Late June 16, Telegram CEO Pavel Durov alleged on X, formerly Twitter, that “Indian telecom Reliance is sabotaging access to Telegram for millions of users outside India (including the UAE) via a rogue method called BGP hijacking,” and that this “sabotage seems intentional, as Reliance has ignored multiple reports”.

What had happened was in fact a result of an accidental misconfiguration by Reliance Communications, the once-large telecom operator under the Anil Dhirubhai Ambani Group. That misconfiguration briefly caused Telegram outages in several countries, following a government-ordered India-only ban aimed at stopping the spread of exam-related misinformation. While Telegram had challenged the ban in the Delhi High Court, the court upheld the Centre’s ban as legal.

BGP mishap

Reliance Communications largely does not exist anymore and is under an insolvency process, as a part of which some of its assets were acquired by Reliance Jio. However, it continues to hold on to a few assets, including datacentres in Mumbai, and some Internet traffic routes. As such, it is required to continue to comply with blocking orders for websites, so that networks that rely on its bandwidth are in turn compliant.

Jio categorically denied being involved with this incident; Mr. Durov appeared to mistakenly refer to the Reliance Industries subsidiary in his post. “Recent posts on X have led to speculation regarding Reliance Jio Infocomm Limited (AS55836) and a BGP route misconfiguration,” Jio said, using the acronym for autonomous systems, a networking term that distinguishes large networks by assigning a number to them. “We categorically clarify that Jio has not been involved in any such incident. Jio continues to operate its network in accordance with global Internet routing best practices and the highest standards of reliability, security, and transparency.”

But instead of applying this blocking order locally, Reliance Communications “hijacked” Border Gateway Protocol (BGP) routes globally that corresponded with Telegram. BGP is a protocol used by networks to map out efficient routes to other networks, and propagating incorrect information through BGP to external networks can disrupt access to services whose routing information is contained within such information.

Flag, a subsea cable network that was once owned by Reliance Communications and was later spun out as a separate company, likely maintains “open filters,” with the latter, Anurag Bhatia, an Internet networking expert said. “It’s common for networks to open filters completely for large customers with the hope and assumption that those customers will not hijack random prefixes,” Mr. Bhatia said. “There is technology available for filtering, but it’s not widely deployed.”

BGP prefixes are, roughly speaking, IP address blocks that assist in routing. Essentially, Reliance Communications’ announcement was trusted by the next network in line, and led to a situation where any network that trusted Reliance Communications’ BGP announcements carried by Flag would lead people trying to reach Telegram’s servers into Reliance Communication servers, where the connection would end with no result.

Impact, mitigation

The event was resolved in the early hours of June 17, as Reliance Communications appeared to have fixed its configuration. However, by then, Mr. Durov complained that Du, a telecom operator in the United Arab Emirates, where Telegram is headquartered, had ingested the incorrect BGP information, and led to disruptions to the service.

Doug Madory, director of Internet analysis at Kentik, a network intelligence firm, said on X that a similar incident took place when an Iraqi international Internet gateway similarly hijacked Telegram routes.

The workaround to that incident, Mr. Madory said, also prevented even wider damage to Telegram access in other countries this time around. Resource Public Key Infrastructure Route Origin Validation (RPKI ROV), a technology used by large networks to ensure that BGP announcements they receive are legitimate, was able to prevent Reliance’s misconfiguration in time. That is the technology Mr. Bhatia was referring to.

Mr. Madory said that further IP addresses announced by Telegram were also hijacked throughout the night, worsening the issue. Overall, Mr. Madory said, “Only a small share of traffic to Telegram was misdirected but it came from all over the world.”

BGP hijacks have been seen occasionally before. In 2008, Pakistan’s state-owned telecom operator, PTCL, hijacked routes belonging to YouTube, leading to worldwide disruptions, due to this announcement being carried to an international transit provider based in Hong Kong.