German police do not need to break the encryption on WhatsApp, Signal or Telegram. They add their own device to the account instead — the same way you would set up the desktop app on a laptop. A classified customs order published by Netzpolitik shows the technique has been running as a formal, permanent tool for over a year.
A couple who came in as witnesses
In January 2020, a married couple went to a German police station to testify as witnesses about their daughter. Officers asked for their phones so messages from her could be read and photographed. The parents agreed.
While the officers had the phones, they quietly activated WhatsApp Web against both accounts, through a page run by the federal criminal police. The couple went home. The police kept reading their messages.
A later court filing describes what the officers did as covert. Nothing was installed, no malware was involved, and the parents were never told that handing over a phone for a few minutes meant handing over an ongoing feed of everything they would go on to send and receive.
What linking a device actually gives an investigator
Once a second device is paired, messages arrive on the police computer already decrypted. The encryption worked exactly as designed — it simply delivered to one more endpoint than the account holder knew about.
The providers' own clients were never built with legal limits in mind. Pairing a new device typically syncs message history along with it: Germany's domestic intelligence service and its federal cybersecurity agency have warned that whoever takes over a Signal account gains the last 45 days of message content. Contact lists come across too. And in some configurations, the second device can send messages in the account holder's name.
From pilot project to standard practice
The document Netzpolitik obtained is an internal order from Germany's customs investigation service, classified and dated February 2026. It records that the agency tested "messenger surveillance" as a pilot from late 2023, found that it produced significant results in serious and organised crime cases, and made it a permanent tool for customs investigation units on 1 August 2025. The agency draws on technical assistance from other federal authorities to run it.
The order also instructs staff to treat the method with what it calls extremely sensitive handling, on a need-to-know basis, to avoid jeopardising it for German security authorities generally.
Customs is not the only user. The federal criminal police have used the same approach to get into Telegram accounts in dozens of cases, including the prosecution of the neo-Nazi group Oldschool Society. In Lower Saxony in March 2022, officers connected to a doping dealer's Telegram account. He noticed and cut the connection a few hours later — by which point police had already copied his message archive.
Getting the confirmation code
Pairing a new device requires confirmation from the existing account, so the work is in obtaining that confirmation. Three routes appear in the documented cases: scanning the pairing QR code off a phone that is in the officers' hands for some other reason, intercepting a verification code sent unencrypted by SMS through ordinary telephone surveillance, or phishing the code out of the account holder.
The same routes are used against Germans by people who are not police. Earlier this year, the domestic intelligence service and the cybersecurity agency warned of a likely state-controlled actor phishing messenger accounts, Signal in particular. Their advice to the public is to check the list of devices with access to your account and remove unknown ones immediately — which is the defence against the police version as well, and how the doping dealer in Lower Saxony spotted it.
No law, and a court that has started drawing lines
No German parliament has passed a law authorising any of this. Agencies rely on readings of existing surveillance provisions, and legal experts have not accepted them.
In January 2026 the Federal Court of Justice ruled that secretly attaching to a messenger account is source telecommunications interception, overturning a 2020 decision that had treated it as ordinary wiretapping. That classification matters: source interception covers current communications, not the archive that syncs across when a new device is linked.
Christian Rückert, professor of criminal and IT criminal law at the University of Bayreuth, goes further in what is probably the most thorough legal analysis of the practice. Because cloning an account reaches back into stored chats and technically allows an officer to send messages as the target, he argues it belongs under the rules for online searches — and that even then it is impermissible unless investigators can guarantee, by technical means rather than by wording in a court order, that they cannot alter anything. The providers' own web clients offer no such guarantee.
How often? Classified.
Netzpolitik asked customs and the federal criminal police how long they have used the method, how often, on what legal basis, and how they technically ensure they stay within the law. Customs said the information is classified. The BKA said it does not comment on IT surveillance.
Green MP Marcel Emmerich then put the question to the government twice. The second time — narrowed to a single year — the interior ministry replied that the information is particularly confidential and touches the national interest to a very high degree, because confirming the use of such measures would reveal capabilities and might change the behaviour of surveillance targets.
The raw number of times German federal authorities have cloned someone's messenger account is, on that reasoning, too secret to release at any classification level.
Check your own linked devices
- WhatsApp: Settings → Linked devices
- Signal: Settings → Linked devices
- Telegram: Settings → Devices
Remove sessions you do not recognise. Treat a pairing QR code the way you would treat a password, and remember that no messenger's support team will ever ask for your SMS code or PIN in a chat.
Source: Andre Meister, "Messenger-Überwachung: Immer mehr Polizei überwacht Messenger wie WhatsApp," netzpolitik.org, 2 September 2026, publishing an internal Zollkriminalamt order dated 20 February 2026.
Get the ICD Newsletter
Subscribe for source-forward cyber news, OSINT notes, breach updates, and analysis. Have evidence or a lead? Send it to ICD.
