Skip to main content
Geopolitics & DefenseGovernment & Policy

Telegram Exposes India's Internet Routing Risks in Dispute Over Exam Fraud

Network operations center with a large map in the background, showing global internet connectivity.

"Reliance is sabotaging our ability to serve people outside India," Telegram CEO Pavel Durov wrote, accusing an Indian telecom of disrupting access for users as far away as the UAE.

What New Delhi ordered and Telegram's legal response

On June 16, India's Ministry of Electronics and Information Technology invoked Section 69A of the IT Act to restrict access to Telegram nationwide until June 22, following a recommendation from the National Testing Agency (NTA). A separate order requires Telegram to disable its message-editing feature in India until June 30. Telegram moved the Delhi High Court to challenge the ban, and the court agreed to hear the matter urgently today.

The routing fallout: AS18101, FLAG Telecom (AS15412), and a leaked route

Public routing data and independent analysis show the disruption extended beyond India. Durov alleged that Reliance was using Border Gateway Protocol (BGP) hijacking to interfere with Telegram access outside India. BGP hijacks occur when a network announces ownership of IP address ranges it does not control, redirecting or dropping traffic for the real owner.

Network observers reported that AS18101 began announcing Telegram IP prefixes around the time the domestic block went live. Doug Madory, Director of Internet Analysis at Kentik, confirmed AS18101 hijacked Telegram's routes, and noted that RPKI route-origin validation and filtering limited how far the erroneous route propagated. Network researcher Anurag Bhatia independently verified the hijack against public routing data.

Technology policy researcher Pranesh Prakash traced mechanics in a thread: the route leaked to the global internet via FLAG Telecom (AS15412), a former RCom-owned transit provider that failed to drop an RPKI-invalid announcement. Prakash interpreted the incident as a domestic block misconfigured into a global leak, not evidence of deliberate sabotage; Madory and Bhatia reached similar conclusions by comparing it to a 2023 case where a domestic cut also leaked routes outward. The routing anomaly is documented; the intent and the identity of who triggered it remain unresolved.

Why India restricted Telegram: the NEET leak and the NTA's rationale

The NTA linked its direction to leaks around the National Eligibility-cum-Entrance Test (NEET), India's largest medical entrance exam. Question papers were allegedly leaked before the May 3 exam through a paid WhatsApp group and coaching-centre networks in Rajasthan; the exam was cancelled on May 12 and a re-test scheduled for June 21. The Central Bureau of Investigation (CBI) took over the probe and made multiple arrests, including NTA-appointed subject experts and coaching figures.

The NTA says cheating networks used Telegram channels, groups and bots to sell access to exam material and spread misinformation, and that channel administrators abused the edit feature to backdate posts and pass off altered timestamps as proof of a prior leak. The agency called the ban a "last resort" after channel-by-channel takedowns failed to stop the fraud. Telegram counters that it removed hundreds of channels sharing leaked material and that a platform-wide ban punishes the many for the actions of a few.

Internet Freedom Foundation and the proportionality debate

Digital rights group the Internet Freedom Foundation (IFF) called the ban disproportionate and "constitutionally incompatible," arguing the directions exceed what Section 69A and the blocking rules permit. The IFF described a nationwide block on a service used by more than 150 million people to address fraud committed by a handful as failing a proportionality test. The group also criticized the opacity of Section 69A: blocking orders are routinely issued without public reasons and the list of blocked sites is not disclosed.

The article cites the Daily Mail as an example of a site quietly inaccessible across Indian ISPs since 2022, returning DNS resolution errors with no stated reason; that case sits among thousands blocked under the same provision without public explanation.

How users can restore access now: Telegram's MTProto proxy

Telegram includes a built-in proxy feature, MTProto (also called MTProxy), designed to route traffic around network-level censorship by obfuscating traffic and forwarding it through an intermediary node. The traffic remains end-to-end encrypted; the proxy operator cannot read messages or identify the account, though they can see the connecting IP address. Public proxy lists exist — for example, StormyCloud runs a free MTProto proxy and the SoliSpirit project on GitHub publishes a list of verified proxies refreshed automatically every 12 hours. The story cautions: only use proxies from a source you trust, and layering a trusted VPN on top closes the residual metadata risk.

To set up an MTProto proxy on desktop:

  • Open Settings, select Advanced.
  • Under Data and storage, click Connection type at the top of the panel.
  • In Proxy settings, select Use custom proxy, then click Add proxy.
  • Enter the MTProto server, port and secret from your chosen proxy source; once saved, the proxy shows as online and Telegram routes through it.

On mobile: Settings > Data and Storage > Proxy (iOS) or Settings > Data and Storage > Proxy Settings (Android), then Add Proxy > MTProto and enter the same server, port and secret.

What this means for NEET aspirants, network operators, and policymakers

NEET aspirants: Thousands relied on Telegram for free and paid study material; the ban has locked many out of notes and groups the students used to prepare. For them, MTProto proxies offer a technical workaround but carry trust and privacy trade-offs.

Network operators and engineers: The incident underscores the operational danger of misconfigured BGP announcements and the role of RPKI validation in limiting damage; the path the leak took — via FLAG Telecom (AS15412) — will be of particular interest to routing teams reviewing filtering and transit policies.

Policymakers and regulators: The pause is framed as a law-enforcement response to exam fraud, but legal and procedural objections from civil-society groups highlight tensions between swift intervention and proportionality, transparency, and collateral harm to legitimate users.

The routing anomaly is established and the legal dispute is active; what remains open is intention. For now the ban is set to lift on June 22 and the editing restriction runs to June 30, while Telegram seeks a court ruling that could change those dates. Until then, affected users have a documented technical path back into the service — and a set of unanswered institutional questions about how a domestic action leaked onto the global routing table.

Original story