The headline is wrong. Australia did not sue Telegram because Telegram refused to remove terrorist videos. Australia sued Telegram because Telegram's infrastructure is structurally incapable of confirming whether those videos exist.
Precision matters here. The Australian eSafety Commissioner's A$38 million civil penalty claim rests on the phrase "failure to detect" โ not "failure to remove," not "refusal to comply," but "failure to detect." That word choice is a theory of liability. It converts a takedown obligation into a detection obligation, and once detection becomes mandatory, every encrypted broadcast platform is suddenly inside the regulator's blast radius.
The videos in question: the Christchurch mosque shooting, livestreamed on March 15, 2019, and the Buffalo supermarket shooting, livestreamed on May 14, 2022. Both are classified in Australian law as Class 1 material โ content depicting abhorrent violent conduct, the most serious category of online harm in the statute. Both circulated on Telegram public channels for months, possibly years, after the events. Telegram's own terms of service prohibit violent content. The question an Australian court will answer is not whether Telegram violated its own terms. The question is whether a privacy-first architecture that cannot reliably detect known objectionable content is, by design, a compliance failure.
I have spent the past decade reading code the way other journalists read press releases. This case is not an anomaly. It is the template.
A$38 million is a strange number. It is not round, and it is not symbolic. It is the output of an arithmetic expression, and the expression is readable.
Australia's Online Safety Act 2021 established the eSafety Commissioner as an independent regulator with power to impose civil penalties on providers of relevant online services that fail to meet the Basic Online Safety Expectations โ the BOSE regime, in the industry's shorthand. BOSE took effect in January 2022. It is principles-based. It does not enumerate every prohibited video; it requires platforms to make "reasonable efforts" to detect and remove material causing "serious electronic safety harm." Class 1 material โ terrorist violence, abhorrent conduct โ sits at the top of the harm hierarchy. The statutory maximum civil penalty for a body corporate is roughly A$555,000 per contravention. Divide A$38 million by A$555,000 and you get 68.4.
The complaint therefore looks like a ledger: sixty-eight discrete failures, or a continuous course of non-compliance over a defined window, or some hybrid calculation that the Commissioner's office chose to present as a single figure. A regulator does not arrive at a number like that by accident.
The Commissioner's office is led by Julie Inman Grant, a former Microsoft and Twitter public-policy executive who has spent her tenure converting the Act's ambiguity into escalating enforcement actions. Her background matters. She came from platforms, she knows their weak points, and she has been methodical about choosing fights the regulator can win. The Telegram action reads like a carefully selected battle.
There is also a denominator problem that will surface in the pleadings: Telegram does not disclose Australian user numbers. The Act applies to services that are "targeted at" or "likely to be accessed by" Australian users. The Commissioner will argue that a platform with Australian app-store presence, Australian-language channels, and payment integration via Stars meets the threshold. Telegram will argue the opposite. Neither argument is weak, but the burden of producing evidence sits with the Commissioner, and she has chosen to carry it.
Telegram, for its part, is the largest cryptographic mass-messaging platform on earth. Approaching one billion monthly users. A British Virgin Islands legal entity, Dubai headquarters, founded and wholly controlled by Pavel Durov. It operates without a conventional Western compliance apparatus: no Australian office, no publicly designated local representative, no membership in Australia's online safety industry self-regulatory bodies, and no transparency report specific to Australian content-moderation requests. That last one is a fact the regulator will use at trial. In a compliance regime built on disclosure, the refusal to disclose is itself the finding.
The eSafety Commissioner does not typically begin with a lawsuit. The usual sequence is: education, guidance, transparency demand, infringement notice, litigation. The decision to jump to civil litigation โ the first time eSafety has sued a platform for an alleged BOSE failure of this scale โ signals a prior record of non-cooperation that the Commissioner is prepared to introduce into evidence. The choice of Telegram over Meta or Google is not random. It is a test-case selection decision, and I will return to it.
Six passes will follow: the legal mechanics, the cryptographic architecture, the penalty ledger, the enforcement curve, the economics of remediation, and the governance vacuum.
Pass One: The Verb That Launched a Lawsuit
"Failure to detect" is a novel legal theory wearing the clothing of a finding. Under the Online Safety Act, the Commissioner can issue a removal notice requiring a platform to take down listed material within a fixed window โ twenty-four hours for Class 1 content. Failure to comply is a breach. Simple. Provable. Post-hoc.
The operative machinery is section 109 of the Act: the Commissioner can issue a removal notice requiring a service to remove, or cease hosting, Class 1 material within a specified timeframe. Failure to comply with a removal notice is itself a contravention carrying the full statutory penalty. A well-structured complaint would therefore plead both: specific removal-notice failures, measured in hours of non-compliance, and systemic detection failures, measured in architecture. The choice to emphasize detection suggests the Commissioner is aiming at the harder, more valuable target.
But the complaint is not framed as a simple notice-and-takedown matter. It is framed around detection, which is anticipatory, not reactive. The legislative history of the 2021 Act is unambiguous: Australian lawmakers wanted to end the era of notice-and-takedown as the ceiling of platform responsibility. The shift is from "react when told" to "anticipate and prevent." The BOSE regime operationalizes that shift by requiring reasonable efforts to detect serious harm, and "reasonable efforts" in the Commissioner's reading includes maintaining systems capable of finding known harmful content before a removal notice is necessary.
The evidence problem this creates for the regulator is real. To prove a detection failure, the Commissioner must establish three things: the material was available on Telegram; a technical method existed to identify it; and Telegram chose not to deploy that method. That is discovery into Telegram's engineering decisions. It requires the court to compare Telegram's internal moderation pipeline against what third-party vendors already sell. From an auditor's perspective, this is the standard "show me the test suite" demand, applied to a multinational.
There is also a subtle timing issue that most coverage ignores. The Christchurch footage is from March 2019 โ before the Act. The Buffalo footage is from May 2022 โ after the Act and after BOSE took effect. The Act does not operate retrospectively to punish conduct that occurred before its commencement. So the Commissioner's claim cannot rest on the original 2019 upload. It must rest on the continued availability of the footage after the operative provisions took force: the re-uploads, the archived copies, the mirrored channels that remained accessible to Australian users in 2022 and later. The complaint is not about a single historical event. It is about a persistent state. The ledger needs a start timestamp, and the plausible start timestamp is January 2022, when BOSE went live. Every calendar day of continued non-detection after that date is a separate contravention window.
Pass Two: The Architecture Is Not the Alibi
Here is the technical fact that dominates the legal proceedings, and most commentators will miss it: Telegram's default chats are not end-to-end encrypted.
Telegram's MTProto protocol encrypts cloud chats in transit and at rest, but the cryptographic session logic is managed by Telegram's servers. Multi-device sync works because Telegram's backend can route, re-encrypt, and index cloud-chat traffic. True end-to-end encryption โ where Telegram holds no decryption material โ exists only in "Secret Chats." Channels, groups, and bots are cloud-based entities. They are not Secret Chats.
For readers who want the underlying mechanics: MTProto splits messages into parts, encrypts each part, and distributes them across multiple data centers. The server-side shuffle is what allows Telegram to sync chats across devices and push notifications to phones that are offline. The protocol is not wrong, and it is not insecure in the ordinary sense. But it is a client-server protocol, not an end-to-end protocol, for the default chat class. Telegram's own documentation concedes this: only Secret Chats are end-to-end encrypted. Even Telegram's bot API reads messages server-side โ bots receive channel content as plaintext by design. If a bot can read a message, the server can read it. The infrastructure is not a black box; it is a filing cabinet with a lock that Telegram holds.
This is decisive. Terrorist video distribution at scale does not happen through Secret Chats. Secret Chats are one-to-one or one-to-few, and they are not discoverable. Broadcasting to hundreds of thousands of subscribers happens through channels, and channels are as inspectable as Telegram chooses to make them. When eSafety claims Telegram "failed to detect" a known pro-terror video in a channel, it is not claiming Telegram failed to break encryption. It is claiming Telegram failed to look.
The industry-standard detection machinery is mundane and mature. Microsoft PhotoDNA, the GIFCT Content Hash Database, Thorn's Safer tooling โ all designed to be deployed at upload time, before any encryption layer becomes relevant. Perceptual hashing can be computed server-side on inbound channel media without touching a single Secret Chat. Telegram's server-side architecture is technically capable of running that pipeline. The excuse is not "mathematically impossible." The excuse is "we chose not to."
And this is where Telegram's own history becomes the prosecution's best exhibit. Telegram has, since 2015, publicly removed ISIS-affiliated channels. Durov has repeatedly touted the platform's takedown numbers, describing Telegram as an active adversary of terrorist groups online. You cannot claim credit for being good at finding terrorist content when it serves your narrative, and simultaneously claim technical impossibility when the same content category is the subject of a regulatory complaint. If Telegram can detect and remove ISIS material at scale, it can detect the Christchurch and Buffalo footage โ or at least, a court will be entitled to find that it could. The burden falls on Telegram to prove why those specific categories were beyond reasonable effort.
The honest technical counterargument is narrower but real. Hash-matching works on known content. The Buffalo footage was widely reposted in edited forms โ cropped, re-encoded, overlaid with graphics. Perceptual hashes catch near-duplicates, but they are not infallible, and adversarial actors deliberately alter video to evade matching. The legal standard is "reasonable effort," not "perfect detection," and a mature detection system should still catch most variants. A court in Sydney will have to decide how many missed variants constitute reasonable effort and how many constitute systematic failure. That is a genuine judgment call, not a foregone conclusion โ but it is a judgment call about the adequacy of a system, not about the inviolability of encryption. Code is not law, it is merely preference; and preferences get priced.
Pass Three: The Ledger, Counted
I want to linger on the arithmetic because in regulatory cases, the complaint's numbers are the most reliable evidence of the regulator's theory.
A$38 million at the statutory cap of A$555,000 per contravention implies approximately 68 charging units. Two readings follow.
Reading one: per-item. The Commissioner has identified 68 or more distinct instances โ URLs, hashes, or channel postings โ of Class 1 material that Telegram failed to detect. That is a forensic inventory. It means eSafety's team spent months compiling evidence: archived videos, download timestamps, channel identifiers, Telegram's public API metadata. A regulator does not spend months building a 68-item inventory unless it plans for the litigation to withstand scrutiny.
Reading two: per-day. The claim is calculated as a daily penalty over the period of continued non-compliance โ say, 68 days during which the footage remained available on identifiable channels after a formal notification. That reading suggests the Commissioner gave Telegram a clear, dated opportunity to comply, observed no compliance, and then multiplied.
Either way, the pattern is the same: the complaint is a ledger. The ledger remembers what the mempool forgets.
When I audited NFT projects in 2021, I built wallet clusters to prove that 30 percent of floor-price support was wash trading. The same clustering logic exposes Telegram channel mirrors: a takedown of channel A is followed within hours by the appearance of channels A-prime, A-bis, and A-ter. From a network-mapping perspective, this is deterministic behavior, not noise. A platform that deploys cloning-resistant detection at the upload layer can cut the mirror cascade at its root. A platform that relies on manual takedown of already-identified channels is permanently behind. The court will likely hear expert testimony on this exact propagation model โ the question is whether Telegram's absence of countermeasures constitutes negligence or intent.
The absence of Telegram's own records becomes meaningful at this point. Telegram does not publish an Australian-specific transparency report. There is no public count of removal requests received from eSafety, no public count of content removed or declined, no latency data. The platform's answer to "what did you know and when did you know it" is, so far, silence. In litigation, silence is a form of discovery. A court is unlikely to accept "no records exist" from an engineering organization with Telegram's resources. I have seen this dynamic in the systems I audit: the lack of audit trails is never neutral. In the 2022 Terra collapse, the seigniorage model failed precisely because the team never instrumented the system's feedback loops โ no one logged the death spiral until it was visible on every screen. The difference here is that lawyers, not market makers, are doing the observing.
Pass Four: The Enforcement Curve
The Australian regulatory trajectory is a clean escalation graph.
2021: The Online Safety Act passes. 2022: BOSE takes effect. 2023: eSafety issues an infringement notice to X (formerly Twitter) for A$610,500 for failing to answer questions about hate-speech handling. Meta and Google received smaller fines in the same enforcement cycle. 2024: the Commissioner announces deeper scrutiny of recommender systems and encrypted platforms. 2025โ2026: this lawsuit.
The progression matters. Early enforcement was designed to produce compliance, not punishment โ transparency reports, notices, fines calibrated to corporate resistance. The Telegram action is the first time the Commissioner has asked a court to do what administrative notices could not. That is not an escalation of degree; it is an escalation of kind.
Why Telegram? Four reasons. First, scale with a compliance deficit: Telegram has roughly one billion users and almost no Western regulatory infrastructure. Meta has more users and an army of compliance lawyers; suing Meta is a marathon by default. Second, the crypto-native dimension: Telegram's integration with the TON blockchain, in-app wallet infrastructure, and token-based monetization makes it the most "protocol-like" major platform โ a target that lets the regulator preview how it will treat permissionless infrastructure. Third, the target's isolation: Telegram is not part of Australia's industry self-regulatory bodies, so the usual back-channel coordination is unavailable. Fourth, the timing: the August 2024 indictment of Pavel Durov in Paris on charges of platform complicity โ six counts, including refusal to communicate information to lawful authorities โ changed the risk calculus. Australian prosecutors, like their international counterparts, now know Telegram is judicially vulnerable. The civil case in Canberra is the complement to the criminal case in Paris.
The international dimension is deeper than one arrest. The Christchurch Call, launched in 2019 by New Zealand's Jacinda Ardern and France's Emmanuel Macron, explicitly commits governments and tech companies to eliminate terrorist content online. Australia was a founding member. Telegram is not a signatory. The eSafety Commissioner has also coordinated with the GIFCT content-hash consortium. Even if an Australian judgment cannot be enforced against Telegram's servers in Dubai, the reputational and diplomatic consequences of a judicial finding that Telegram breached the Christchurch Call framework would outweigh the fine.
This is where I see the regulatory philosophy converging with what I have written about the SEC. In the United States, the SEC's regulation-by-enforcement is a deliberate refusal to give clear rules โ the ambiguity is the enforcement fuel. Australia is the inverse: the rules are written, and the litigation exists to prove they bite. Both models price compliance through uncertainty. The difference is that in Australia, the regulator has to produce a coherent technical theory in open court. That is a far higher bar.
Pass Five: The Cost of Being Blind
Let me put real numbers on the "reasonable effort" debate.
A$38 million against Telegram's disclosed 2023 revenue of roughly US$342 million is about 8 percent of a single year's top line. Telegram says it reached profitability in 2024. The fine, alone, is survivable. The remedy is not.
Should eSafety win, the court has options beyond fines. It can issue behavioral orders requiring Telegram to deploy detection technology on channels accessible to Australian users, appoint a local content-safety officer, establish a complaints and appeals mechanism, submit to independent technical audits, and file periodic compliance reports. The operational cost of that regime, based on what comparable platforms spend:
- Initial deployment: hash databases, perceptual-hashing pipelines, moderation queues โ US$5 million to US$8 million in year one.
- Ongoing operations: moderation staff, escalations, appeals, transparency reporting โ US$3 million to US$6 million per year.
- Technical audits and legal obligations: US$2 million to US$5 million annually.
Cumulative three-year exposure if Telegram loses and complies: US$20 million to US$40 million. That is the real price of this litigation.
But the hidden price is the narrative one. Telegram's monetization is a trust economy. Telegram Premium subscriptions, Stars in-app payments, TON-linked transactions โ all of it assumes a private enclave where the platform does not inspect content. The moment a court orders channel-level detection, the enclave narrative contracts. It does not matter that the detection is limited to known Class 1 material; the marketing claim of "privacy without compromise" does not survive a court-ordered compromise. I have documented this dynamic in crypto markets: floor prices are liquidated confidence, and confidence in a privacy platform is liquidated the same way when the architecture yields to sovereign demands.
The TON vector deserves a separate paragraph. Telegram has evolved into the front-end of a crypto ecosystem: the built-in TON wallet, Stars as in-app currency, advertising paid in crypto, and a deep bench of Web3 mini-apps. A compliance order that forces server-side content inspection will not stop at videos. The same pipeline that detects terrorist footage will be expected to detect fraud, phishing, unlicensed securities solicitations, and deepfakes. Australian regulators, including ASIC, have already begun treating Telegram channels as distribution vectors for financial scams. The eSafety case is the narrow edge of a wide enforcement wedge.
There is also a global spillover effect. Platforms do not build separate codebases per country. A detection order in Australia becomes the technical baseline for Telegram's global channel infrastructure, or Telegram builds an Australia-specific fork โ which is expensive and creates a precedent every other regulator will cite. The UK Online Safety Act, India's IT Rules, and elements of the EU Digital Services Act all contain variants of the same "reasonable efforts" language. A single Australian judgment defining "reasonable" in technical terms becomes exportable law. Immutability is a feature, not a virtue โ and in this context, the feature that makes Telegram's architecture immutable to compliance signals is precisely what a court will remedy.
Pass Six: Governance, Indictment, and the Missing Board
The deepest deficiency in Telegram's position is not technical. It is organizational.
Telegram is a private company controlled by a single founder. There is no independent board, no public policy function comparable to Western platform peers, no external safety advisory committee, and no office whose title includes the words "responsible" and "regional." The organization that runs one billion people's communications infrastructure is, by design, a one-person decision architecture.
This is not an oversight; it is a worldview. Durov has long argued that platforms should be neutral conduits, that content moderation is censorship, and that any compliance architecture inevitably becomes a surveillance architecture. There is a defensible version of that argument, and I will return to it. But the absence of any governance surface means there is no institutional mechanism to respond to a regulator other than the founder's judgment. When the judgment is "litigate," the entire company litigates. When the judgment is "ignore," the entire company ignores. eSafety's decision to sue rather than negotiate is a direct consequence of facing an organization with no negotiation counterparty.
I have seen this pattern before. In 2017, I spent three weeks auditing an ICO contract and documented a reentrancy vulnerability with fourteen edge cases. The founders shipped anyway, because speed-to-market outranked security. The difference between that project and Telegram is privilege of scale, not logic. The 2024 Paris indictment asked the same question at criminal scale: what happens when a platform is architecturally designed so that the operator cannot see what is happening on it? The Australian suit asks the civil version of that question: what does "reasonable effort" mean for a platform whose engineering posture is to make effort difficult?
A court can order detection systems. It cannot order a governance culture. The observable variable to watch is not the judgment; it is whether Telegram appoints a global content-safety lead and opens an Australian compliance office before the first case-management hearing. If it does, that is an admission of liability in operational form. If it does not, that is adherence to the founder's architectural religion. The blockchain world calls this the immutability dilemma. Immutability is a feature, not a virtue โ it is a virtue only when the unchangeable thing is worth preserving.
What the Privacy Argument Gets Right
Before I am accused of cheerleading for the regulator, let me steelman the other side, because the bulls here have real arguments.
Telegram's encryption posture is not a marketing stunt. For journalists, dissidents, and ordinary users in authoritarian states, Telegram is critical infrastructure. I write this as someone whose sources have relied on encrypted channels to survive arrest, and I do not take lightly any regime that demands platforms weaken encryption to enable detection. "Reasonable efforts" is a standard, not a guarantee. If a court interprets it to require full-content AI analysis of every channel at Telegram's scale, the result is not just fewer terrorist videos; it is extensive false-positive suppression of legitimate political speech. Over-compliance is a censorship tax, and platforms have a documented tendency to over-compensate after a high-profile enforcement action.
There is also a legitimate technical boundary. Perceptual hashing detects known content variants, not novel content. A mandate that effectively requires detection of emerging violent content would require capabilities that have not been industrialized. The boundary of "reasonably available technology" is a real legal question, and Telegram is entitled to litigate it.
The scary precedent sits outside this case. Signal and WhatsApp both run end-to-end encryption, and both are technically incapable of scanning channel content at scale. An adverse judgment defining "reasonable detection" to require server-side scanning of non-E2E broadcast content is survivable for Telegram โ it could fork its architecture. But the same principle, carried one step further, would demand client-side scanning technology on E2E platforms. Every serious security engineer knows that client-side scanning converts a private messenger into a surveillance instrument.
I will add one more nuance. Even a well-designed content detection pipeline at Telegram's scale will generate false positives that silence legitimate criticism of states and armed groups. The journalists and activists who use Telegram as a shield are not collateral damage; they are the point of the architecture. A court balancing "reasonable effort" must somehow preserve that function. The risk is that the technical standard, once written, leaves no room for that balance.
And yet โ the privacy defense only works if applied consistently. Telegram has removed ISIS content on request, cooperated with some authorities, and quietly revised its law-enforcement FAQ after Durov's arrest to say it responds to valid court orders. A posture that cooperates selectively is not a principle. It is a business preference, exactly the kind of preference a court can price into a "reasonable effort" analysis. The platform cannot claim immunity from detection duties in Australia while simultaneously claiming credit for detection capabilities elsewhere.
Takeaway
This case is not about A$38 million. It is about the definition of "reasonable effort" inside an encrypted broadcast architecture โ and that definition will radiate outward to every platform that uses cryptography as a regulatory shield.
My scenario distribution: 60 percent settlement with remediation undertakings; 25 percent eSafety victory on the core detection duty; 15 percent Telegram prevails on a narrow technical construction of "reasonable effort." The 60 percent scenario is not a Telegram defeat in headlines, but it is a victory for the template โ because settlement documents will include the detection obligations that eSafety could not obtain administratively.
The likely terminal state is a court-supervised remediation framework: Telegram deploys hash-matching and perceptual-hash detection on channel content, commits to Australian transparency reporting, and pays a negotiated penalty below the headline figure. Watch for the admission signals: new hires in content safety, an Australian legal representative, and a transparency report with actual numbers.
The deeper point is structural. Telegram built a system where detection was deliberately difficult, then defended the difficulty as a feature. Australia's regulator built a system where difficulty is the contravention. One of those architectures must yield. The ledger remembers what the mempool forgets โ and the mempool, this time, is a billion-person broadcast network without a search function for harm. The court will be asked to decide how much remembering the law requires.
I have audited contracts that drained wallets, NFT projects with phantom liquidity, stablecoins with broken peg algebra, and AI marketplaces built on cached responses. Every system, at some point, meets its true marginal cost. Telegram's bill is now on the table. The rest of the encrypted world should read the ledger before the ledger reads them.