IS4234
Research Report - Messaging Applications Industry

 
Group 14
 
Name 
Student ID 
Lim Zhong Zhi
A0216891X
Koo Heesun
A0274706Y
Zidane Firzatullah
A0293482W
Neo Wei Kian 
A0266883L











1. Introduction	2
2. Motivation	3
3. Current State of the Art	4
3.1 Current Governance Methods	4
3.2 Current Regulation Condition	5
3.3 Current RegTech Used	7
4. Current Challenges and Issues in System Reliability	9
4. 1 Governance Challenges	9
4.2 Regulatory Challenges	10
4.3 RegTech Challenges	10
5. Real-World System Reliability Case Study: KakaoTalk	11
5.1 Overview	11
5.2 Cause of the Incident	11
5.3 Impact of  Incident	12
5.4 Changes Resulting from the Incident	13
5.5 Conclusion	14
6. Current Challenges and Issues in Privacy	15
6.1 Governance Challenges and Issues	15
6.2 Regulatory Challenges and Issues	16
6.3 RegTech Challenges and Issues	16
7. Real-World Privacy Case Study: Telegram	17
7.1 Overview	17
7.2 Complexities of Using Open-Source Libraries	17
7.3 Why We Think It’s The Result of Good Governance	18
8. Potential Solutions	19
8.1 Enhancing System Reliability	19
8.2 Strengthening Privacy Protections	22
9. Future trend	26
8.1 Unified Global Standards	26
8.2 Interoperability of Messaging App	26
8.3 Quantum Computing Threats	27
8.4 Emergence of AI	27
References	28





Introduction
A messaging service is a digital platform that enables real-time communication between users, allowing them to exchange text, images, videos, and other media across devices and locations. Key aspects of a messaging app include user-friendly interfaces, strong security features like encryption, efficient message delivery systems, and often additional features such as multimedia sharing, group chats, and notification systems. Messaging apps are commonly used for personal communication, business collaboration, customer service, and even telemedicine. They have significantly shaped our lives by making communication instantaneous and accessible, bridging distances, fostering connections, and even enhancing productivity in professional settings. Through messaging, people can maintain relationships, collaborate remotely, and access services seamlessly, all of which contribute to a more connected and efficient world.
















Motivation
As messaging apps become more commonly used in critical settings, including by government officials and key figures in major companies, the need for clear governance, regulatory compliance, and strong safeguards is growing to ensure secure and reliable use.

Effective governance ensures responsible data management, controlled access, and enforced security measures, all of which are essential for building trust in a messaging platform, especially when sensitive or critical information is at stake. Clear regulations encourage all stakeholders to commit to and willingly implement these guidelines. Strong compliance practices further help to prevent misuse, data leaks, and breaches, protecting individuals, organizations, and governments from potential harm.

Some security frameworks, like ISO/IEC 27001 (an international standard for information security management systems), and regulations, such as the General Data Protection Regulation (GDPR) in the EU and California Consumer Privacy Act (CCPA) in the U.S., are already enforced in many parts of the world to safeguard privacy and ensure the reliability of messaging apps. Despite these measures, incidents still occur. Notable examples include the shutdown of KakaoTalk in 2022 due to system failure and the WhatsApp privacy leak in 2021. These incidents highlight a gap in the current governance, regulatory, and compliance frameworks related to system reliability and privacy within messaging apps.

This paper aims to provide valuable insights into strengthening governance, regulatory, and compliance frameworks specifically tailored for messaging apps. By identifying current gaps in privacy protection and system reliability, we hope to offer recommendations that enhance the security and trustworthiness of these platforms. Ultimately, the findings of this paper are intended to guide policymakers, developers, and organizational leaders toward implementing more robust safeguards and standards, ensuring that messaging apps remain reliable and secure even in critical contexts.




Current State of the Art
3.1 Current Governance Methods
Compliance with International Standards and Frameworks
ISO/IEC 27001: Information Security Management (ISO/IEC, 2022): Many instant messaging companies follow the ISO/IEC 27001 standard, which outlines the requirements for an information security management system (ISMS). This framework is designed to help organizations manage the security of assets such as financial information, intellectual property, employee details, and third-party information. Messaging platforms implementing this standard focus on risk management practices, ensuring that information remains secure from unauthorized access or breaches.
ISO/IEC 27018: Cloud Privacy Protection (ISO/IEC, 2019): For platforms that rely on cloud infrastructure, ISO/IEC 27018 specifically addresses the protection of personal data in the cloud. This standard is particularly relevant for instant messaging services that store user data in the cloud, as it provides guidelines for managing privacy risks and securing sensitive personal information.
General Data Protection Regulation (GDPR) Compliance (European Union, 2016): Although not an "ISO" framework, the GDPR (General Data Protection Regulation) has become the global standard for data privacy and protection, particularly in Europe. Companies such as WhatsApp, iMessage, and Telegram align with GDPR’s provisions, ensuring users' rights to data access, correction, and deletion, as well as implementing technical measures like encryption to protect user data.
Internal Governance Structures
Data Protection Officer (DPO): A critical element of governance for instant messaging platforms is the appointment of a Data Protection Officer (DPO). The DPO ensures that the company complies with relevant privacy laws, monitors data handling practices, and acts as a liaison between the company and regulatory bodies. This role is mandated under GDPR and other regional data protection laws.
Risk Management Frameworks: Instant messaging companies often implement comprehensive risk management frameworks, which include:
Risk Assessment and Audits: Regular audits and assessments help identify potential vulnerabilities and mitigate risks associated with data breaches and security threats.
Incident Response Plans: To address potential data breaches or security incidents, instant messaging companies prepare predefined response protocols to limit damage, investigate breaches, and notify regulators and users when required.
Security and Privacy Standards
End-to-End Encryption (E2EE) Security remains a top priority for instant messaging platforms (Endeley, R. E., 2017). Leading companies such as WhatsApp, Telegram, and Signal adopt End-to-End Encryption (E2EE), which ensures that only the sender and the intended recipient can access the content of a message. This standard aligns with ISO/IEC 27001's objectives, preventing unauthorized access and ensuring privacy.
These platforms conduct penetration testing and regular security audits to identify vulnerabilities within their systems. They may also work with external security firms to conduct independent assessments of their platforms' security posture.
Transparency and Reporting
Companies like WhatsApp and Telegram provide transparency reports that detail government data requests, user data handling practices, and compliance with local laws (Wagner et al., 2020). These reports enhance trust and allow users to understand how their data is managed and when it may be shared with authorities.
Internal Privacy Policies and Ethical Guidelines Internal governance is also shaped by clear privacy policies and ethical guidelines. These policies govern how user data is collected, stored, and shared, ensuring that platforms are transparent about their practices and compliant with regulatory standards.
3.2 Current Regulation Condition 
Regulation Approach
As the digital ecosystem grows, there is a notable diversity in the regulatory approaches adopted by different regions. Key players include the European Union (EU), the United States, the United Kingdom, and China, each introducing their own set of rules to govern platforms, including instant messaging services.
European Union: The EU has taken a proactive stance with its Digital Services Act (DSA) and Digital Markets Act (DMA), which impose stringent requirements on online platforms (European Commission, 2020). These include measures to ensure the safety of minors, protect users from illegal content, and promote transparency in content moderation. Messaging platforms are required to implement risk assessments, provide content moderation tools, and take swift action against harmful content.
United Kingdom: The UK’s Online Safety Bill (2024) sets a new global standard for regulating online platforms, including instant messaging services (UK Parliament.,2024). The Bill imposes a duty of care on platforms to protect users from harmful content, such as child sexual abuse material and terrorism. For platforms like instant messaging apps, the legislation mandates age verification mechanisms and requires companies to address risks associated with private communications.
United States: In the U.S., there is currently no single federal law regulating instant messaging platforms. However, regulations like the Communications Decency Act Section 230 provide platforms with immunity from liability for user-generated content (Exon, J., 1996). The regulatory landscape is dynamic, with ongoing discussions about updating Section 230 to better address issues related to online harm.
China: China has implemented stringent regulations through laws like the Cybersecurity Law and Personal Information Protection Law, which place heavy obligations on tech companies to control content, ensure data protection, and maintain national security. The government mandates extensive monitoring and content filtering by instant messaging platforms operating in the country.
Key Regulatory Measures
Several core principles are emerging as common threads across global regulations for instant messaging platforms:
Content Moderation and Safety: Platforms are required to address illegal content proactively, including child exploitation materials, hate speech, and terrorist propaganda. The regulations often mandate robust systems for detecting and removing such content, alongside creating mechanisms for users to report harmful activities.
Data Protection and Privacy: With growing concerns over data breaches and privacy violations, countries are enhancing regulations around user data. The General Data Protection Regulation (GDPR) in the EU, for example, imposes strict guidelines on how personal data is collected, processed, and stored. Instant messaging platforms are required to obtain explicit consent from users for data processing and to provide clear mechanisms for data access and deletion.
Age Verification and Protection of Minors: Many jurisdictions, including the EU and the UK, are enforcing measures to protect minors from accessing inappropriate content. Age verification systems are being implemented to ensure that children cannot access platforms unsuitable for their age.
Transparency and Accountability: Platforms, particularly those with large user bases, are required to disclose their content moderation practices and report on their efforts to combat harmful content. Transparency reports are becoming a key requirement for compliance, helping to hold companies accountable for their actions.
Enforcement and Penalties
Enforcement of these regulations is a critical aspect of ensuring compliance. In several regions, regulators have been empowered to impose heavy fines and penalties on non-compliant platforms:
United Kingdom: Ofcom, the UK’s communications regulator, can fine platforms up to £18 million or 10% of their annual global turnover for failing to meet regulatory requirements. This includes non-compliance with content moderation standards and failure to protect users from harm (UK Government, 2022).
European Union: The EU’s Digital Services Act imposes similar penalties for non-compliance, with platforms facing significant fines for failure to act on illegal content or provide adequate user safety protections.
China: In China, tech companies face severe penalties, including service suspensions or shutdowns, for failing to comply with content regulation and cybersecurity laws.

3.3 Current RegTech Used 
Trends in RegTech for Instant Messaging Platforms
Real-Time Identity Verification: RegTech advancements, such as Trulioo’s digital identity platform, enable instant identity verification for individuals and businesses globally. This technology improves processing speed and compliance, reducing onboarding time by 56% while maintaining accuracy. For instant messaging platforms handling numerous transactions, real-time verification is essential for ensuring regulatory adherence and user trust. Privacy is a key concern, as these solutions must comply with laws like the General Data Protection Regulation (GDPR) and South Korea’s Personal Information Protection Act (PIPA), which mandate secure and transparent handling of personal data. By integrating RegTech, messaging platforms can verify identities efficiently while upholding stringent data privacy standards.
AI-Driven Compliance Monitoring: RegTech platforms have also harnessed artificial intelligence (AI) and machine learning (ML) to automate regulatory compliance processes (Singh, C., & Lin, W., 2021). These technologies are particularly beneficial in instant messaging applications, which often require constant monitoring of user data and communication activities. For example, AI can help platforms automatically interpret financial regulations and detect anomalies in real-time, reducing human error and ensuring compliance with laws such as GDPR and CCPA. By continuously analyzing large datasets, AI can detect and flag potential non-compliance issues before they escalate.
KYC Automation via Bots: Know-Your-Customer (KYC) compliance is essential for platforms that engage in financial transactions. KYC bots, like those developed by AskLulo, have been integrated into instant messaging platforms to automate the client identification process. These bots guide users through KYC procedures directly within messaging apps, improving the efficiency of compliance and reducing user friction. The automation of KYC processes not only enhances the user experience but also ensures that businesses comply with anti-money laundering (AML) regulations. For instance, KakaoTalk, a widely used app in South Korea known for features like sending money and paying bills, has stringent regulations that require ID verification tied to the app. Integrating KYC bots in KakaoTalk could streamline these processes, allowing users to complete identity verification seamlessly while ensuring compliance with AML regulations, like Financial Services Commission (FSC) and the Korea Financial Intelligence Unit (KoFIU).
Cloud-Based Compliance Tools: Cloud-powered RegTech solutions are another significant trend, especially for financial institutions using messaging apps for customer communication. ComplyFirst, for example, offers a cloud-based platform that automates regulatory reporting, streamlining the process from data collection to submission. The platform integrates legal workflows to ensure compliance with financial regulations, such as those set by the Financial Conduct Authority (FCA) in the UK. The cloud-based approach allows for better data management, cross-party collaboration, and real-time compliance monitoring, all of which are essential for global messaging platforms.
Current Challenges and Issues in System Reliability 
4. 1 Governance Challenges
The stability of digital services directly impacts user trust in the service and is a critical element of a business's core competitiveness. Some global companies have effective processes, technologies, dedicated teams, internal regulations, and periodic training processes in place to ensure system stability. For example, Google has developed the Site Reliability Engineering (SRE) methodology to enhance the reliability of its systems and provide trustworthy services to customers. SRE is based on core principles such as risk acceptance, service level objectives, eliminating unnecessary tasks, distributed system monitoring, and simplicity, systematically managing Google's entire system.

Example of SRE Principles by Google
However, many other digital service providers have defined basic processes for handling outages and disaster situations, but often lack systematic management systems. In terms of governance related to digital service stability, they face several challenges, such as the lack of dedicated teams and expertise, insufficient response plans for ensuring business continuity, inadequate vendor and third-party risk management frameworks, and difficulty in changing organizational culture regarding the importance of system stability. Furthermore, at the C-level, there is still a tendency to prioritize short-term profit generation over proactive investments in outage and disaster management, often considering these tasks as secondary. Once a system outage occurs and customer trust is lost, significant costs and time are required for recovery. Therefore, it is essential to establish effective governance to create a sustainable business foundation.
4.2 Regulatory Challenges
In most countries, governments regulate financial institutions, such as banks, and telecommunications infrastructure-related companies to ensure that their systems operate reliably. However, there are no established regulations regarding the system stability of digital service companies. As we enter the digital age, certain digital services have had a significant impact on the daily lives of citizens in many countries, leading to various discussions about introducing regulations. There are differing opinions, with some arguing that strict regulations could hinder innovation, while others believe that regulations are necessary to minimize the social disruption caused by digital service outages.
From the business perspective, with the increasing number of regulations on digital companies (such as the EU's DSA, DMA, etc.), the introduction of regulations related to system stability could lead to significant compliance costs and increased business complexity due to regulatory differences across countries. In South Korea, regulations to ensure system stability have already been introduced, and specific details will be covered in the case study. Therefore, companies need to closely monitor regulatory changes in each country and build organizations and systems that can respond flexibly. Additionally, governments must create a reasonable regulatory environment that allows innovation and regulation to coexist harmoniously.
4.3 RegTech Challenges
In the financial sector, standardized regulations have already been established, and various RegTech solutions are being implemented and utilized. However, regulations to ensure service stability for digital service companies, such as messaging services and search engines, have not yet been standardized. However, major cloud providers (MS, Amazon, Google, etc.) consider system stability to be critically important, and they have developed their own technologies to support customers in running their businesses securely and reliably. Other companies are focusing more on improving their own service reliability than on regulatory compliance, implementing various technologies such as automated monitoring and alert systems, AI-driven incident response, and security testing. As the global regulatory environment evolves, the development direction of RegTech will also change, and companies need to invest in research and development to respond flexibly to regulatory changes and enhance the reliability of their own businesses.
Real-World System Reliability Case Study: KakaoTalk
5.1 Overview
Kakao, one of South Korea's leading IT companies, offers a wide range of services in various fields such as messaging, mobility, gaming, and payments, having a close impact on the lives of Korean citizens. On October 15, 2022, a fire broke out at the data center where Kakao's main software was operating, resulting in widespread disruptions to the digital services provided by Kakao. It took 127 hours and 33 minutes for Kakao's digital services to be fully restored, during which time Korean citizens faced significant inconveniences. Although the services were eventually restored, this incident highlighted the importance of digital service reliability in South Korea and served as a catalyst for the government to create new laws and regulations.
5.2 Cause of the Incident
Fire Incident: On October 15, 2022, a fire broke out in the battery room of the SK C&C Pangyo Data Center, where Kakao's main software was operating. During the firefighting process, the power to the entire building was cut off, and the operations of the data center were completely suspended.
The battery monitoring system, which automatically alerts administrators when the battery temperature rises, was not functioning properly. The Uninterruptible Power Supply (UPS) was not physically isolated, resulting in a complete power shutdown to all servers when the data center lost power.
There was a lack of specialized fire prevention manuals for the recently installed lithium-ion batteries. The structural integrity of the data center was insufficient, making it difficult to quickly identify the power cutoff switches in specific areas, and the UPS system was unable to function properly.
Additionally, there was a lack of specific action plans and training to effectively respond to a fire incident in the data center.
Redundancy System Failure: Kakao operated redundant servers in multiple regions to prepare for the potential failure of specific data centers. However, during the incident, the active-standby system between the Pangyo data center (active) and the other centers (standby) was not functioning properly.
When the active server encountered issues, the tools necessary to activate the standby servers were not replicated across all data centers, leading to a significant delay in service recovery.
There was a lack of comprehensive recovery plans, training, and preventive education for scenarios where an entire data center in a specific region fails. Concentrating most of Kakao's core services in a single data center indicates a vulnerability in risk prevention.

5.3 Impact of  Incident
(Users) The messaging service KakaoTalk experienced disruptions, preventing 47.6 million users from accessing the messaging service. The mobility service Kakao T faced outages, leading to a suspension of ride-hailing services, which impacted 12.5 million users. The payment service Kakao Pay also experienced disruptions, halting mobile payments and transfers, affecting 23 million users.
(Company) The service disruption had an immediate impact on Kakao's stock price, resulting in a loss of 49.7 billion KRW for the quarter due to service outages and subsequent compensation. Customer loyalty declined as users switched to competitor services during the disruption. The CEO of Kakao publicly apologized for the lack of prevention and response measures and resigned.
Kakao's quarterly earnings



(Society) Concerns have spread that disruptions in digital services, which play an essential role in daily life, can significantly impact society as a whole. As a result, discussions have begun regarding the establishment of governance and the introduction of reasonable regulations to ensure the stability of services provided by major digital companies
5.4 Changes Resulting from the Incident
Corporate Governance
A dedicated organization will be established to prevent and respond to incidents and disaster situations, and regular training will be conducted to prepare for worst-case scenarios. Recovery priorities and goals will be set for the company's key services and functions in preparation for incidents, along with a detailed response plan that includes failure detection, propagation, and recovery. Additionally, principles and criteria for user compensation in the event of service disruptions will be established.
Regulation
Following the incident, the government announced a plan to strengthen the stability of digital services, which includes enhancing the survivability of data centers, improving the resilience of digital services, and establishing a foundation for digital crisis management. Along with this, legal amendments were also initiated.
First, a legal amendment was made to mandate disaster management for major digital service providers. Previously, the disaster management obligations applied only to network infrastructure operators, but this has now been extended to include major digital service providers.
Existing Framework Act on Telecommunications Development
Amended Framework Act on Telecommunications Development
(Target) Major network infrastructure operators
 (Content) Prevention and response to network failures / Safety management of critical communication facilities / Operation of dedicated disaster response organizations / Conduct of simulation training
(Target) Expanded from existing major network infrastructure operators to include major digital service providers and major data center operators
 (Content) Similar to the existing provisions

Next, a legal amendment was made to require major digital service providers to regularly submit reports to the government on the status and plans for service stability measures.
Existing Telecommunications Business Act
Amended Telecommunications Business Act
(Target) Major digital service providers
 (Content) Must take necessary measures to provide stable digital services.
(Target) Major digital service providers
 (Content) Must take necessary measures to provide stable digital services / Report the status and plans for ensuring service stability to the government annually.

 
5.5 Conclusion
The digital service outage of Kakao that occurred in South Korea had a significant impact that went beyond inconveniencing the daily lives of citizens—it paralyzed the entire economy and society. This incident prompted the South Korean government to legally mandate disaster response systems for major digital services. Given the growing importance of digital services—illustrated by recent events like Microsoft's cloud outage affecting various services worldwide—it is necessary to examine governance, regulations, and other measures to ensure digital service stability, using South Korea's case as a reference.


Current Challenges and Issues in Privacy
6.1 Governance Challenges and Issues
Most probably, messaging services developers use well-known software libraries to do many things, whether it’s network calls, user authentication, and even for their encryption. Not only for their production or operation environment, the engineers must be using some well-known public tools during their development lifecycle, e.g. to login to the development (or even production) servers. This brings governance challenges, because the disclosure of any public libraries (especially the old ones) used could trigger some parties (even state-sponsored) to start to inject some malicious update to their public libraries code. Injection malicious updates, without a doubt, will hurt the privacy aspects of the messaging services because they might introduce backdoors that make it possible to open all users’ messages.
More serious companies must also ensure that they limit the usage of some public libraries or tools, because of how fragile it is to hidden backdoors, but still keep balances so that this limitation won’t just introduce new vulnerabilities and hard engineering challenges. This is a complex governance challenge because every system increment must evaluate the libraries that are needed comprehensively first, develop new libraries for risky implementations, etc. These things could bring down development velocity and the time to market, which might not be very good metrics for the management. 
Major vulnerabilities in the libraries used by the company are significant issues that these privacy-first companies need to respond to as soon as possible because they might compromise users’ data if left untreated. For example, there was a major vulnerability disclosed in 2021 caused by Log4J, a very widely used logging library used by Java-based software. This vulnerability made it possible for the hackers to do Remote Code Execution (RCE) that basically allowed the hackers to do anything they wanted, this is catastrophic for private messaging service companies. Although they’re implementing end-to-end encryption and no one should know anything about the chats stored in the company’s server, bad actors could export the code that the company runs for the servers and do reverse engineering to check for vulnerabilities in their code. We do not want this to happen, so governance of monitoring vulnerabilities and responding as soon as possible to vulnerabilities is a very important matter.
6.2 Regulatory Challenges and Issues
Because of the nature of messaging services, which are connecting people from all around the world, it will certainly be harder to comply with local data protection laws from these many different countries. For example, if a Russian citizen is messaging a Singaporean, the laws under different jurisdictions might make it harder for the messaging service company to process and store these messages. The Russian Federal Law mandates that the data of Russian citizens must be stored in servers located in Russia (data localization), while PDPA doesn’t mandate this data localization policy. If two parties from two different countries mandate the same data localization policy, these regulatory challenges might even bring new engineering tasks because the data stored will be fragmented.
Regulations for fully private messaging services are harder to negotiate, because they might be seen as threats by the governments because it could hide communications done by dangerous organizations. Telegram, for example, claimed many interventions done by US law enforcement and intelligence agencies to give backdoors to users’ personal chats because of the dangerous activities allegedly done in Telegram. So, while fully private messaging services are seen as something important and beneficial by the people, they might not be seen the same way by the government because of the dangers it might hide.
6.3 RegTech Challenges and Issues
Again, because of the multi-jurisdictions nature of messaging services, the parties involved in a single messaging activity could be from many different countries with different local or regional data protection laws and this could introduce engineering challenges. To comply with these laws from different countries, different companies might implement different solutions. If we’re positioning ourselves as practitioners, we think that the usage of regtech from 3rd parties might need bespoke solutions for different companies. This challenge might reduce the efficiency of some 3rd party regtech that were designed as Commercial Off-the-Shelf.
One of the issues of using 3rd party regtech for privacy-first messaging services is the people using these services because of the privacy claims are more skeptical about using 3rd parties to manage their data, even if it’s to comply with the local or regional regulations. 3rd parties could be seen as the “weak-chain” that could compromise users’ privacy, one way or another. Is using 3rd party regtech to simplify compliance processes worth the potential distrust by the consumer base? We think privacy-first messaging companies need to strike a balance between them, so that they’re still up-to-date with the compliance needs and the customers won’t bring distrust to the table.
Real-World Privacy Case Study: Telegram
7.1 Overview
Telegram, being a fully private messaging application, has brought many controversies to the digital world. They are claiming that they’re using end-to-end encryption on the messages and they do not have access to the user messages. A fully private messaging service is a rare case, we do not see many of them although there are many messaging service companies that claim so.  For example, WhatsApp, although they claim that the messages there are fully private, it is not until a few years ago they introduced an encrypted backup mechanism. Before that, it was well known by the privacy community that their backup mechanism isn’t encrypted and authorities or people at WhatsApp can see user messages when done. But, was the introduction of encrypted backup because of good intentions or they just found a better backdoor mechanism to access user messages, we don’t really know. 

Telegram is kind of different, at least from what we know. Their founder was recently arrested by the French authorities, because Telegram was accused of facilitating illegal activities and not providing authorities the information they needed for investigations. We think that it’s a good sign of Telegram not abusing their platform to provide user messages, without their consent, to other parties. If there is a known backdoor, whether intentional or not by Telegram, we think it might be better for the authorities to directly use it rather than making a scene at international level by arresting the founder of a very famous encrypted messaging service company.

The founder of Telegram, Pavel Durov, previously claimed that the US government tried to bribe Telegram engineers to tell the US government the information they wanted to know. It wasn’t necessarily a direct information of user messages of some criminals that the US government was trying to catch, but it could be what open source libraries they use, how their client-server protocol works and their cryptography strategy. The founder claimed that the engineers didn’t take the bribe, so hopefully Telegram is still private and has no open backdoor.

7.2 Complexities of Using Open-Source Libraries
Software that use open source libraries are more prone to backdoors if a complete protection of the server environment is not provided. Many open source projects receive a merge request (git mechanism of introducing an update to a software) that includes backdoors, many were caught and many weren’t. For example, there is an open source disk encryption software called TrueCrypt that was mysteriously discontinued in 2014. Many people are saying it is a state-sponsored attack on the software by the US government. Another example is a backdoor found in a well known and very widely used open source library, XZ Utils. Many people are also saying that it was a state-sponsored attack that was done by supplying a backdoor to the library. These examples show that open source libraries are prone to backdoors and privacy-first messaging companies need to strike a balance between using them and creating their own. But again, developing too many libraries on their own might introduce unchecked vulnerabilities, so clean practices of using open-source libraries are needed and Telegram is doing a good job at it. Disclosure of the libraries used or the encryption strategies could be misused by some parties to introduce backdoors and give them free and unwanted access to the user messages, because the adversaries are state-sponsored actors and they could do many attacks at a bigger scale.
7.3 Why We Think It’s The Result of Good Governance
Telegram does not disclose the libraries and encryption strategies used by them in their server-side software, and they even allegedly created their own protocols for the cryptography part which shows their seriousness in creating a fully private messaging service. The governance of the usage of open source libraries and cryptography mechanisms by the engineers at Telegram is excellent. We think that it’s a good sign of how they have done their due diligence of the libraries they use in their software, even though doing so clearly slows down the development process. The fact that none of the Telegram engineers disclose the libraries used and they didn’t take the bribe for it is also an example of excellent governance and discipline exercised by them.











Potential Solutions 
Addressing the challenges mentioned in the messaging applications industry requires comprehensive strategies that not only leverage technological advancements but also emphasize robust governance frameworks, regulatory compliance, and proactive engagement with users and stakeholders. This section presents potential solutions tailored to the specific issues discussed earlier in the report, particularly focusing on enhancing system reliability and strengthening privacy protections. Real-world examples are integrated to substantiate the proposed solutions, offering practical insights into how these measures can be effectively implemented in the real-world. 
8.1 Enhancing System Reliability
The KakaoTalk incident highlighted significant gaps in system reliability, governance, and regulatory compliance. The key issues included the lack of effective disaster recovery plans, insufficient redundancy systems, inadequate governance structures, and the absence of robust regulatory frameworks mandating service stability for digital service providers. To address these challenges, the following potential solutions are proposed:
8.1.1 Establishing Robust Disaster Recovery and Business Continuity Plans
Developing comprehensive disaster recovery (DR) and business continuity plans (BCP) is essential for ensuring rapid recovery from system outages and minimizing service disruptions. These plans should include:
Identification of Critical Services and Priorities: Clearly define which services are essential and set recovery time objectives (RTOs) and recovery point objectives (RPOs) to guide restoration efforts.
Detailed Response Procedures: Outline specific actions to take during various disaster scenarios, such as fires, natural disasters, or cyber-attacks. This should include steps for detection, containment, eradication, and recovery.
Regular Testing and Drills: Conduct simulations and drills to test the effectiveness of DR and BCP, ensuring that staff are familiar with procedures and can respond effectively in real situations.
For example, after the KakaoTalk incident, the company recognized the need for better disaster preparedness. By establishing a dedicated disaster management team and conducting regular training, KakaoTalk can improve its ability to respond swiftly to future incidents, reducing downtime and mitigating impacts on users. 
8.1.1a Recognized Standards and Frameworks:
ISO 22301:2019 - Business Continuity Management Systems (BCMS):
ISO 22301 is an international standard that specifies requirements to implement, maintain, and improve a Business Continuity Management System. It helps organizations prepare for, respond to, and recover from disruptive incidents.
ISO/IEC 27031:2011 - Guidelines for ICT Readiness for Business Continuity:
 This standard provides guidelines for Information and Communication Technology (ICT) to support business continuity.
National Institute of Standards and Technology (NIST) SP 800-34 Rev. 1 - Contingency Planning Guide for Federal Information Systems:
Although designed for federal information systems, NIST SP 800-34 provides a solid framework applicable to private organizations.


8.1.2 Implementing Redundancy and Geo-Distributed Systems
To prevent single points of failure, messaging platforms should implement redundancy across multiple data centers in geographically diverse locations. This includes:
Active-Active Configurations: Deploy data centers that operate simultaneously, sharing the load and providing seamless failover capabilities if one center becomes unavailable.
Data Replication: Use real-time data replication technologies to synchronize data across all locations, ensuring consistency and reducing the risk of data loss.
Load Balancing and Traffic Management: Distribute user traffic intelligently across servers and data centers to optimize performance and reliability.
For instance, global messaging services like WhatsApp and Telegram use distributed server architectures spread across multiple locations to ensure high availability and fault tolerance. This approach minimizes the risk of service disruptions due to localized incidents, such as the data center fire that affected KakaoTalk. These solutions can help enhance system reliability for crucial communication networks. 
8.1.3 Strengthening Governance Structures
Creating specialized teams focused on system reliability and incident management can enhance organizational readiness. This involves:
Establishing Site Reliability Engineering (SRE) Teams: Dedicated SRE teams are responsible for maintaining system stability, performance, and scalability. Google pioneered this approach, integrating software engineering and systems administration to build ultra-reliable systems. Having SRE teams is a practical solution to bridging the gap between system administration and software development. 
Defining Clear Roles and Responsibilities: Assign specific roles within incident response protocols to streamline decision-making and ensure accountability during crises, inline with governance principles already adopted by these companies. 
Incorporating Reliability Metrics into KPIs: Prioritize long-term system stability by including reliability targets in key performance indicators, encouraging a culture that values sustained performance over short-term gains for these companies.
By adopting these governance practices, messaging platforms can improve their ability to prevent and respond to system failures, fostering greater trust among users and stakeholders.
8.1.4 Proactive Regulatory Compliance
In light of the regulatory changes following the KakaoTalk incident, messaging service providers should proactively engage with regulators to understand and comply with service stability requirements. Actions include:
Regular Reporting to Authorities: As mandated by amendments to Korea's Telecommunications Business Act, companies must report on measures taken to ensure system stability. Compliance demonstrates a commitment to accountability and transparency.
Collaborative Regulation Development: Work with regulatory bodies to develop reasonable regulations that balance innovation with the need for reliability, ensuring that policies are practical and effective.
Investment in RegTech Solutions: Utilize Regulatory Technology (RegTech) tools to streamline compliance processes, monitor adherence to regulations, and automate reporting requirements. This can reduce the administrative burden and enhance accuracy.
By staying ahead of regulatory requirements and fostering positive relationships with regulators, companies can avoid penalties and contribute to shaping a favorable regulatory environment.
8.1.5 Leveraging Technological Solutions
Adopting advanced technologies can significantly enhance system reliability:
Automated Monitoring and Alerting Systems: Implement tools that continuously monitor system health and performance, automatically alerting engineers to anomalies or potential failures. For example, Datadog and New Relic offer comprehensive monitoring solutions that can be customized for messaging platforms.
Artificial Intelligence and Machine Learning: Use AI and ML algorithms to predict system load, detect unusual patterns, and proactively allocate resources or address issues before they escalate. Netflix uses such technologies to anticipate and manage traffic spikes, ensuring smooth streaming services.
Containerization and Microservices Architectures: Break down applications into microservices deployed in containers (e.g., using Docker and Kubernetes). This approach enhances scalability, allows for isolated updates, and reduces the impact of failures in individual components.
By integrating these technologies, messaging platforms can build more resilient infrastructures capable of handling complex demands and recovering quickly from disruptions.
8.2 Strengthening Privacy Protections
The challenges in privacy, as illustrated by the Telegram case study, revolve around governance issues related to the use of open-source libraries, regulatory complexities due to multi-jurisdictional obligations, and skepticism towards third-party RegTech solutions. To address these concerns, the following solutions are proposed:
8.2.1 Adopting Privacy-by-Design Principles
Integrating privacy considerations into every stage of the software development lifecycle ensures that privacy is built into the foundation of the platform. This includes:
Data Minimization: Collect only the data necessary for providing services, reducing the risk associated with data breaches or misuse.
End-to-End Encryption (E2EE): Implement E2EE by default to ensure that only the communicating parties can access message contents. WhatsApp's adoption of E2EE is a prominent example, providing strong privacy protections for users.
User Consent and Control: Provide clear options for users to control their data, including settings for data sharing, retention, and deletion.
Telegram's commitment to developing its own encryption protocols and limiting the disclosure of its encryption strategies exemplifies this approach, ensuring that user messages remain secure even under external pressures.
8.2.2 Developing In-House Cryptographic Solutions with Expert Verification
To mitigate risks associated with open-source libraries that may contain vulnerabilities or backdoors, companies can:
Develop Proprietary Cryptographic Libraries: By building custom solutions, companies maintain control over security implementations. However, this requires significant expertise and resources.
External Audits and Peer Reviews: Engage independent security experts to audit proprietary cryptographic systems. This adds credibility and helps identify potential weaknesses without exposing sensitive implementation details.
Balanced Transparency: While keeping specific technical details confidential, companies can still be transparent about their commitment to security and privacy principles.
Signal's open-source approach, where the code and cryptographic methods are publicly available, contrasts with Telegram's strategy but also demonstrates that transparency, coupled with rigorous security practices, can build trust, and either option should be adopted depending on the needs of the company.
8.2.3 Navigating Multi-Jurisdictional Regulatory Compliance
To address the regulatory challenges posed by different data protection laws across countries, messaging platforms should:
Flexible Data Management Strategies: Implement data localization where required, using regional data centers to store data in compliance with local laws (e.g., storing Russian users' data within Russia).
Dynamic Compliance Systems: Use compliance management tools that can adapt to various legal requirements, automatically applying the necessary protocols based on user location and applicable laws.
Legal Expertise and Global Compliance Teams: Establish teams specialized in international law to navigate complex regulations and update practices as laws evolve.
Microsoft's cloud services offer compliance with numerous international standards by providing customers with choices about data storage locations and ensuring that services meet regional regulatory requirements.
8.2.4 Balancing the Use of Third-Party RegTech Solutions
While skepticism exists regarding third-party involvement in privacy-first messaging services, leveraging RegTech can be beneficial if managed carefully:
Due Diligence in Vendor Selection: Choose RegTech providers with strong security credentials, transparency, and a track record of compliance.
Contractual Safeguards: Include strict data protection clauses in agreements with third-party providers, ensuring they adhere to the same privacy standards and are subject to audits.
User Communication: Be transparent with users about the use of third-party services, explaining how their data is protected and the benefits of compliance.
By carefully integrating RegTech solutions, companies can enhance compliance without compromising user trust.
8.2.5 Enhancing Governance and Security Practices
Strengthening internal governance can mitigate risks associated with software development and open-source library use:
Strict Policies on Third-Party Libraries: Implement controls over the use of external code, including approval processes, security assessments, and regular updates to address vulnerabilities.
Secure Development Training: Provide ongoing education for developers on secure coding practices, threat awareness, and the importance of adhering to governance policies.
Incident Response Planning: Establish protocols for handling security incidents, including communication strategies and mitigation steps.
Telegram's disciplined approach to governance, evidenced by their engineers' refusal to disclose sensitive information even under pressure, highlights the importance of strong internal policies and a culture of security.
















Future trend
8.1 Unified Global Standards
The global usage of messaging apps connects individuals across borders, enabling communication between people in different countries, each with unique privacy, security, and regulatory standards. This fragmentation poses challenges, particularly as messaging platforms are increasingly used by government officials and corporate leaders who may discuss sensitive or national security-related topics. When users from diverse jurisdictions communicate, varying regulations can lead to inconsistencies in data protection and privacy, exposing critical information to different levels of security risk and compliance complexities.
A unified global regulatory framework could help address these challenges by establishing consistent standards for privacy, security, and system reliability in messaging apps. Such a framework would protect user data and support national security interests by creating a common baseline, allowing countries to build on these standards with additional regulations tailored to their specific needs. For example, the EU's General Data Protection Regulation (GDPR) and APEC's Cross-Border Privacy Rules (CBPR) system provide multinational governance frameworks that promote privacy protection and secure data transfer across borders. This approach would help messaging app providers achieve reliable, cross-border compliance, ensuring the secure and trustworthy use of messaging platforms worldwide.
8.2 Interoperability of Messaging App
The trend of interoperability between messaging apps like WhatsApp, Meta Messenger, and Signal aims to create a more connected communication ecosystem, allowing users across different platforms to seamlessly interact. However, this growing interconnectedness introduces significant Governance, Regulation, and Compliance concerns. As data flows across multiple platforms, ensuring consistent privacy protection, data security, and system reliability becomes more complex, particularly when different services are governed by varying regulations, such as GDPR in the EU. The challenge lies in maintaining secure cross-platform communication while addressing issues like user consent, data retention policies, and compliance with diverse national regulations, which could lead to vulnerabilities or privacy risks if not carefully managed.
8.3 Quantum Computing Threats
Quantum computing presents a significant challenge to current encryption methods, potentially breaking traditional cryptographic algorithms that rely on the complexity of mathematical problems, such as RSA and ECC. As quantum computers become more powerful, the need for quantum-safe encryption is growing to ensure that sensitive data, including private communications on messaging apps, remains secure. This shift towards quantum-resistant algorithms is critical for the future of privacy-preserving regulations, as governments and regulatory bodies will need to adapt to protect data from quantum-enabled decryption. As quantum computing evolves, it will likely drive the development of new privacy standards and encryption protocols to safeguard user data, reshaping how privacy regulations are structured to account for future technological threats.
8.4 Emergence of AI
The rise of AI and chatbots, especially those powered by large language models (LLMs), has transformed industries like customer service and communication. However, these systems can pose privacy risks because they often rely on third-party services or cloud providers for processing and storing data. When sensitive information is entered into these AI systems, it might be accessed or misused by these external providers. This reliance on third-party services can weaken privacy regulations because control over how data is handled is no longer fully in the hands of the messaging app provider. Even if an app follows privacy laws like GDPR, the third-party services may not follow the same rules, leading to potential gaps in privacy protection and making it harder to ensure that personal data remains secure.







References
Endeley, R. E. (2017). End-to-end encryption in messaging services and national security—Case of WhatsApp messenger. Journal of Information Security, 9(1), 95–99. https://doi.org/10.4236/jis.2017.91007
Exon, J. (1996). The Communications Decency Act. Federal Communications Law Journal, 49(1), 4.
European Commission. (2020). Digital Services Act package. https://digital-strategy.ec.europa.eu/en/policies/digital-services-act-package
European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official Journal of the European Union. https://eur-lex.europa.eu/eli/reg/2016/679/oj
ISO/IEC. (2022). ISO/IEC 27001:2022: Information security, cybersecurity and privacy protection—Information security management systems—Requirements (3rd ed.). International Organization for Standardization. https://www.iso.org/standard/27001
ISO/IEC. (2019). ISO/IEC 27018:2019: Code of practice for protection of personal data in the cloud (1st ed.). International Organization for Standardization. https://www.iso.org/standard/74104
Ofcom. (n.d.). About Ofcom. https://www.ofcom.org.uk/about-ofcom
Singh, C., & Lin, W. (2021). Can artificial intelligence, RegTech and CharityTech provide effective solutions for anti-money laundering and counter-terror financing initiatives in charitable fundraising. Journal of Money Laundering Control, 24(3), 464–482. https://doi.org/10.1108/JMLC-09-2020-0094
Trulioo. (n.d.). Instant global identity verification platform. https://www.trulioo.com
UK Parliament. (2024, May 7). Online Safety Act: Explainer. https://www.gov.uk/government/publications/online-safety-act-explainer/online-safety-act-explainer
Wagner, B., Rozgonyi, K., Sekwenz, M. T., Cobbe, J., & Singh, J. (2020, January). Regulating transparency? Facebook, Twitter and the German Network Enforcement Act. In Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency (pp. 261–271). https://doi.org/10.1145/3351095.3372853
Ministry of Science and ICT (2022, December 6). Announcement of Digital Service Disruption Investigation Results and Demands for Improvements.
보도자료 - 과학기술정보통신부

Ministry of Science and ICT (2023, March 30). Announcement of Digital Service Stability Enhancement Measures. 
보도자료 - 과학기술정보통신부
Matt Burgess (2024, February 6). WhatsApp Chats Will Soon Work With Other Encrypted Messaging Apps. https://www.wired.com/story/whatsapp-interoperability-messaging/
Jon Jackson (2024, April 17). US Government Tried to Spy on People, Telegram Founder Claims. https://www.newsweek.com/telegram-tucker-carlson-government-spying-1891398



Offer a strong critique of this report, from the following rubrics:

Report (33 Marks)
• In this report you are recommended to cover the following sections:
o Introduction of this topic (2’)
§ What it is about
§ Study context
• Business context: e.g., Finance, Healthcare, etc.
• Technology context: e.g., AI, blockchain, IoT, Cloud, etc
o Motivation/Importance of this topic (3’)
§ Why this topic is important
o Current state of the art (6’)
§ Current governance methods
§ Current regulation condition
§ Current RegTech used
o Current challenges and issues in this area (6’)
§ E.g., Governance challenges
• Oversight
• Policies
• Risk management
• Audit function
§ E.g., regulatory challenges
• Laws
2
• Industry regulatory
• Policy vacuum (if any)
§ E.g., RegTech challenges
o At least a relevant real business case study (8’)
§ E.g., a case of failure or success
o Potential solutions addressing the challenges (5’)
§ E.g., governance solutions
§ E.g., regulation solutions
§ E.g., tech solutions
o Future Trend (2’)
§ Future direction of this area
o References (1’)
Report Requirements:
Please format the written report based on the following settings:
• Paper size: A4.
• Margin: 1 inch all around.
• Orientation: Portrait.
• Line Spacing: 1.5 spacing.
• Font Type for Main Text: Times New Roman.
• Font Size for Main Text: 11pt.
• File Format: PDF.
• File Name: Group ID (e.g.,G1_Final Report) as the file name.
• Cite the sources/references from where you have taken them.
• Page limit: maximum 25 pages without cover page, table of content, reference, and
appendix.
• Your report structure does not need to exactly follow the section sequences recommended
above, you can adjust it and write in a way which makes the whole report information flow
fluent.
Please provide a simple cover page that includes the full name and student number of all group
members as the first page of your written report. You are also required to include a references
section at the end of the written report.
Important Dates and Key Deliverables:
1) Project Proposal -2%
• Submit your proposal in doc, docx or pdf format to Project Proposal Submission
folder on Canvas by 22 Sep 2024 2359hrs (Sunday Midnight, Week 6).
2) Report - 33%
• Submit your completed report to Project Report Submission Folder on Canvas by 15
Nov 2024 2359hrs (Fri Midnight, Week 13).
• Clicking on this submission folder in Canvas will redirect you to the Turnitin
Assignment submission web page. You must upload your submission via Turnitin.
3
You are allowed to view the originality report immediately and make resubmissions
anytime up till the submission deadline. Typically, the similarity rate should be kept
within 10%. Otherwise, penalty mark will be applied.
• Each student will have one submission attempt. After each submission, the system
will tell you the similarity score. You can based on the feedback and make necessary
editing.
Grading Criteria:
1) Proposal - 2%
2) Report -33%
• Depth
o Whether the topic has been researched and discussed in depth
§ Clear problem investigation
§ Thorough discussions of current situations
§ Comprehensive and Innovative solution exploration and discussion
§ Implications
• Writing
o Report structure
o Writing clarity
o Formatting
References and Citations in Your Written Report
• Please cite all references at the end of your paper (both proposal and final report). You
should include references for facts, figures and any other information that you obtained
through various sources. References from relevant papers in the NUS Digital Library are
preferred over Internet sources as Internet sources may not always be reliable.
• Whenever you quote, paraphrase, summarize or refer to ideas, facts, figures or findings from
another source (e.g. research paper, book, website), you should cite the source, with
appropriate formatting, in the sentence that mentions these ideas or figures. It is not
sufficient to just provide a list of references at the end of your paper. The source that you
use should be cited in the text of your paper, either in parentheses or as part of the text itself.
We suggest the use of APA style for referencing.
Plagiarism and Academic Honesty
• The University takes a serious view against any forms of plagiarism. Please refer to the NUS
Plagiarism Notice (http://www.comp.nus.edu.sg/cug/plagiarism) for more information. All
submitted deliverables will be subjected to a plagiarism check via Turnitin. Any student who is
found guilty of committing an act of academic dishonesty, e.g., plagiarism or soliciting external
help, will be severely dealt with. You may be given a FAIL grade.
Acknowledging Your Use of AI
If you completed any work with the aid of an AI tool, please always acknowledge the use.
4
AI Tool used How is the tool used in the work
Teamwork
Teamwork is very important for this project. Please meet regularly with all your group members
and ensure that everyone contributes towards the report and the presentation. Please discuss with
your lecturer if your group is facing any problems. There will be a peer review at the end of the
semester to gauge your contribution in your respective groups. Despite good intentions and effort,
it happens that some group members fail to take their role within the group seriously. If your group
is experiencing such challenges, please follow this procedure:
a. Active members should make significant effort to contact the slacking member(s) by all
means; for example, e-mail, phone, locate him/her at lectures etc.
b. Maintain a paper trail of interactions between the group members and the slacking
member (e.g., keep a proper log of communications and events), in order to substantiate the
claim of “significant effort” mentioned in paragraph (a) above.
c. Contact the lecturer to report and discuss the group’s problems in a meeting. You should do
this early and not wait until the last minute. Bring all supporting evidence to the meeting. The
lecturer will investigate the problem and take appropriate action. Please note that the lecturer
will not mediate in all other cases (e.g., social incompatibility, skills mismatch, etc).