or memoranda concerning the
use of Telegram’s platform and messaging services to communicate about or conspire
to commit fraud, including fraud against U.S. pandemic relief programs.

2. All communications including Telegram employees and representatives regarding the
use of Telegram’s platform and messaging services to communicate about or conspire
to commit fraud against U.S. pandemic relief programs.

3. All reports or referrals Telegram has made to law enforcement regarding the use of
Telegram’s platform or messaging services to conspire to commit pandemic relief
fraud, solicit guidance for the commission of pandemic relief fraud, and/or sell stolen
personal information for the purpose of committing pandemic relief fraud.

4. All policies or protocols for making referrals to law enforcement or otherwise
contacting law enforcement regarding illegal activity or evidence of illegal activity on
Telegram’s platform and messaging services.

5. All Telegram channels removed or taken down due to their discussion of or
involvement in perpetuating fraud, including fraud against pandemic relief programs.

6. All directions, manuals, guides, fraudulent tax documents, and other documents sent
through Telegram in public or private channels or chats for the purpose of aiding or
facilitating pandemic relief fraud.

7. All “takedown requests” and/or chats or channels reported (by either the “‘report’
button” or by email to abuse@telegram.org or dmca@telegram.org) for illegal
content related to the commission of fraud or aiding or facilitating fraud, including
fraud against pandemic relief programs.

12
Telegram, FAQs (online at https://telegram.org/faq#q-there-39s-illegal-content-on-telegram-how-do-i-
take-it-down) (accessed Nov. 17, 2021).
13
Why Right-Wing Extremists Favorite New Platform Is So Dangerous, Vox (Jan. 20, 2021) (online at
www.vox.com/recode/22238755/telegram-messaging-social-media-extremists); Complaint, Smith v. Trump, Case
No. 21-cv-2265-APM (D.D.C., filed Aug. 26, 2021).
Mr. Pavel Durov
Page 5

8. All Telegram users, identified by username, IP address, and country of origin, who
have been blocked or removed from the platform for posting illegal content related to
fraud against pandemic relief programs.

Please also provide written responses to the following information requests by December
15, 2021.

1. How many staff members (on a full-time equivalent basis) does Telegram dedicate to
monitoring platform content and responding to illegal activity and/or content that
violates Telegram’s terms of service?

2. What is the process used by Telegram for evaluating content flagged as illegal?

3. How much has Telegram spent on monitoring platform content and responding to
illegal activity and/or content that violates Telegram’s terms of service since March
2020?

4. When did Telegram first become aware that users were employing the platform to
discuss ways to commit fraud against pandemic relief programs and to solicit
methods and information to aid such fraud?

These requests are consistent with the House of Representatives’ authorization of the
Select Subcommittee on the Coronavirus Crisis “to conduct a full and complete investigation” of
“issues related to the coronavirus crisis,” including the “efficiency, effectiveness, equity, and
transparency of the use of taxpayer funds and relief programs to address the coronavirus crisis”
and “reports of waste, fraud, abuse, price gouging, profiteering, or other abusive practices related
to the coronavirus crisis.”14

Please respond to this letter by no later than December 8, 2021, to confirm your
company’s cooperation. An attachment to this letter provides additional instructions for
responding to the Select Subcommittee’s request. If you have any questions regarding this
request, please contact Select Subcommittee staff at (202) 225-4400.

Sincerely,

__________________________
James E. Clyburn
Chairman

14
H.Res. 8, sec. 4(f), 117th Cong. (2021); H.Res. 935, 116th Cong. (2020).
Mr. Pavel Durov
Page 6

Enclosure

cc: The Honorable Steve Scalise, Ranking Member
Responding to Oversight Committee Document Requests

1. In complying with this request, produce all responsive documents that are in your
possession, custody, or control, whether held by you or your past or present agents,
employees, and representatives acting on your behalf. Produce all documents that you
have a legal right to obtain, that you have a right to copy, or to which you have access, as
well as documents that you have placed in the temporary possession, custody, or control
of any third party.

2. Requested documents, and all documents reasonably related to the requested documents,
should not be destroyed, altered, removed, transferred, or otherwise made inaccessible to
the Committee.

3. In the event that any entity, organization, or individual denoted in this request is or has
been known by any name other than that herein denoted, the request shall be read also to
include that alternative identification.

4. The Committee’s preference is to receive documents in electronic form (i.e., CD,
memory stick, thumb drive, or secure file transfer) in lieu of paper productions.

5. Documents produced in electronic format should be organized, identified, and indexed
electronically.

6. Electronic document productions should be prepared according to the following
standards:

a. The production should consist of single page Tagged Image File (“TIF”), files
accompanied by a Concordance-format load file, an Opticon reference file, and a
file defining the fields and character lengths of the load file.

b. Document numbers in the load file should match document Bates numbers and
TIF file names.

c. If the production is completed through a series of multiple partial productions,
field names and file order in all load files should match.

d. All electronic documents produced to the Committee should include the following
fields of metadata specific to each document, and no modifications should be
made to the original metadata:

BEGDOC, ENDDOC, TEXT, BEGATTACH, ENDATTACH, PAGECOUNT,
CUSTODIAN, RECORDTYPE, DATE, TIME, SENTDATE, SENTTIME,
BEGINDATE, BEGINTIME, ENDDATE, ENDTIME, AUTHOR, FROM, CC,
TO, BCC, SUBJECT, TITLE, FILENAME, FILEEXT, FILESIZE,
DATECREATED, TIMECREATED, DATELASTMOD, TIMELASTMOD,
INTMSGID, INTMSGHEADER, NATIVELINK, INTFILPATH, EXCEPTION,
BEGATTACH.

7. Documents produced to the Committee should include an index describing the contents
of the production. To the extent more than one CD, hard drive, memory stick, thumb
drive, zip file, box, or folder is produced, each should contain an index describing its
contents.

8. Documents produced in response to this request shall be produced together with copies of
file labels, dividers, or identifying markers with which they were associated when the
request was served.

9. When you produce documents, you should identify the paragraph(s) or request(s) in the
Committee’s letter to which the documents respond.

10. The fact that any other person or entity also possesses non-identical or identical copies of
the same documents shall not be a basis to withhold any information.

11. The pendency of or potential for litigation shall not be a basis to withhold any
information.

12. In accordance with 5 U.S.C.§ 552(d), the Freedom of Information Act (FOIA) and any
statutory exemptions to FOIA shall not be a basis for withholding any information.

13. Pursuant to 5 U.S.C. § 552a(b)(9), the Privacy Act shall not be a basis for withholding
information.

14. If compliance with the request cannot be made in full by the specified return date,
compliance shall be made to the extent possible by that date. An explanation of why full
compliance is not possible shall be provided along with any partial production.

15. In the event that a document is withheld on the basis of privilege, provide a privilege log
containing the following information concerning any such document: (a) every privilege
asserted; (b) the type of document; (c) the general subject matter; (d) the date, author,
addressee, and any other recipient(s); (e) the relationship of the author and addressee to
each other; and (f) the basis for the privilege(s) asserted.

16. If any document responsive to this request was, but no longer is, in your possession,
custody, or control, identify the document (by date, author, subject, and recipients), and
explain the circumstances under which the document ceased to be in your possession,
custody, or control.

17. If a date or other descriptive detail set forth in this request referring to a document is
inaccurate, but the actual date or other descriptive detail is known to you or is otherwise
apparent from the context of the request, produce all documents that would be responsive
as if the date or other descriptive detail were correct.

2
18. This request is continuing in nature and applies to any newly-discovered information.
Any record, document, compilation of data, or information not produced because it has
not been located or discovered by the return date shall be produced immediately upon
subsequent location or discovery.

19. All documents shall be Bates-stamped sequentially and produced sequentially.

20. Two sets of each production shall be delivered, one set to the Majority Staff and one set
to the Minority Staff. When documents are produced to the Committee, production sets
shall be delivered to the Majority Staff in Room 2157 of the Rayburn House Office
Building and the Minority Staff in Room 2105 of the Rayburn House Office Building.

21. Upon completion of the production, submit a written certification, signed by you or your
counsel, stating that: (1) a diligent search has been completed of all documents in your
possession, custody, or control that reasonably could contain responsive documents; and
(2) all documents located during the search that are responsive have been produced to the
Committee.

Definitions

1. The term “document” means any written, recorded, or graphic matter of any nature
whatsoever, regardless of how recorded, and whether original or copy, including, but not
limited to, the following: memoranda, reports, expense reports, books, manuals,
instructions, financial reports, data, working papers, records, notes, letters, notices,
confirmations, telegrams, receipts, appraisals, pamphlets, magazines, newspapers,
prospectuses, communications, electronic mail (email), contracts, cables, notations of any
type of conversation, telephone call, meeting or other inter-office or intra-office
communication, bulletins, printed matter, computer printouts, teletypes, invoices,
transcripts, diaries, analyses, returns, summaries, minutes, bills, accounts, estimates,
projections, comparisons, messages, correspondence, press releases, circulars, financial
statements, reviews, opinions, offers, studies and investigations, questionnaires and
surveys, and work sheets (and all drafts, preliminary versions, alterations, modifications,
revisions, changes, and amendments of any of the foregoing, as well as any attachments
or appendices thereto), and graphic or oral records or representations of any kind
(including without limitation, photographs, charts, graphs, microfiche, microfilm,
videotape, recordings and motion pictures), and electronic, mechanical, and electric
records or representations of any kind (including, without limitation, tapes, cassettes,
disks, and recordings) and other written, printed, typed, or other graphic or recorded
matter of any kind or nature, however produced or reproduced, and whether preserved in
writing, film, tape, disk, videotape, or otherwise. A document bearing any notation not a
part of the original text is to be considered a separate document. A draft or non-identical
copy is a separate document within the meaning of this term.

2. The term “communication” means each manner or means of disclosure or exchange of
information, regardless of means utilized, whether oral, electronic, by document or
otherwise, and whether in a meeting, by telephone, facsimile, mail, releases, electronic

3
message including email (desktop or mobile device), text message, instant message,
MMS or SMS message, message application, or otherwise.

3. The terms “and” and “or” shall be construed broadly and either conjunctively or
disjunctively to bring within the scope of this request any information that might
otherwise be construed to be outside its scope. The singular includes plural number, and
vice versa. The masculine includes the feminine and neutral genders.

4. The term “including” shall be construed broadly to mean “including, but not limited to.”

5. The term “Company” means the named legal entity as well as any units, firms,
partnerships, associations, corporations, limited liability companies, trusts, subsidiaries,
affiliates, divisions, departments, branches, joint ventures, proprietorships, syndicates, or
other legal, business or government entities over which the named legal entity exercises
control or in which the named entity has any ownership whatsoever.

6. The term “identify,” when used in a question about individuals, means to provide the
following information: (a) the individual’s complete name and title; (b) the
individual’s business or personal address and phone number; and (c) any and all
known aliases.

7. The term “related to” or “referring or relating to,” with respect to any given subject,
means anything that constitutes, contains, embodies, reflects, identifies, states, refers to,
deals with, or is pertinent to that subject in any manner whatsoever.

8. The term “employee” means any past or present agent, borrowed employee, casual
employee, consultant, contractor, de facto employee, detailee, fellow, independent
contractor, intern, joint adventurer, loaned employee, officer, part-time employee,
permanent employee, provisional employee, special government employee,
subcontractor, or any other type of service provider.

9. The term “individual” means all natural persons and all persons or entities acting on
their behalf.

File and source

File: 2021-12-01-clyburn-to-durov-re-ppp-eidl-fraud-383f671fb760.pdf
Size: 372,233 bytes
SHA-256: 383f671fb760d8441fa8b93f8ed70537b9fbeb2e2c0ad04954e1f73b55d801d8
Our copy: 2021-12-01-clyburn-to-durov-re-ppp-eidl-fraud-383f671fb760.pdf
Original: No public link identified.