On June 19, Telegram recruitment came under renewed scrutiny after a Ukrainian man convicted of arson attacks linked to UK Prime Minister Keir Starmer was found to have allegedly been recruited and managed through the messaging app by a Russia-linked handler.
The case is now fueling discussions on the increasing use of messaging applications in carrying out criminal acts and foreign interference. Though Telegram continues to be one of the largest platforms used for communication, its technology has increasingly been under investigation.
Telegram Messages Become Central Evidence
Roman Lavrynovych, 22, was found guilty of conspiring with others to carry out arson attacks in May 2025. The attacks targeted two properties linked to Prime Minister Keir Starmer, as well as a Toyota vehicle previously owned by him in north London.
Lavrynovych and co-defendant Stanislav Carpiuc, 27, a Romanian national of Ukrainian origin, are expected to be sentenced on Friday. Carpiuc was convicted on one count of arson.
According to evidence presented during the trial, Lavrynovych communicated through Telegram with an anonymous individual known as “El Money” or “Hroshi,” the Ukrainian word for money. The person allegedly communicated in Russian and Ukrainian and is believed to have links to a Russia-linked sabotage network operating from abroad.
Police recovered more than 320 Telegram messages exchanged between Lavrynovych and the handler beginning in September 2024. Prosecutors said the anonymous contact offered the suspect $ 3,977 (£3,000) in cryptocurrency in exchange for carrying out the attacks, recording them, and ensuring they received media attention.
“Look, you attacked the home of a very high-ranking person in Britain. I’ll send you money, you need to leave the city,” one of the messages reportedly read.
Separate reporting by Radio Liberty’s investigative project Skhemy suggested Lavrynovych may have first come into contact with recruiters while searching for work through Telegram groups used by foreigners living in London.
Journalists found that Lavrynovych regularly used Telegram groups to search for work in London. His final public job request appeared on 3 May, days before the first attack. On May 2, Lavrynovych posted in a Telegram group called London UA: “Looking for a job, open to any options”. Two hours later, a user named Yurii responded: “Message me privately”.
The findings have added to concerns about how Telegram recruitment efforts may be carried out through private online channels that are difficult to monitor.
Technology and Safety Concerns Grow
The case has now drawn the attention of Ofcom, UK communications regulator, which has contacted Telegram to seek further information about how the platform detects and prevents illegal activity.
A spokesperson for Ofcom confirmed that the regulator had approached the company to seek further clarification regarding the circumstances surrounding the case. The move comes as part of a broader Telegram investigation into whether the platform safety systems are effective enough to address criminal misuse.
The incident has also intensified Telegram security concerns, particularly as encrypted messaging services continue to balance user privacy with public safety obligations. Uder the Online Safety Act UK, technology companies must assess risks and reduce users’ exposure to illegal content while maintaining effective safety systems.
Telegram was founded by Russian-born entrepreneur Pavel Durov and is currently headquartered in Dubai. While the app remains widely used in Ukraine, military and government officials have been prohibited from using Telegram on work devices for the past two years because of fears that it could facilitate surveillance and disinformation campaigns.
Investigators examining the Keir Starmer arson case have also looked at evidence suggesting that the suspects may have been connected to a wider Russia-linked sabotage network, highlighting the growing role digital platforms can play in modern influence operations.
This is not the first time Telegram has faced regulatory scrutiny. In April, Ofcom launched a separate probe into whether the company had done enough to prevent the sharing of child sexual abuse material. Responding at the time, Telegram said it had “virtually eliminated” child sexual material through “world-class detection algorithms and cooperation with NGOs” and argued that Ofcom’s accusation was false.
According to technology experts, the case demonstrates how encrypted platforms can be used for far more than personal communication. Authorities believe the exchanges between Lavrynovych, and his alleged handler show how Telegram recruitment can be used to coordinate criminal acts while maintaining anonymity.
As regulators continue reviewing the platform, Telegram security concerns are expected to remain in focus, particularly around Telegram recruitment and online criminal coordination.
Inside Telecom provides you with an extensive list of content covering all aspects of the tech industry. Keep an eye on our Cybersecurity sections to stay informed and up-to-date with our daily articles.
