BGP Hijacking Explained: How Internet Traffic Can Be Redirected and Why Telegram Users Were Affected

If you've recently searched for what is BGP hijacking, you're not alone. The term has entered mainstream discussion after Telegram CEO Pavel Durov claimed that access to Telegram was being disrupted through a technique known as BGP hijacking during India's temporary restrictions on the platform.

While many internet users may never have heard of the Border Gateway Protocol (BGP), it plays a critical role in ensuring data travels across the global internet. When BGP functions correctly, users can access websites, messaging apps, and online services seamlessly. When it is manipulated or misconfigured, however, traffic can be redirected, intercepted, slowed, or blocked.

This article explains what BGP hijacking is, how it works, why it matters, and how the recent Telegram controversy has renewed concerns about internet routing security.

What Is BGP Hijacking?

BGP hijacking occurs when a network falsely announces that it is the best route to reach a particular IP address range.

The Border Gateway Protocol acts as the internet's routing system. It allows thousands of independent networks, known as Autonomous Systems (AS), to exchange information about how traffic should travel across the internet.

Under normal circumstances, networks advertise legitimate routes to destinations. During a BGP hijack, however, a network incorrectly claims ownership of routes it does not control. As a result, internet traffic may be redirected through the announcing network instead of its intended destination.

The consequences can range from temporary service disruptions to large-scale outages affecting millions of users.

How Does BGP Work?

Think of BGP as the internet's GPS system.

Every major internet provider, cloud platform, telecom company, and large organization operates networks that exchange routing information through BGP.

When you open a website or send a Telegram message, your request travels through multiple networks before reaching its destination. BGP determines the most efficient path.

Without BGP, the modern internet would not be able to scale globally.

Key functions of BGP include:

• Exchanging routing information between networks
• Identifying reachable IP address blocks
• Selecting preferred routes
• Maintaining global internet connectivity
• Enabling communication between autonomous systems

How BGP Hijacking Happens

A BGP hijack occurs when an autonomous system announces routes that it should not control.

Other networks may accept these announcements because traditional BGP was designed around trust rather than strong authentication.

The process typically follows these steps:

1. A network advertises ownership of an IP address range.
2. Neighboring networks accept the announcement.
3. Traffic destined for the legitimate owner is redirected.
4. Users may experience outages, slowdowns, or connection failures.
5. The incorrect route propagates across the internet.

Depending on the scale of the announcement, the impact can be local, regional, or global.

Telegram, India, and the BGP Hijacking Claims

The latest attention surrounding BGP hijacking stems from the temporary restriction imposed on Telegram in India.

Indian authorities temporarily restricted Telegram after allegations that the platform was being used to distribute leaked examination questions related to the National Eligibility cum Entrance Test (NEET).

According to reports, Telegram channels allegedly offered purported access to examination papers in exchange for payments ranging from a few thousand rupees to several lakh rupees.

Authorities also reportedly instructed Telegram to disable certain platform features, including message editing, for a limited period while investigations continued.

During the disruption, Telegram CEO Pavel Durov alleged that internet traffic was being intentionally redirected through BGP hijacking. He claimed the incident affected not only users in India but also users in other countries, including the United Arab Emirates.

Reports indicated that Autonomous System AS18101 announced Telegram-related IP address space into the global routing table, resulting in accessibility issues beyond India's borders.

Why the Telegram Incident Matters Globally

The Telegram case highlights a key reality of modern internet infrastructure: routing changes in one region can affect users worldwide.

Unlike traditional website blocking methods that rely on DNS filtering or local ISP restrictions, BGP route announcements can have broader consequences if propagated globally.

This creates concerns about:

• Internet resilience
• Cross-border connectivity
• Service reliability
• Network trust models
• Cybersecurity governance

Because the internet is interconnected, routing mistakes or intentional route advertisements can create unexpected consequences for users far beyond the original target region.

Security Risks Associated with BGP Hijacking

BGP hijacking is more than just a service disruption issue.

Potential risks include:

Traffic Interception

Attackers may redirect traffic through systems they control, potentially allowing monitoring or collection of sensitive information.

Service Outages

Users may be unable to reach websites, cloud services, or communication platforms.

Data Manipulation

In advanced attacks, traffic could potentially be altered before reaching its destination.

Financial Damage

Businesses relying on uninterrupted internet connectivity may experience significant revenue losses.

Reputation Risks

Service providers affected by routing incidents can suffer reputational damage and loss of customer trust.

Famous Examples of BGP Hijacking

The Telegram situation is not the first time BGP hijacking has attracted attention.

Several notable incidents have occurred over the years:

These events demonstrate how routing announcements can affect millions of users within minutes.

Can BGP Hijacking Be Prevented?

The internet community has developed several tools to reduce the risk of BGP hijacking.

Resource Public Key Infrastructure (RPKI)

RPKI helps validate whether a network is authorized to announce specific IP address ranges.

Route Filtering

Network operators can reject suspicious route announcements before accepting them.

Monitoring Systems

Real-time monitoring tools detect unexpected routing changes quickly.

Industry Collaboration

Internet providers share threat intelligence and routing information to identify anomalies.

Although these measures significantly improve security, complete elimination of BGP-related risks remains challenging due to the decentralized nature of the internet.

Why Governments and Telecom Operators Are Paying Attention

As digital infrastructure becomes increasingly important, governments worldwide are paying closer attention to routing security.

Reliable internet access is now essential for:

• Education
• Healthcare
• Banking
• Government services
• Communications
• Commerce

The Telegram case demonstrates how internet routing decisions can become part of broader policy, security, and regulatory discussions.

The Future of Internet Routing Security

Experts expect growing adoption of routing security standards such as RPKI and enhanced route validation mechanisms.

Telecom operators, cloud providers, and internet exchanges are investing more heavily in infrastructure security to prevent accidental or malicious route announcements.

As cyber threats evolve, securing the foundational systems that power the internet will remain a top priority.

Key Takeaway

Understanding what is BGP hijacking is increasingly important in a world where internet connectivity underpins daily life. BGP hijacking occurs when networks falsely advertise routes, causing traffic to be redirected away from its intended destination.

The recent Telegram controversy has highlighted how such routing events can affect users across multiple countries, raising broader questions about internet governance, cybersecurity, and infrastructure resilience. Whether caused by error, misconfiguration, or deliberate action, BGP hijacking remains one of the most significant risks facing the global internet routing ecosystem.