Culture WIRED: Neo-Nazis Are Fleeing Telegram for Encrypted App SimpleX Chat - Wired writes yet another blatant hit piece


David Gilbert
Politics
Oct 4, 2024 6:00 AM

Neo-Nazis Are Fleeing Telegram for Encrypted App SimpleX Chat​

Neo-Nazis are joining SimpleX Chat, a relatively unknown app that received funding from Jack Dorsey and promises users there is no way for it or law enforcement to track their identity.

Dozens of neo-Nazis are fleeing Telegram and moving to a relatively unknown secret chat app that has received funding from Twitter founder Jack Dorsey.

In a report from the Institute for Strategic Dialogue published on Friday morning, researchers found that in the wake of the arrest of Telegram founder Pavel Durov and charges against leaders of the so-called Terrorgram Collective, dozens of extremist groups have moved to the app SimpleX Chat in recent weeks over fears that Telegram’s privacy policies expose them to being arrested. The Terrorgram Collective is a neo-Nazi propaganda network that calls for acolytes to target government officials, attack power stations, and murder people of color.

While ISD stopped short of naming SimpleX in its report, the researchers point out that the app promotes itself as “having a different burner email or phone for each contact, and no hassle to manage them.” This is exactly how SimpleX refers to itself on its website.

Last month, one accelerationist group linked to the now defunct neo-Nazi terrorist group Atomwaffen Division, with more than 13,000 subscribers on Telegram, began migrating to SimpleX. Administrators of the channel advised subscribers that “while it's not as smooth as Telegram, it appears to be miles ahead with regard to privacy and security.”

The group now has 1,000 members on SimpleX and, according to ISD, is “part of a wider network built by neo-Nazi accelerationists that consists of nearly 30 channels and group chats,” which includes other well-known accelerationist groups like the Base. Accelerationists seek to speed up the downfall of Western society by triggering a race war in order to rebuild civilization based on their own white Christian values.

The network of groups on SimpleX are also sharing extremist content, including al-Qaeda training manuals, Hamas rocket development guides, neo-Nazi accelerationist handbooks, and militant anarchist literature. And in their newly secure channels on SimpleX, the members of the groups have immediately made direct calls for violence.

“During a 24-hour period on September 25, analysts observed three instances of users calling for the assassination of Vice President Kamala Harris, and one instance calling for the assassination of former President Donald Trump,” the ISD researchers wrote. “Similarly, numerous users called for a race war that would hasten the fall of society, allow them to take the US by force, and institute their desired system of white supremacy.”

SimpleX Chat is an app that was founded by UK-based developer Evgeny Poberezkin. It was initially launched in 2021, and a blog post in August announced that it had passed 100,000 downloads on Google’s Play store. The same blog post announced that Dorsey had led a $1.3 million investment round, having previously praised the app on other social media platforms. Dorsey did not reply to a request for comment.

Poberezkin told WIRED that he was unaware of the migration of neo-Nazi groups to his platform, but says he believes that despite his network’s focus on privacy, SimpleX can curb the spread of terrorist or abusive material on its app.

“Even in these early days we already did more to prevent distribution of [child sexual abuse material] via the preset servers included in the app than many other platforms did, even though they have much more control,” Poberezkin says. “While we cannot indiscriminately scan all content, and it would have been a human rights violation to do so, if the group entry point is publicly promoted and can be joined, and it uses the servers that we operate, we can remove these entry points and the files from the servers. A very important quality of the SimpleX network is that users cannot be approached unless they want to be. It protects the users from any hostile actors and unwanted promotions.”

In February of this year, the European Court of Human Rights ruled that forcing encrypted messaging apps to provide a backdoor to law enforcement was illegal, a decision that undermined the EU’s plan to force encrypted messaging apps to scan all user content for identifiers of child sexual abuse material.

For years, neo-Nazi groups have flourished on Telegram, many of them under the assumption that Telegram was a fully encrypted platform that provided a greater level of security than it really did. Telegram was used by these groups for building out their networks, sharing propaganda, and planning attacks. However, two of the leaders of the Terrorgram Collective were arrested and charged last month, which was a key factor in triggering the migration to SimpleX, the ISD analysts wrote. The group used Telegram to encourage acts of terrorism in the US and overseas.

“For terrorists and violent extremists looking to avoid detection, SimpleX Chat provides significant advantages over Telegram, largely due to its design and features that prioritize privacy and anonymity,” Marc-André Argentino, a senior research fellow at the Accelerationism Research Consortium, wrote last month in an analysis also discussing the migration of extremists from Telegram to the new platform. “SimpleX offers end-to-end encryption by default for all messages, whereas Telegram only encrypts conversations in its ‘secret chats.’”

Poberezkin says that SimpleX is “100 percent private by design” and that even if he wanted to, he couldn’t access information about user IP addresses. Another key privacy aspect of the app is that, unlike most other encrypted chat apps, SimpleX does not require users to enter a phone number or email to register for an account—removing one of the key ways that law enforcement can track down users on other platforms.

“SimpleX, at its core, is designed to be truly distributed with no central server. This allows for enormous scalability at low cost, and also makes it virtually impossible to snoop on the network graph,” Poberezkin wrote in a company blog post published in 2022.

SimpleX’s policies expressly prohibit “sending illegal communications” and outline how SimpleX will remove such content if it is discovered. Much of the content that these terrorist groups have shared on Telegram—and are already resharing on SimpleX—has been deemed illegal in the UK, Canada, and Europe.

Argentino wrote in his analysis that discussion about moving from Telegram to platforms with better security measures began in June, with discussion of SimpleX as an option taking place in July among a number of extremist groups. Though it wasn’t until September, and the Terrorgram arrests, that the decision was made to migrate to SimpleX, the groups are already establishing themselves on the new platform.

“The groups that have migrated are already populating the platform with legacy material such as Terrorgram manuals and are actively recruiting propagandists, hackers, and graphic designers, among other desired personnel,” the ISD researchers wrote.

However, there are some downsides to the additional security provided by SimpleX, such as the fact that it is not as easy for these groups to network and therefore grow, and disseminating propaganda faces similar restrictions.

“While there is newfound enthusiasm over the migration, it remains unclear if the platform will become a central organizing hub,” ISD researchers wrote.

And Poberezkin believes that the current limitations of his technology will mean these groups will eventually abandon SImpleX.

“SimpleX is a communication network, rather than a service or a platform, where users can host their own servers, like in Open Web, so we were not aware that extremists have been using it,” says Poberezkin. “We never designed groups to be usable for more than 50 users and we’ve been really surprised to see them growing to the current sizes despite limited usability and performance. We do not think it is technically possible to create a social network of a meaningful size in the SimpleX network.”

Updated 10-4-2024 12:25 pm BST: The story was updated with responses from Evgeny Poberezkin to questions from WIRED.
 
Bet he didn't want to create a Nazi messaging app, he just wanted to use Haskell for something.

Security through small community. Haskell is shockingly easy to write unreadable spaghetti in. Nightmare for the Chinese.

A KF group would be nice.

Apparently if you want to get real crazy you can host your own server, even on tor:

Even has the ability to write bots with it:

The sex appeal of the CLI was calling me and then I saw the section about WebRTC with SMP. There's no way to privacyproof WebRTC short of moving it and your community off clearnet and over to I2P/YggDrasil where the IPv6 routing is a nightmare or impossible to rewind.

This thing has an attack surface, just a different one.

Making a high privacy comms platform but still keep the use/maintenance of a Fisher-Price app so that skinheads who can barely work their car radios can use it is proving to be a Sisyphean task.

(on non-clearnet nets)...

The creator of Yggdrasil had put out an idea/brainchild that you can take a platform like Matrix and convert it to zero-trust (no server trusting) but then also move to a public VPN (which is what I2P and Yggdrasil are), and get closer to the point of "just add water" privacy comms.

In essence the hitchpoint is the VPN mesh and the nodes on it, and the actual com server nodes that then sit on top of that. Breaking the traceability back to clearnet gets you to full privacy, but there's no way to do a public VPN mesh without having trusted root nodes. So, you need an untrusted server network sitting on top of a trusted virtual network, that then finally hides the show-your-ass public hardware network.
 
Last edited:
The sex appeal of the CLI was calling me and then I saw the section about WebRTC with SMP. There's no way to privacyproof WebRTC short of moving it and your community off clearnet and over to I2P/YggDrasil where the IPv6 routing is a nightmare or impossible to rewind.

This thing has an attack surface, just a different one.

Making a high privacy comms platform but still keep the use/maintenance of a Fisher-Price app so that skinheads who can barely work their car radios can use it is proving to be a Sisyphean task.
SMP is only for the messages, and WebRTC is only for audio/video calls. Group owners can disable audio and video messages through the group, and you can disable it in your own settings. The question is probably will it still connect to the WebRTC server even if you disable the setting? That would probably be my big concern but if you are using the CLI would it even include that since you can't do that via CLI?

I wouldn't put it past the "fisher-price" skin heads to roll defaults and get fucked that way, or law enforcement sets up their own server for the group and pulls information that way.

I still think there is plenty of ability to make it off the clearnet, at least if you are only using it for messages.
 
SMP is only for the messages, and WebRTC is only for audio/video calls. Group owners can disable audio and video messages through the group, and you can disable it in your own settings. The question is probably will it still connect to the WebRTC server even if you disable the setting? That would probably be my big concern but if you are using the CLI would it even include that since you can't do that via CLI?

I wouldn't put it past the "fisher-price" skin heads to roll defaults and get fucked that way, or law enforcement sets up their own server for the group and pulls information that way.

I still think there is plenty of ability to make it off the clearnet, at least if you are only using it for messages.
you can frustrate an attacker/fed by not homing the STUN/TURN servers and make that rando on each group call that's started, SSL-only of course. that would force an attacker/fed into in-the-moment espionage, at least. you'd then also need to avoid cheapening out (using SIP) and write your own presence/activity layer to relay that information, because you don't want knowledge of a call starting or when people are on to be discoverable information.

same as what they have to do now with I2P websites.

edit: thanks to PaaS and IaaS tools the work of hydrating/rotating rando STUN/TURN points is easier, and if you're willing to code in Haskell I'd argue it would be worth the effort to homegrow your own STUN/TURN implementation just for the sake of making that more transportable, so that you can then make that infrastructure look pretty close to a separate P2P network with the peer nodes having no clue what conversations they're hosting or what's going on (you can add your own token exchange on top of STUN so server-eavesdropping is neutralized)
 
Last edited:
ohhh sick idea just came into my head. iOS/Android drop-in WebRTC library but it connects to yggdrasil first using a homing list from the yggdrasil research network, then pulls from gitea a list of POPs for STUN/TURN, and a separate unlisted set of yggdrasil alternate peers. it works through a list of reliable yggdrasil peers to get on the network, then works through the second set of STUN/TURN inside that network to get a candidate list

all this negotiation will likely solve before your user GUI gets to the point where the user can ask to start a call.

what would be needed for browser is a plugin to do this same thing, and the requisite sexy graphics so users understand the "telephone switchboard" set up going on to build the equivalent of a Tor route.

the browser APIs let you supply your own stream sinks for audio, so you can add another direct implementation of RTP voice over yggdrasil, via the browser plugin, without STUN/TURN.
 
Wired’s Attack on Privacy
SimpleX Blog (archive.ph)
By SimpleX Staff
2024-10-16
20241016-wired-privacy.jpg

The Wired article by David Gilbert focusing on neo-Nazis moving to SimpleX Chat following the Telegram's changes in privacy policy is biased and misleading. By cherry-picking information from the report by the Institute for Strategic Dialogue (ISD), Wired fails to mention that SimpleX network design prioritizes privacy in order to protect human rights defenders, journalists, and everyday users who value their privacy — many people feel safer using SimpleX than non-private apps, being protected from strangers contacting them.

Yes, privacy-focused SimpleX network offers encryption and anonymity — that’s the point. To paint this as problematic solely because of who may use such apps misses the broader, critical context.

SimpleX’s true strength lies in protection of users' metadata, which can reveal sensitive information about who is communicating, when, and how often. SimpleX protocols are designed to minimize metadata collection. For countless people, especially vulnerable groups, these features can be life-saving. Wired article ignores these essential protections, and overlooks the positive aspects of having such a unique design, as noted in the publication which they link to:

“SimpleX also has a significant advantage when it comes to protecting metadata — the information that can reveal who you’re talking to, when, and how often. SimpleX is designed with privacy at its core, minimizing the amount of metadata collected and ensuring that any temporary data necessary for functionality is not retained or linked to identifiable users.”

Both publications referenced by Wired also explore how SimpleX design actually hinders extremist groups from spreading propaganda or building large networks. SimpleX design restricts message visibility and file retention, making it far from ideal for those looking to coordinate large networks. Yet these important qualities are ignored by Wired in favor of fear-mongering about encryption — an argument we've seen before when apps like Signal faced similar treatment. Ironically, Wired just a month earlier encouraged its readers to adopt encrypted messaging apps, making its current stance even more contradictory.

The vilification of apps that offer critically important privacy, anonymity, and encryption must stop. That a small share of users may abuse these tools doesn’t justify broad criticism. Additionally, the lobbying for client-side scanning, which Wired’s article seems to indirectly endorse, is not only dangerous but goes against fundamental principles of free speech and personal security. We strongly oppose the use of private communications for any kind of monitoring, including AI training, which would undermine the very trust encryption is designed to build.

It’s alarming to see Wired not only criticize SimpleX for its strong privacy protections but also subtly blame the European Court of Human Rights for upholding basic human rights by rejecting laws that would force encrypted apps to scan and hand over private messages before encryption. Wired writes:

…European Court of Human Rights decision in February of this year ruled that forcing encrypted messaging apps to provide a backdoor to law enforcement was illegal. This decision undermined the EU’s controversial proposal that would potentially force encrypted messaging apps to scan all user content for identifiers of child sexual abuse material.

This commentary is both inappropriate and misguided — it plays into the hands of anti-privacy lobbyists attempting to criminalize access to private communications. Framing privacy and anonymity as tools for criminals ignores the reality that these protections are essential for millions of legitimate users, from activists to journalists, to ordinary citizens. Client-side scanning can't have any meaningful effect on reducing CSAM distribution, instead resulting in increase of crime and abuse when criminals get access to this data.

We need to correct this narrative. The real danger lies not in protecting communication, but in failing to do so. Privacy apps like SimpleX are crucial, not just for those resisting mass surveillance, but for everyone who values the right to communicate without fear of their conversations being monitored or misused. This is a right we must defend and incorporate into law, as we wrote before.

Wired could have stood on the right side of this battle and helped normalize the demand for privacy, genuinely protecting people from criminals and from the exploitation of the increasingly AI-enabled mass surveillance. Instead they chose the path of spreading fear and uncertainty of encrypted messaging and tools that enable privacy and anonymity.

Spreading misinformation about privacy and security undermines trust in the tools that protect us, making it easier to justify more invasive surveillance measures that chip away at our civil liberties.

Wired did not respond to our request for comment.
 
Back