Telegram says it faced a massive DDoS attack originating from China coinciding with protests in Hong Kong, where organizers used the app to evade surveillance
The popular encrypted messaging service Telegram is once again being hit with a distributed denial of service (DDoS) …
Context & Ripple Effects
Telegram has spent years walking a line between protest infrastructure and platform liability: it suspended an Iranian public channel in late 2017 for inciting violent anti-government protests while remaining a major platform with tens of millions of Iranian users (suspending the incitement channel). The Hong Kong DDoS extends that pattern from content moderation to network-level pressure.
The attack also previews what came next in the corpus: within a year, Telegram and Facebook were refusing Hong Kong police data requests under the new national security law (suspending Hong Kong police data requests), and mainland users had already turned to Telegram as a censorship-proof refuge during COVID (a refuge for WeChat users amid heavy censorship).
First-order effects
- Hong Kong protest organizers lose coordination capacity at the moment they need it most, since the app they chose specifically to evade surveillance is degraded by traffic flooding attributed to China.
- Telegram bears the direct cost of absorbing a massive DDoS on its infrastructure, effectively paying to keep a protest channel alive against a state-scale adversary.
Second-order effects
- The incident forces Telegram into open geopolitical alignment: the same platform that later refused Hong Kong police data requests is now visibly targeted by the state it defies, hardening its position rather than deterring it.
- Censorship pressure in one market feeds growth in others — the dynamic already visible when mainland Chinese users fled to Telegram during COVID-era information controls.
Third-order effects
- States are converging on a two-pronged playbook against encrypted messaging used by movements — network attacks where deniable, legal instruments (data demands, security laws) where not — making platform jurisdiction and refusal policies a core battleground.
- Telegram's dual identity, documented from Iran through Belarus, as both a democracy-movement accelerant and a haven scrutinized when extremists flock to it, means every defensive stand it takes deepens the regulatory exposure that follows the platform across jurisdictions.
The trend: Encrypted messaging platforms are being contested as protest infrastructure, with states attacking them at the network level and, failing that, through data-demand and national-security law.