Select Subcommittee on the Coronavirus Crisis — Apple Inc., Timothy Cook: Fraud on Telegram (March 23, 2022)

Summary

A March 23, 2022 letter from Chairman James E. Clyburn of the Select Subcommittee on the Coronavirus Crisis to Timothy Cook, Chief Executive Officer of Apple Inc. The letter states that the Select Subcommittee is investigating fraud against pandemic relief programs facilitated on Telegram, an application available through Apple’s App Store. It describes instructions on Telegram for evading fraud controls for the Paycheck Protection Program (PPP), Economic Injury Disaster Loan (EIDL) program, unemployment insurance and the Restaurant Revitalization Fund (RRF). It requests documents dated March 15, 2020 to the present and written responses by April 7, 2022, and asks for a reply by March 30, 2022 confirming cooperation. An enclosure gives instructions for responding.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Date: 2022-03-23

Cite this document

“Select Subcommittee on the Coronavirus Crisis — Apple Inc., Timothy Cook: Fraud on Telegram (March 23, 2022).” Dated 2022-03-23. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2022-03-23-clyburn-to-apple-re-telegram-f7836b06d34f-ecbd778b1d/, SHA-256 f7836b06d34fe22bd251052b082ccb49e876572abd39009de1c60ef46e6a5e2c.

Full text

March 23, 2022

Mr. Timothy Cook
Chief Executive Officer
Apple Inc.
1 Infinite Loop
Cupertino, CA 95014

Dear Mr. Cook:

The Select Subcommittee on the Coronavirus Crisis is investigating fraud against
pandemic relief programs being facilitated on Telegram, an application available for download
through Apple Inc.’s (Apple) App Store. Telegram has served as a platform for extensive and
widespread dissemination of instructions for evading fraud controls for the Paycheck Protection
Program (PPP), Economic Injury Disaster Loan (EIDL) program, unemployment insurance, and
the Restaurant Revitalization Fund (RRF). The availability of these instructions on Telegram
may have enabled bad actors to commit large-scale fraud. Troublingly, such facilitation of
widespread fraud appears to be consistent with Telegram’s terms of service. This activity is not
consistent, however, with Apple’s publicly available standards and terms of service for
application developers, which explicitly prohibit applications from being used to facilitate the
commission of unlawful conduct. I am writing to request documents and information necessary
for the Select Subcommittee to better understand this apparent inconsistency and to determine
whether Apple may be able to play a constructive role in combating this Telegram-facilitated
fraud against the American public.

Apple’s publicly available requirements for applications that are available through the
Apple App Store include terms that appear to prohibit an application like Telegram from
systematically facilitating criminal activity like fraud against pandemic relief programs. The
model Apple Developer Program License Agreement prevents companies from distributing
applications through Apple software and Apple services if those applications would “facilitate
the commission of a crime, or other tortious, unlawful or illegal act.”1 Similarly, Apple’s App
Store Review Guidelines states that applications that “solicit, promote, or encourage criminal or

1
Apple Inc., Apple Developer Program License Agreement (online at
https://developer.apple.com/support/downloads/terms/apple-developer-program/Apple-Developer-Program-License-
Agreement-20211213-English.pdf) (accessed Mar. 15, 2022).
Mr. Timothy Cook
Page 2

clearly reckless behavior will be rejected.”2 There is substantial evidence that Telegram has not
complied with these requirements by allowing its application to be used as a central platform for
the facilitation of fraud against vital pandemic relief programs.3

Telegram’s platform has served as a hub for people to discuss ways to commit large-scale
criminal fraud against numerous federal and state relief programs.4 Individuals have used
Telegram channels to advertise the sale of detailed instructions for successfully submitting
fraudulent relief claims to numerous relief programs.5 These channels have been used to
disseminate what some reports have called “step-by-step playbook[s]” that scammers follow to
commit fraud.6 The dissemination of such guides for evading relief program fraud controls is
consistent with reports that a substantial share of pandemic relief program funds have been
illicitly obtained by criminals committing fraud on a large scale, rather than individuals
submitting isolated applications for benefits they were not eligible for. The Department of
Justice has prosecuted numerous cases where individuals submitted dozens or hundreds of
fraudulent applications for loans or other relief worth millions of dollars, demonstrating the
substantial damage caused by distributing “playbooks” for evading fraud controls to committed
criminals.7 Telegram channels have also included discussion of using stolen identities to aid in
the commission of pandemic relief fraud, and some users have advertised the sale of such stolen

2
Apple Inc., App Store Review Guidelines (online at https://developer.apple.com/app-
store/review/guidelines/) (accessed Mar. 15, 2022).
3
Letter from Chairman James E. Clyburn, Select Subcommittee on the Coronavirus Crisis, to Pavel Durov,
Chief Executive Officer, Telegram (Dec. 1, 2021) (online at
https://coronavirus.house.gov/sites/democrats.coronavirus.house.gov/files/2021-12-
01.Clyburn%20to%20Durov%20re%20PPP-EIDL%20Fraud.pdf).
4
How Unemployment Insurance Fraud Exploded During the Pandemic, ProPublica (July 26, 2021) (online
at www.propublica.org/article/how-unemployment-insurance-fraud-exploded-during-the-pandemic) (discussing the
use of Telegram to disseminate methods for submitting fraudulent unemployment insurance claims); An Avalanche
of Fraud Buried a Small Business Relief Program, Bloomberg (Oct. 29, 2020) (online at
www.bloomberg.com/news/features/2020-10-29/small-business-administration-10-000-grant-fraud-went-viral-
hurting-program); Is Womply Getting Whomped with PPP Fraud?, FrankonFraud (May 2, 2021) (online at
https://frankonfraud.com/fraud-trends/is-womply-getting-whomped-with-ppp-fraud/); Fraudsters Targeting New
SBA Restaurant Fund, FrankonFraud (May 28, 2021) (online at https://frankonfraud.com/fraud-trends/fraudsters-
targeting-sbas-restaurant-fund/) .
5
How Unemployment Insurance Fraud Exploded During the Pandemic, ProPublica (July 26, 2021) (online
at www.propublica.org/article/how-unemployment-insurance-fraud-exploded-during-the-pandemic).
6
How Scammers Siphoned $36B in Fraudulent Unemployment Payments from US, USA Today (Jan. 26,
2021) (online at www.usatoday.com/in-depth/news/investigations/2020/12/30/unemployment-fraud-how-
international-scammers-took-36-b-us/3960263001/).
7
See, e.g., Complaint, United States v. Ayvazyan, Case No. 20-cr-579-SVW (C.D. Cal., filed Oct. 20, 2020)
ECF No. 1 (alleging defendants conspired to submit more than 150 fraudulent PPP and EIDL applications worth
over $20 million using stolen identities); Complaint, United States v. Arnett, Case No. 21-mj-30522 (E.D. Mich.,
filed Nov. 5, 2021) (alleging two defendants submitted over 500 fraudulent unemployment insurance claims worth
over $4 million in large-scale, multistate fraud scheme); Complaint, United States v. Carter, Case No. 21-mj-9734
(S.D.N.Y., filed Oct. 11, 2021) (alleging four defendants submitted over 1,000 fraudulent EIDL applications seeking
at least $10 million); Information, United States v. Blotnick, Case No. 21-cr-796-BRM (D.N.J., filed Oct. 13, 2021)
(alleging defendant submitted at least 21 fraudulent PPP applications seeking over $6.8 million).
Mr. Timothy Cook
Page 3

personal information.8 This is particularly concerning because people whose stolen identities
have been used to apply for pandemic aid, like unemployment insurance, will subsequently face
great difficulty in lawfully obtaining such aid for themselves.9

Telegram’s lax standards and content moderation policies appear to have made the
application an ideal platform for the facilitation of large-scale fraud against relief programs.
Telegram’s very brief terms of service only prohibit users from “scam[ming]” other Telegram
users, appearing to permit the use of the platform to conspire to commit fraud against others.10
The terms only bar users from promoting violence or posting illegal pornographic content on
“publicly viewable” channels, even though so-called “private” channels are often far from
private, permitting up to 200,000 users. The company explicitly says it “do[es] not process any
requests related to [illegal content on “private” group chats].”11 Telegram’s lax standards and
minimal content moderation have also reportedly led, in addition to its use for the facilitation of
fraud, to use by extremist groups advocating for political violence and to the widespread
dissemination of misinformation relating to the coronavirus and vaccines.12 The proliferation
and monetization of such misinformation is the subject of a separate Select Subcommittee
investigation.13

8
How Unemployment Insurance Fraud Exploded During the Pandemic, ProPublica (July 26, 2021) (online
at www.propublica.org/article/how-unemployment-insurance-fraud-exploded-during-the-pandemic); How Scammers
Siphoned $36B in Fraudulent Unemployment Payments from US, USA Today (Jan. 26, 2021) (online at
www.usatoday.com/in-depth/news/investigations/2020/12/30/unemployment-fraud-how-international-scammers-
took-36-b-us/3960263001/).
9
See, e.g., ‘Easy Money’: How International Scam Artists Pulled off an Epic Theft of Covid Benefits, NBC
News (Aug. 15, 2021) (online at www.nbcnews.com/news/us-news/easy-money-how-international-scam-artists-
pulled-epic-theft-covid-n1276789); Identity Thieves Target New Yorkers’ Unemployment Benefits, New York Daily
News (Feb. 20, 2021) (online at www.nydailynews.com/new-york/ny-identity-theft-unemployment-20210220-
3jlamauylba7nkuyjmdf3akplu-story.html).
10
Telegram, Terms of Service (online at https://telegram.org/tos) (accessed Mar. 17, 2022).
11
Telegram, FAQs (online at https://telegram.org/faq#q-there-39s-illegal-content-on-telegram-how-do-i-
take-it-down) (accessed Mar. 17, 2022).
12
Why Right-Wing Extremists Favorite New Platform Is So Dangerous, Vox (Jan. 20, 2021) (online at
www.vox.com/recode/22238755/telegram-messaging-social-media-extremists); Germany: Telegram Becoming a
‘Medium for Radicalization,’ ABC News (Jan. 26, 2022) (online at
https://abcnews.go.com/Health/wireStory/germany-telegram-medium-radicalization-82491848); Lacking Oversight,
Telegram Thrives in Ukraine Disinformation Battle, France 24 (Mar. 9, 2022) (online at www.france24.com/en/live-
news/20220309-lacking-oversight-telegram-thrives-in-ukraine-disinformation-battle); Telegram Forgot to Check its
Email and Now it’s Banned in Brazil, The Verge (Mar. 18, 2022) (online at
https://theverge.com/2022/3/18/22985737/telegram-brazil-supreme-court-ban-email-address-statement-durov);
Telegram Emerges as New Dark Web for Cyber Criminals, Financial Times (Sep. 17, 2021) (online at
https://ft.com/content/cc3e3854-5f76-4422-a970-9010c3bc732b); Some of the Most-Viewed Posts on Telegram
Channels Contain Vaccine Misinformation: Study, Newsweek (Dec. 17, 2021) (online at
www.newsweek.com/some-most-viewed-posts-telegram-channels-contain-vaccine-misinformation-study-1660656).
13
Select Subcommittee on the Coronavirus Crisis, Press Release: Select Subcommittee Launches
Investigation into Online Entities Pushing Coronavirus Misinformation and Selling Unproven Treatments (Oct. 29,
2021) (online at https://coronavirus.house.gov/news/press-releases/select-subcommittee-launches-investigation-
online-entities-pushing-coronavirus).
Mr. Timothy Cook
Page 4

Given that Telegram is among the most used and downloaded applications in the world,
with over 500 million active users and over a billion downloads, the company’s apparent failure
to comply with Apple’s terms of service and other standards is particularly consequential.14

To help the Select Subcommittee better understand Apple’s engagement with and
standards for Telegram related to that application’s use as a platform for the facilitation of
pandemic relief fraud, please provide, by April 7, 2022, the following documents dated March
15, 2020 to the present.

1. All agreements and/or contracts between Apple and Telegram;

2. All communications between Apple and Telegram and/or its representatives related to
fraud or other unlawful conduct on the Telegram platform, including fraud against
pandemic relief programs; and

3. All analyses, reports, and/or assessments of Telegram’s compliance with Apple’s
terms of service and other requirements related to the potential use of the Telegram
application for fraud or other unlawful conduct, including fraud against pandemic
relief programs.

Please also provide written responses to the following information requests by April 7,
2022.

1. Has Apple requested that Telegram take any actions regarding Telegram’s use as a
platform for aiding or facilitating pandemic relief fraud?

2. How does Apple communicate with Telegram concerning its compliance or failure to
comply with Apple’s terms of services, standards, or other contractual requirements?

3. What policies and practices has Apple implemented to monitor whether applications
disseminated through the App Store are being used to facilitate fraud, and what steps
does Apple take when it discovers that an application is being used to facilitate fraud?

4. What policies and practices has Apple implemented to monitor whether applications
disseminated through the App Store are being used to disseminate coronavirus
misinformation, and what steps does Apple take when it discovers that an application
is being used to spread coronavirus misinformation?

14
Telegram, FAQs (online at https://telegram.org/faq#q-what-is-telegram-what-do-i-do-here) (accessed
Mar. 15, 2022); Telegram Tops 1 Billion Downloads, TechCrunch (Aug. 30, 2021) (online at
https://techcrunch.com/2021/08/30/telegram-tops-1-billion-downloads/).
Mr. Timothy Cook
Page 5

These requests are consistent with the House of Representatives’ authorization of the
Select Subcommittee on the Coronavirus Crisis “to conduct a full and complete investigation” of
“issues related to the coronavirus crisis,” including the “efficiency, effectiveness, equity, and
transparency of the use of taxpayer funds and relief programs to address the coronavirus crisis”
and “reports of waste, fraud, abuse, price gouging, profiteering, or other abusive practices related
to the coronavirus crisis.”15

Please respond to this letter by no later than March 30, 2022, to confirm your company’s
cooperation. An attachment to this letter provides additional instructions for responding to the
Select Subcommittee’s request. If you have any questions regarding this request, please contact
Select Subcommittee staff at (202) 225-4400.

Sincerely,

__________________________
James E. Clyburn
Chairman

Enclosure

cc: The Honorable Steve Scalise, Ranking Member

15
H.Res. 8, sec. 4(f), 117th Cong. (2021); H.Res. 935, 116th Cong. (2020).
Responding to Oversight Committee Document Requests

1. In complying with this request, produce all responsive documents that are in your
possession, custody, or control, whether held by you or your past or present agents,
employees, and representatives acting on your behalf. Produce all documents that you
have a legal right to obtain, that you have a right to copy, or to which you have access, as
well as documents that you have placed in the temporary possession, custody, or control
of any third party.

2. Requested documents, and all documents reasonably related to the requested documents,
should not be destroyed, altered, removed, transferred, or otherwise made inaccessible to
the Committee.

3. In the event that any entity, organization, or individual denoted in this request is or has
been known by any name other than that herein denoted, the request shall be read also to
include that alternative identification.

4. The Committee’s preference is to receive documents in electronic form (i.e., CD,
memory stick, thumb drive, or secure file transfer) in lieu of paper productions.

5. Documents produced in electronic format should be organized, identified, and indexed
electronically.

6. Electronic document productions should be prepared according to the following
standards:

a. The production should consist of single page Tagged Image File (“TIF”), files
accompanied by a Concordance-format load file, an Opticon reference file, and a
file defining the fields and character lengths of the load file.

b. Document numbers in the load file should match document Bates numbers and
TIF file names.

c. If the production is completed through a series of multiple partial productions,
field names and file order in all load files should match.

d. All electronic documents produced to the Committee should include the following
fields of metadata specific to each document, and no modifications should be
made to the original metadata:

BEGDOC, ENDDOC, TEXT, BEGATTACH, ENDATTACH, PAGECOUNT,
CUSTODIAN, RECORDTYPE, DATE, TIME, SENTDATE, SENTTIME,
BEGINDATE, BEGINTIME, ENDDATE, ENDTIME, AUTHOR, FROM, CC,
TO, BCC, SUBJECT, TITLE, FILENAME, FILEEXT, FILESIZE,
DATECREATED, TIMECREATED, DATELASTMOD, TIMELASTMOD,
INTMSGID, INTMSGHEADER, NATIVELINK, INTFILPATH, EXCEPTION,
BEGATTACH.

7. Documents produced to the Committee should include an index describing the contents
of the production. To the extent more than one CD, hard drive, memory stick, thumb
drive, zip file, box, or folder is produced, each should contain an index describing its
contents.

8. Documents produced in response to this request shall be produced together with copies of
file labels, dividers, or identifying markers with which they were associated when the
request was served.

9. When you produce documents, you should identify the paragraph(s) or request(s) in the
Committee’s letter to which the documents respond.

10. The fact that any other person or entity also possesses non-identical or identical copies of
the same documents shall not be a basis to withhold any information.

11. The pendency of or potential for litigation shall not be a basis to withhold any
information.

12. In accordance with 5 U.S.C.§ 552(d), the Freedom of Information Act (FOIA) and any
statutory exemptions to FOIA shall not be a basis for withholding any information.

13. Pursuant to 5 U.S.C. § 552a(b)(9), the Privacy Act shall not be a basis for withholding
information.

14. If compliance with the request cannot be made in full by the specified return date,
compliance shall be made to the extent possible by that date. An explanation of why full
compliance is not possible shall be provided along with any partial production.

15. In the event that a document is withheld on the basis of privilege, provide a privilege log
containing the following information concerning any such document: (a) every privilege
asserted; (b) the type of document; (c) the general subject matter; (d) the date, author,
addressee, and any other recipient(s); (e) the relationship of the author and addressee to
each other; and (f) the basis for the privilege(s) asserted.

16. If any document responsive to this request was, but no longer is, in your possession,
custody, or control, identify the document (by date, author, subject, and recipients), and
explain the circumstances under which the document ceased to be in your possession,
custody, or control.

17. If a date or other descriptive detail set forth in this request referring to a document is
inaccurate, but the actual date or other descriptive detail is known to you or is otherwise
apparent from the context of the request, produce all documents that would be responsive
as if the date or other descriptive detail were correct.

2
18. This request is continuing in nature and applies to any newly-discovered information.
Any record, document, compilation of data, or information not produced because it has
not been located or discovered by the return date shall be produced immediately upon
subsequent location or discovery.

19. All documents shall be Bates-stamped sequentially and produced sequentially.

20. Two sets of each production shall be delivered, one set to the Majority Staff and one set
to the Minority Staff. When documents are produced to the Committee, production sets
shall be delivered to the Majority Staff in Room 2157 of the Rayburn House Office
Building and the Minority Staff in Room 2105 of the Rayburn House Office Building.

21. Upon completion of the production, submit a written certification, signed by you or your
counsel, stating that: (1) a diligent search has been completed of all documents in your
possession, custody, or control that reasonably could contain responsive documents; and
(2) all documents located during the search that are responsive have been produced to the
Committee.

Definitions

1. The term “document” means any written, recorded, or graphic matter of any nature
whatsoever, regardless of how recorded, and whether original or copy, including, but not
limited to, the following: memoranda, reports, expense reports, books, manuals,
instructions, financial reports, data, working papers, records, notes, letters, notices,
confirmations, telegrams, receipts, appraisals, pamphlets, magazines, newspapers,
prospectuses, communications, electronic mail (email), contracts, cables, notations of any
type of conversation, telephone call, meeting or other inter-office or intra-office
communication, bulletins, printed matter, computer printouts, teletypes, invoices,
transcripts, diaries, analyses, returns, summaries, minutes, bills, accounts, estimates,
projections, comparisons, messages, correspondence, press releases, circulars, financial
statements, reviews, opinions, offers, studies and investigations, questionnaires and
surveys, and work sheets (and all drafts, preliminary versions, alterations, modifications,
revisions, changes, and amendments of any of the foregoing, as well as any attachments
or appendices thereto), and graphic or oral records or representations of any kind
(including without limitation, photographs, charts, graphs, microfiche, microfilm,
videotape, recordings and motion pictures), and electronic, mechanical, and electric
records or representations of any kind (including, without limitation, tapes, cassettes,
disks, and recordings) and other written, printed, typed, or other graphic or recorded
matter of any kind or nature, however produced or reproduced, and whether preserved in
writing, film, tape, disk, videotape, or otherwise. A document bearing any notation not a
part of the original text is to be considered a separate document. A draft or non-identical
copy is a separate document within the meaning of this term.

2. The term “communication” means each manner or means of disclosure or exchange of
information, regardless of means utilized, whether oral, electronic, by document or
otherwise, and whether in a meeting, by telephone, facsimile, mail, releases, electronic

3
message including email (desktop or mobile device), text message, instant message,
MMS or SMS message, message application, or otherwise.

3. The terms “and” and “or” shall be construed broadly and either conjunctively or
disjunctively to bring within the scope of this request any information that might
otherwise be construed to be outside its scope. The singular includes plural number, and
vice versa. The masculine includes the feminine and neutral genders.

4. The term “including” shall be construed broadly to mean “including, but not limited to.”

5. The term “Company” means the named legal entity as well as any units, firms,
partnerships, associations, corporations, limited liability companies, trusts, subsidiaries,
affiliates, divisions, departments, branches, joint ventures, proprietorships, syndicates, or
other legal, business or government entities over which the named legal entity exercises
control or in which the named entity has any ownership whatsoever.

6. The term “identify,” when used in a question about individuals, means to provide the
following information: (a) the individual’s complete name and title; (b) the
individual’s business or personal address and phone number; and (c) any and all
known aliases.

7. The term “related to” or “referring or relating to,” with respect to any given subject,
means anything that constitutes, contains, embodies, reflects, identifies, states, refers to,
deals with, or is pertinent to that subject in any manner whatsoever.

8. The term “employee” means any past or present agent, borrowed employee, casual
employee, consultant, contractor, de facto employee, detailee, fellow, independent
contractor, intern, joint adventurer, loaned employee, officer, part-time employee,
permanent employee, provisional employee, special government employee,
subcontractor, or any other type of service provider.

9. The term “individual” means all natural persons and all persons or entities acting on
their behalf.

File and source

File: 2022-03-23-clyburn-to-apple-re-telegram-f7836b06d34f.pdf
Size: 365,180 bytes
SHA-256: f7836b06d34fe22bd251052b082ccb49e876572abd39009de1c60ef46e6a5e2c
Our copy: 2022-03-23-clyburn-to-apple-re-telegram-f7836b06d34f.pdf
Original: No public link identified.