Unlike regular messages, secret chats are not cloud-based and can only be accessed on the device used. Encryption keys are also exchanged when a secret chat is initiated, therefore securing the messages sent. Messages in these secret chats can also be deleted at any time, and can be set to “self-destruct” after a set time.

Why is Telegram in the spotlight in Hong Kong?

The messaging app became one of Hong Kong’s most downloaded apps this week, according to App Annie, amid large-scale protests in the city as hundreds of thousands protested against Hong Kong’s proposed extradition bill with China.

On Wednesday, thousands of protesters gathered outside the city’s legislature and administrative headquarters to protest the proposed bill, calling for Chief Executive Carrie Lam Cheng Yuet-ngor to shelve the plan altogether. The protests forced legislators to delay a legislative debate of the bill that initially could have been set to pass next Thursday.

From social media to encrypted messaging: tech’s changing role in protests

Many of these protesters used the Telegram app to form groups, to provide updates, exchange details on how and where they should protest, as well as request additional supplies. Some of the groups had tens of thousands of members.

However, on the day of the protests, Telegram told its users that it suffered a distributed denial of service (DDoS) attack, where its servers were overloaded with “garbage requests”, causing connection issues for certain users.

Most of the IP addresses executing the attacks came “mostly from China”, chief executive Pavel Durov wrote on Twitter.

“IP addresses coming mostly from China. Historically, all state actor-sized DDoS (200-400 Gb/s of junk) we experienced coincided in time with protests in Hong Kong (coordinated on @telegram). This case was not an exception,” Durov wrote.

If Telegram chats are secure, how come authorities could identify and arrest the administrator of a Telegram group?

While there is a common perception that Telegram is a secure messaging app, not all messages have more secure ‘end-to-end’ encryption by default. Only secret chats in Telegram have this encryption by default while group chat messages do not. That means that group communications on Telegram are less secure than secret chats.

Ivan Ip, the administrator of a Telegram group in Hong Kong, was arrested for conspiracy to commit a public nuisance after police turned up at his home on Tuesday night.

The basis of the allegations against Ip, who is in his 20s and managed a conversation involving 30,000 members, is that he plotted with others to charge the Legislative Council Complex and block neighbouring roads.

What other apps are secure?

Theoretically, many messaging apps like WhatsApp, Telegram and Signal offer end-to-end encryption options.

China kills nine messaging apps for peddling pornography

However, while end-to-end encryption only ensures that others are not able to access the contents of your conversation, each message sent leaves behind a digital footprint called metadata. This metadata information reveals the sender and recipient of each encrypted message, as well as when it was sent. So while the exact contents are encrypted, it is still possible for others to see who a user has been contacting, when they contacted them, and for how long.

Signal, for example, does not store metadata or log information on its users, but the company has been exploring techniques to minimise the digital footprint its users leave behind so that a sender’s identity can also be protected, even if the communication becomes intercepted.

WhatsApp states in its legal information that the company collects “service-related, diagnostic and performance information”, which includes information about a user’s activity, such as “how you use our services, how you interact with others using our services, and the like”. It does not explicitly state whether it stores or does not store metadata on users.

Similarly, Telegram says in its Terms of Service that it “may collect metadata such as your IP address, devices and Telegram apps you’ve used” among others, and that if such data is collected, it is kept for “12 months maximum”.

Another popular app is FireChat – a messaging app that allows users to chat without going online via wireless mesh networking – the same technology that enables smartphone peer-to-peer connections via Bluetooth or Wi-fi without an internet connection.

The ability for FireChat to be used without an internet connection makes it popular at civil protests, when thousands gather in one place, potentially slowing down mobile connections. However, FireChat only encrypts private messages and it is not clear how user metadata is dealt with.