Platform Characteristics and Cross-Platform Extremism: A Case Study of Telegram

Author: R.Y. Lazerson

The threat environment is increasingly dynamic and complex[1], due in-part to the diversification of online platforms used by extremist actors.[2] This Deep Dive blog post is part 2 in a series that examines the adoption of alternative platforms within the broader cross-platform operations of extremists and other threat actors. Twelve one-on-one interviews with experts and stakeholders provide the basis of this analysis.[3]

Extremists have increased exploitation of alternative platforms that offer niche capabilities such as encryption and minimal content moderation, using them in tandem with mainstream social media platforms. But why do extremists use multiple platforms? How can researchers visualize an extremist group’s selection of various platforms? What strategies can be effective in countering cross-platform extremist mobilization?

The online extremist’s dilemma and matrix

The Online Extremist’s Dilemma[4] provides a powerful explanation of why extremist groups use multiple online platforms. Extremists must on one hand have a relatively open and public presence to recruit new members, but on the other hand, they must have a more private channel outside of the gaze of law enforcement and platform moderation to operate the group. These two motivations are inherently at odds.[5] Recruitment requires exposure, and operating secretly, by definition, requires secrecy. As a result of this dilemma, an extremist group will typically need to resort to multiple platforms to achieve both objectives at once.

This blog introduces a matrix that can help visualize the Online Extremist’s Dilemma and the need for multiple platforms, see figure 1.

Figure 1 shows why an extremist group would choose to utilize three hypothetical platforms in tandem. If Platform A affords the group a high Ability to Recruit (Y axis) but only affords a low Ability to Operate Secretly (X axis), then the group may compliment Platform A with Platform B, since the latter affords a high ability to operate secretly but low ability to recruit. The extremist group may further supplement their efforts to address the online extremist’s dilemma with hypothetical Platform C, finding that it offers a combination of relatively high ability to recruit and relatively high ability to operate secretly. In practicality, an extremist group may use far more than three platforms to accomplish the group’s diverse recruitment and operations goals.[6] The matrix is a tool that can help visualize the various platforms an extremist group currently uses or may use in the future.

Each platform’s collection of characteristics (e.g., policy, product, and usage) determine the degree the platform affords recruitment and operational security. In other words, a platform’s characteristics determine the platform’s location on the matrix. For example, hypothetical Platform A in figure 1 may have a billion users, thus affording a high ability to recruit, but may also have a policy requiring users to use their real names, thus affording only a low ability to operate secretly. Changes to Platform A’s characteristics can shift its affordances (e.g., if its user base decreases, the degree the platform affords recruitment may also decrease).

Telegram as a case study of a platform’s characteristics

This section uses Telegram as a case study for examining how a platform’s characteristics determine the degree it affords recruitment and operational security.[7] Figure 2 provides an illustrative model for Telegram’s rare combination of relatively high in Ability to Recruit and relatively high in Ability to Operate Secretly. This rare combination can situate the platform as an “Extremists haven,” affording a unique role within extremist cross-platform mobilization, facilitating recruitment and operations on Telegram, and buttressing recruitment and operations on other platforms.

The case study analysis of Telegram’s policy, product, and usage serves multiple purposes:

  1. To illustrate how a given platform’s combination of policy and design decisions provide unique affordances for extremists. The unique affordances from each platform contribute to an extremist group’s selection of platforms used in their cross-platform mobilization.
  2. As an example of one matrix that can help evaluate the design and policy decisions of a platform and estimate its affordances to extremists.
  3. To understand Telegram’s popularity within many extremist groups’ cross platform efforts.
  4. To further illuminate how existent or new platforms may mimic Telegram’s decisions and/or offer novel compelling features that extremists will seek to exploit.[8]
  5. To further illuminate how changes in Telegram’s affordances can lead extremists to seek substitute platforms.[9]

Policy: Hands-off, Anti-government, and Anonymous

Explicitly Minimal Content Moderation

Extremist groups are drawn to Telegram’s explicitly minimal content moderation policies. Whereas Facebook and Twitter, and even mainstream encrypted app, Whatsapp, have specific policies that ban hate, harassment, and disinformation,[10] Telegram’s Terms of Service does not. Telegram’s Terms of Service contain only three short prohibitions:[11]

  1. Use our service to send spam or scam users.
  2. Promote violence on publicly viewable Telegram channels, bots, etc.
  3. Post illegal pornographic content on publicly viewable Telegram channels, bots, etc.

By only prohibiting the promotion of violence on “publicly viewable Telegram channels,” Telegram’s policy connotes that promotion of violence in all other Telegram chat options, such as groups, one-to-one chats, or private channels, is of no concern to the platform. It also implies that extremist content that does not directly promote violence but which is integral for extremist mobilization – including racism, hate, conspiracy theories, and disinformation – are allowed across the platform, even on publicly viewable channels.[12]

Deliberately Anti-Collaboration with Government

Of additional appeal to extremists, Telegram explicitly depicts itself as an extraterritorial savior from governments, spurning collaboration with law enforcement and governments. For example, when describing why it stores encrypted data and decryption keys in servers across different jurisdictions, Telegram proudly states that due “to this structure, we can ensure that no single government or block of like-minded countries can intrude on people’s privacy and freedom of expression.”[13]

Anonymous Identities

Unlike Facebook, for example, Telegram offers users the ability to have anonymous accounts not associated with a real-world identity. Additionally, Telegram also allows users the ability to have multiple accounts on a single device, thus enabling the creation of different online identities. According to an interview respondent,[14] the anonymity and multiple identities that Telegram offers, may serve to embolden extremists to be more uninhibited with their messages and therefore hasten organizing.[15]

Product: Features for Recruitment and Operational Security

In addition to minimal content moderation policies, Telegram offers a number of compelling technical features that can make the platform an ideal selection for extremist actors. This blog highlights a few of the most important product features that arose in analysis of the literature and interviews: 1) varied chat sizes, 2) encryption and self-destructing chats, 3) file-sharing and cloud storage, 4) URL links.

Varied Chat Sizes to Funnel Recruits

Telegram users can create channels for broadcasting to unlimited audiences, groups for conversations up to 200,000 people,[16] or direct chats for one-to-one messaging. Telegram groups are designed for conversations; any group member can post in the group chat.[17] Telegram channels, on the other hand, are specifically designed for the channel admin to share messages with a large audience.[18] Channels and large groups afford vast audiences for extremist recruitment and mobilization, while small groups and one-to-one chats afford coordination of extremist activity without scrutiny. The infinite spectrum of chat sizes offered by Telegram is rare among platforms. For example, the largest group chat size on Signal is 1000[19], thus limiting the possibilities of recruitment on the platform.

The spectrum of chat size options makes Telegram exceptionally useful for vetting and funneling new recruits through increasingly radicalized smaller chats.[20] Large channels or groups can serve as initial contact on the platform with extremist ideologies and groups. Within channels, extremists sometimes use a channel’s discussion tool to vet new recruits[21] before offering links to more secure chats. Group chats can also serve as check-points for extremist groups to identify and remove interlopers.[22] Of particular appeal, Telegram offers chat admins the ability to see who in the chat has not been active, thereby offering the opportunity for extremist groups to more easily identify observers and outside researchers.[23] Some extremist groups may even use multiple layers of smaller group chats, with increasingly radical and emboldened discourse, to funnel and mobilize new recruits.

In many ways Telegram’s spectrum of chat sizes allows extremists to recreate operational security structures typical of organizations in physical spaces. As one analysis of ISIS operations on the platform put it: “Telegram allows extremists to arrange themselves in [group-like] virtual cliques that mirror the structure of their physical counterparts. Enemies are kept at a distance and, if tracked, they get ousted promptly. On the other hand, secluded digital proximity promotes affiliative ties among ISIS sympathizers.”[24]

Figure 4 below models how a “marketing funnel” used by many advertisers can be a helpful tool to depict how Telegram’s spectrum of chat sizes enable extremists to recruit and mobilize individuals within the platform.

Awareness, interest, desire, and action are terms utilized by some advertising professionals to describe the stages of a customer’s interaction with a brand’s product, or service:[25] a) initial awareness; b) interest to conduct further research into the product or service; c) desire for the product or service; d) taking whatever action is sought by the marketing firm e.g., email sign-up, product purchase, etc. The funnel also depicts how not all individuals in each stage move to the next stage – and yet, the lower funnel stages are reliant on greater numbers of individuals in upper funnel stages. The funnel is also cyclical, as depicted by the arrows in the bottom left of Figure 4; lower funnel individuals who have gained desire for the product or have taken an action are then likely to increase awareness and interest in other individuals.

This model is a helpful tool for considering the potency of extremist recruitment on Telegram, in that it affords at least a moderate capacity for each stage of the funnel. Large channels and chats at the upper funnel for building awareness and interest in the extremist group or ideology, and small channels and chats at the lower funnel to establish desire to associate with and act on behalf of the extremist group or ideology.[26] Of course, Telegram is often used alongside other platforms.

Extremists, like advertising professionals, typically utilize multiple platforms to recruit individuals. Some platforms like YouTube and Twitter offer vast audiences for initial awareness, and others like Whatsapp or Signal offer secure chats to interact directly with individuals and mobilize action. However, Telegram’s spectrum of chat sizes, from small to unlimited, along with minimal content moderation, make the platform a particularly valuable funneling tool, since it affords a rare ability to conduct multiple stages of the recruitment funnel with relative impunity. For some extremists who do not need access to billions of people, such as on a platform like YouTube, Telegram may be able to provide the bulk of their recruitment and mobilization. For larger extremist groups and movements that do desire a platform like YouTube for awareness, Telegram can still play an important funneling role within a broader cross-platform recruitment campaign. One interview respondent summed up Telegram’s unique cross-platform role as follows:

Telegram is helpful, because it is subject to less content moderation and regulation than the major players. But it plays a role in the ecosystem of that middle ground, where you can have somewhat of a stable platform to communicate with a medium range of followers. And then from there, they can go and take their Facebook accounts and their Twitter accounts, and make 100 new ones each day and use coded language to get all this stuff from Telegram out to the broader reaching audiences. At the same time, Telegram spins off side conversations between individual groups of extremists who are interested in getting a little bit more operational as well.[27]

Encrypted and Self-Destructing Messages

Notably, Telegram claims that all messages on the platform, including those sent on public channels, are encrypted.[28] This means that only scrambled undecipherable versions of messages are stored on Telegram’s servers. The decryption keys to unscramble the messages are then distributed across multiple locations.[29] Encryption thus affords extremists a level of security even on their larger coordinating chats. Telegram also offers “secret chats,” which take privacy one step further with end-to-end encryption. This means that only the sender and the recipient of the message can access it.[30] Telegram claims that these messages can only be accessed from the devices on which they were sent or received.[31] Telegram also offers end-to-end encrypted voice and video calls. The extra level of security offered by end-to-end encryption provides an impenetrable safe for extremists to lock away their most incendiary and illegal messages.

Telegram also offers two message self-destructing features on secret chats,[32] which address extremists’ concerns[33] that an outsider may access chats if they can retrieve an extremist group member’s device. Feature 1: When a user deletes messages on their side of the conversation, the app on the other side of the secret chat will be ordered to delete the messages as well. Feature 2: A user can order messages, photos, videos, and files to self-destruct in a set amount of time after they have been read or opened by the recipient. The message will then disappear from both the sender and recipient’s devices.

Telegram’s encryption can help assuage the understandable privacy concerns of the average user. However, it is also crucial to examine how the aggregate characteristics of encryption + other discussed appealing features + minimal content moderation, collectively make the platform ideal for exploitation by extremists with relative impunity.

File Sharing and Cloud Storage

Telegram offers unlimited cloud storage[34] enabling extremist groups the ability to build repositories of content on the platform, without storing incriminating material on their own devices. Telegram operates its own cloud storage rather than relying on an outside storage provider such as Microsoft or Amazon. White supremacist groups have dedicated channels containing literature, writings, music and other media from past and present white supremacist figures stored on Telegram to serve as a resource for ideological recruitment and mobilization.[35] Similarly, an assessment of far-right OPSEC (operational-security) practices, highlighted the existence of Telegram channels focused “primarily on promoting digital and physical security practices.”[36]

URL Links

Of appeal to extremist recruitment, public channels and groups on Telegram have their own URL links. Rather than having to manually invite each user, extremists can simply share a link to their Telegram channel or group on another platform (e.g., in a YouTube comments section or in a Twitter post). Additionally, in anticipation of bans from mainstream platforms, extremist groups share and post the URL links to their Telegram group or channel for their followers to join as a backup.[37]

Usage: Significant, Broad, Easy, and Free

For continued recruitment and operations, extremist groups are drawn to Telegram’s high usage among the public. The rule of network effects means that this draw continues to grow as the platform’s usage grows. Globally, Telegram now has more than 700 million active monthly users,[38] which constitutes a massive population to share propaganda with. Importantly, the platform is significantly used by numerous extremist groups and ideologies. This allows more extreme ideas to cross-pollinate between groups on Telegram, organically and intentionally. For example, posts originating from the Telegram channel of the Western Chauvenists’ – a Proud Boys offshoot that embraces overt white supremacist ideas – were found to be shared in other Proud Boys channels.[39] This suggests that individuals in “regular” Proud Boys chapters may be interacting on Telegram with the more radical ideas espoused by the Western Chauvinists offshoot. Similarly, Telegram contains massive anti-vax channels where links to more extreme conspiracies can be found circulating.[40]

Ease of use and interface familiarity are also determining factors in extremist use of Telegram, as well as in their exploration of substitute messaging applications,[41] should Telegram strengthen its content moderation or change other features that they rely on. Additionally, Telegram is free for users, making it particularly appealing for use by the general public, and by extremists. The impact of Telegram’s adoption of a premium service[42] that offers extra features is a needed point of research.

Platform Characteristics at the Aggregate Determine Affordances

Importantly, it is the aggregate of Telegram’s characteristics noted in this blog that make the platform particularly appealing to extremists. In other words, if the platform were to change one or more characteristics it can shift the degree it affords recruitment and operational security. For example, if Telegram were to strengthen content moderation or introduce a cap on group size, affordances may be reduced. Similarly, if the platform introduced a new characteristic, e.g., default end-to-end encryption, this could increase its affordances.

The same is true of other platforms. For example, when Signal enabled URL links,[43] which allows anyone to click on the link to join a group chat, the platform may have inadvertently significantly increased the degree it affords recruitment. Although Signal previously offered desirable features, e.g., end-to-end encryption, it may be the introduction of URL links that lifted the platform at the aggregate characteristics level into a desirable tool in extremist cross-platform mobilization. Similarly, were the platform to remove the 1000 limit on group chat size, this could further enhance the platform’s appeal to extremists.

Different Matrixes for Different Groups

A platform’s location on the extremist’s dilemma matrix depends on the context of each extremist group. In other words, the same platform can afford one extremist group with higher abilities than another group. An assessment of a platform’s characteristics should take into account the context (e.g., language, ideology, location, goals) of the extremist group under consideration. Using examples for language and ideology, Figure X uses two hypothetical extremist groups to visualize how the same platforms may provide distinct affordances to different extremist groups.

Language: How effective the platform is at moderating a language used by the extremist group. For example, Facebook is still more successful at detecting extremist content in some languages, such as English, than in many other languages.[44] If hypothetical extremist Group A in figure X primarily recruits in English, Facebook may provide a relatively low ability to recruit, since English-language extremism is identified and removed at a greater rate by Facebook. If Extremist Group B primarily recruits in a language where Facebook’s detection is weaker then Facebook would afford a higher ability to recruit.

Ideology: How strong a given platform’s ability to assess nuanced terminology of one extremist ideology over another, or how willing a platform is to remove content from one ideology over another would impact its affordances to different extremist ideologies. For example, research suggests that Telegram has removed ISIS related content more consistently than far-right related extremists or non-ISIS jihadist extremist groups.[45] If hypothetical Group A is far-right related, Telegram may enable a higher ability to recruit and operate, and if Group B is ISIS-related Telegram may enable a lower ability to recruit and operate secretly.

At a high level, we can see that Group A ‘s matrix suggests the group is in greater need to find substitute platforms to recruit, and Group B is in greater need of substitutes to operate secretly.[46]

Moving toward a characteristics and cross-platform lens

Due to the extremist’s dilemma there is a need for counter-extremism efforts to further increase adoption of a cross-platform lens that accounts for the policy, product, and usage characteristics that extremists exploit across platforms.[47]

Each platform should increase examination of how their features are being used within a cross-platform extremist web, for example recruitment via URL links that link to alternative platforms. Product designers, and policy teams should proactively assess how new features will be exploited by extremists: How will this change in a feature or policy increase or decrease the ability to recruit or operate secretly on the platform? How will the feature or policy change impact the use of this platform in tandem with other platforms? Does the impact differ depending on the context of each extremist group?

Platforms rely on many technologies to function, including user-facing services (e.g., app stores, devices, operating systems, and telecommunications carriers) and more behind-the-scenes services, s(e.g., web hosting, DDoS mitigation services, proxy servers, and data centers). These other technologies in the stack also have a responsibility to assess how their technologies’ characteristics are exploited to support extremist cross-platform mobilization.

Researchers should increase examination of extremism and disinformation from a cross-platform lens and assess the characteristics across platforms that appeal to extremists. The online extremist’s dilemma and matrix are one set of helpful tools to consider and visualize extremist cross-platform mobilization.

The next deep dive in this series will examine gaps in current research related to cross-platform mobilization.

  1. “National Terrorism Advisory System Bulletin – June 7, 2022 | Homeland Security,” U.S. Department of Homeland Security, June 7, 2022,
  2. Erin Saltman, “Challenges in Combating Terrorism and Extremism Online,” Lawfare, July 11, 2021,
  3. Interview respondents include senior academics with subject-matter expertise, think-tank specialists on extremism and disinformation, investigative researchers who focus on alternative platforms, government counter-disinformation practitioners, encryption technologists, tech employees, and other experts. Respondents have been anonymized in this blog.
  4. Bennett Clifford and Helen Christy Powell, “De-Platforming and the Online Extremist’s Dilemma,” Lawfare, June 6, 2019, Clifford and Powell describe the dilemma as: “online extremists are forced to balance public outreach and operational security in choosing which digital tools to utilize.”
  5. Ibid.
  6. For example, recruiting from different demographics.
  7. Clifford, B. & Powell, H., (2019). “De-platforming and the Online Extremist’s Dilemma” first noted how Telegram’s variety of chat sizes can help address the so-called extremist’s dilemma, a concept inspired by Jacob N. Shapiro’s book, The Terrorist’s Dilemma: Managing Violent Covert Organizations. Clifford’s subsequent work, “Migration Moments” dives into other features that make Telegram appealing to extremist groups. This section of the blog builds on Clifford and other literature that highlight appealing Telegram features, and synthesizes that material with feedback from multi-sector respondents interviewed by the author. Bennett Clifford, “Migration Moments: Extremist Adoption of Text‑Based Instant Messaging Applications” (GNET, 2020),
  8. Building on previous work in Clifford, “Migration Moments: Extremist Adoption of Text‑Based Instant Messaging Applications.”
  9. Building on previous work in Clifford, “Migration Moments: Extremist Adoption of Text‑Based Instant Messaging Applications.”
  10. WhatsApp’s Terms of Service (accessed April 30, 2022) refer to this as use that “involve publishing falsehoods, misrepresentations, or misleading statements”
  11. “Terms of Service,” Telegram, accessed October 7, 2022,
  12. Indeed, as described in the first blog in this Deep Dive series, Telegram contains easily accessible public channels that explicitly share such content.
  13. “Telegram FAQ,” Telegram, accessed October 7, 2022,
  14. Interview respondent, interview by author.
  15. Two interview respondents also noted that anonymity is a double-edged sword for extremists since it can be hard to be certain that the user someone is messaging is actually a member of the extremist group and not an outside researcher or law enforcement. From a security studies perspective the lesson is meaningful, by driving an organization to increase operational security practices (e.g., use of anonymity) it decreases their ability to organize efficiently. This is a dilemma closely related with the aforementioned extremist’s dilemma.
  16. “Telegram FAQ.”
  17. Khamosh Pathak, “How to Find and Join Telegram Channels,” HowToGeek, February 12, 2021,
  18. Pathak, K. (2021). However, there is also the option to add discussion groups to channels, which enable channel subscribers to comment and converse.
  19. “Group Chats,” Signal Support, accessed October 7, 2022,
  20. Interview respondent, interview by author.
  21. Interview respondent, interview by author.
  22. Daniele Valentini, Anna Maria Lorusso, and Achim Stephan, “Onlife Extremism: Dynamic Integration of Digital and Physical Spaces in Radicalization,” Frontiers in Psychology 11 (March 24, 2020),
  23. Ibid.
  24. Ibid.
  25. Annmarie Hanlon, “The AIDA Model,” Smart Insights, March 8, 2022,
  26. See also Wood, G. (2016) The Way of the Strangers: Encounters with the Islamic State. for a broader discussion on ISIS recruitment, including the group’s method of showing beheading videos to potential recruits as a desensitizing mechanism and as a tool to assess recruitment potential.
  27. Interview respondent, interview by author.
  28. “Telegram FAQ,” Telegram, accessed October 7, 2022,
  29. Ibid.
  30. On Signal, all messages, including group chats, are end-to-end encrypted. Anthony Spadafora, “Signal vs. Telegram: Which Encrypted Messaging App Wins?,” Tom’s Guide, September 2022,
  31. “Telegram FAQ.”
  32. Ibid.
  33. As the Telegram FAQ notes: “All secret chats in Telegram are device-specific and are not part of the Telegram cloud. This means you can only access messages in a secret chat from their device of origin. They are safe for as long as your device is safe in your pocket.”
  34. Telegram Messenger [@telegram], “Telegram Users Have Unlimited Cloud Storage…,” Tweet, Twitter, June 23, 2021,
  35. Interview respondent, interview by author.
  36. Michael Loadenthal, “Evolving Digital OPSEC Practices Amongst Far-Right Networks,” GNET, June 4, 2020,
  37. URL links also open opportunities for countermeasures, such as link analysis or blocking links from particular sources.
  38. Manish Singh, “Telegram Tops 700 Million Users, Launches Premium Tier | TechCrunch,” TechCrunch, June 19, 2022,
  39. Interview respondent, interview by author.
  40. Interview respondent, interview by author.
  41. Clifford, “Migration Moments: Extremist Adoption of Text‑Based Instant Messaging Applications.”
  42. Manish Singh, “Telegram Tops 700 Million Users, Launches Premium Tier | TechCrunch,” TechCrunch, June 19, 2022,
  43. Casey Newton, “Warning Signal: The Messaging App’s New Features Are Causing Internal Turmoil – The Verge,” 1/26/21, accessed October 9, 2022,
  44. Isabel Debre and Fares Akram, “Facebook’s Language Gaps Weaken Screening of Hate, Terrorism,” AP NEWS, October 25, 2021,
  45. Clifford, “Migration Moments: Extremist Adoption of Text‑Based Instant Messaging Applications.” p.6 and p.22
  46. Clifford writes: Different groups of extremists will likely transition away from Telegram at different times, as they currently face disparate competition on the platform. The measures in effect against extremists on Telegram from the company and governments, from content and account takedowns to monitoring efforts, largely focus on IS supporters. Meanwhile, supporters of other extremist groups, including far‑right extremists and other jihadist groups, face limited contestation and therefore less incentive to move away from the platform. For this reason, IS supporters will likely continue to drive efforts to experiment with emergent instant messaging platforms as wholesale alternatives to Telegram. However, if Telegram begins substantial crackdowns on other types of extremist activity on its platform, a wider range of jihadists and extreme right‑wing groups may follow suit.” Clifford, B., (2020). “Migration Moments: Extremist Adoption of Text‑Based Instant Messaging Applications” p.22. Or as researcher Tore Refslund Hamming noted: “Finding Islamic State and al-Qaida Telegram channels is quite a hassle. Believe me, I’m doing it a lot. Yet finding right-wing extremist channels is surprisingly easy.” Tore Refslund Hamming, (2022). Twitter. This may signal that ISIS is less likely to use Telegram for wide-scale upper-funnel recruitment and instead use the app primarily lower-funnel recruitment (see figure 4) and for operational security; using private channels, groups, and one-to-one chats rather than public channels.
  47. For in-depth detail on how policymakers can incorporate a features-centric lens see Section 5, “Recommendations: Towards a Features Centric Approach to Online Extremism” in Bennett Clifford, “Migration Moments: Extremist Adoption of Text‑Based Instant Messaging Applications” (GNET, 2020),