04.11.2024
2 min
893
German law enforcement is using built-in features in WhatsApp, Signal, and other messaging apps to access conversations without breaking end-to-end encryption or installing spyware on users’ phones.
New documents published by the German digital rights outlet Netzpolitik show that Germany’s customs law enforcement authorities began testing a method known as “messenger monitoring” in late 2023. In internal documents, officials stressed that details of the method should be handled with strict confidentiality so as not to jeopardize its continued use. At the same time, the technique itself is relatively simple: WhatsApp Web, Signal Desktop, and similar services allow a single account to be linked to additional devices such as a laptop or desktop computer.
Law enforcement agencies are using exactly this capability. They link a police-controlled computer to a person’s account, after which messages can be delivered directly to that device. This means officers do not need to break end-to-end encryption, because they gain access to the conversations through an already authorized device.
Netzpolitik explains that such access can be obtained in several ways. One involves physical access to the phone. Another is intercepting verification codes through a state-authorized phishing attack or capturing SMS messages as part of phone surveillance. In the case of Signal, German security authorities warn that successfully linking an additional device can provide access to messages from the previous 45 days.
Netzpolitik also cites a Telegram case from Lower Saxony. In March 2022, police secretly linked themselves to the account of a man suspected of drug trafficking. He noticed the unauthorized access only several hours later, but by then officers had already copied an archive of his messages. According to official documents reviewed by Netzpolitik, the method became an official practice in August 2025 after authorities reported “significant investigative successes” in cases involving serious and organized crime. At the same time, the outlet questions the legality of the technique, the scale of its use, and how surveillance targets are selected.
Another case highlighted by Netzpolitik dates back to 2020. A married couple who were not suspected of any crime voluntarily handed their phones to police while being questioned as witnesses in a case involving their daughter. They allowed officers to review and photograph messages she had sent them.
While the smartphones were in police custody, officers secretly activated WhatsApp Web and linked the couple’s accounts to a computer operated by Germany’s Federal Criminal Police Office, or BKA. After that, officers could potentially read new WhatsApp messages even after the phones had been returned to their owners, view synchronized conversations and contacts, and send messages on the couple’s behalf. However, they could not monitor WhatsApp voice calls or access the phone’s camera, microphone, regular SMS messages, or apps outside WhatsApp.
The legal status of “messenger monitoring” in Germany remains disputed. In January, Germany’s Federal Court of Justice ruled that secretly linking to Telegram chats in this way constitutes a form of telecommunications surveillance. The ruling rejected an earlier interpretation of the law that customs criminal investigators had still been relying on as recently as February this year.
In the United States, there have also been reports that law enforcement agencies can obtain information from iOS and Android devices through push notifications even when the messaging app itself uses end-to-end encryption. This shows that accessing messages does not always require breaking the encryption itself if authorities can use other mechanisms to gain access to the account or device.
