WhatsApp and Signal Conversations Are Being Read and Saved by German Police, Classified Customs Document Reveals

End-to-end encryption cannot keep your messages private when police quietly add themselves as one of your trusted devices.

German authorities are accessing WhatsApp, Signal, and Telegram accounts through a technique known as “account cloning,” according to a classified customs document published by netzpolitik.org.^[1] Once connected, investigators can monitor new conversations and potentially copy messages you sent before the surveillance began.

The method targets specific accounts rather than every German user. Still, it gives authorities access to encrypted conversations without forcing WhatsApp or Signal to weaken their encryption.

Thanks for subscribing!

Please check your email for your first message.

Never miss the privacy news that affects you.

Join thousands who get the latest security news, scams, and policy changes every week, right to their inbox.

Sign me up

By submitting this form you agree to receive emails from All About Cookies and to the privacy policy and terms.

Police can become one of your linked devices

WhatsApp Web and Signal Desktop allow you to read messages on a computer by linking it to your account. Investigators are reportedly using the same feature to add a police-controlled computer.

The account owner must normally approve the connection by scanning a QR code, confirming the request in the app, or entering a verification code. Authorities may obtain that approval by accessing a seized or voluntarily surrendered phone, intercepting an SMS code, or using phishing tactics.

In one case described by netzpolitik.org, a married couple voluntarily handed their phones to police so officers could photograph messages from their daughter. The officers allegedly used that access to activate WhatsApp Web on a police computer, giving them continued access to later conversations.

After the device is linked, the service recognizes it as an authorized endpoint and sends decrypted messages to it. The encryption still works during transmission, but the police computer now sits inside the protected conversation.

The cloned account may also synchronize older messages. German security agencies have warned that attackers who successfully link a Signal account can access message content from the previous 45 days.

German customs made the technique permanent

Germany’s Customs Criminal Investigation Office, or ZKA, began testing messenger surveillance in late 2023.

The internal directive says the trial produced “significant investigative successes” in serious and organized crime cases. On August 1, 2025, the agency turned the experiment into a permanent surveillance tool available to customs investigators.

The document says deployments require specially trained personnel and are extremely resource-intensive, so the ZKA must prioritize requests. Investigators also need approval from their department leadership and the responsible public prosecutor.

Police agencies can ask the ZKA for help arranging similar surveillance. The office also receives technical assistance from other unnamed federal authorities.

The document instructed officials to treat the method with extreme sensitivity, applying the principle that knowledge should be shared only when necessary.

When netzpolitik.org asked how often the surveillance had been used, the ZKA refused to answer because the information was classified. Germany’s Interior Ministry later said that even confirming which surveillance capabilities federal agencies use could reveal tactical weaknesses and threaten national security.

Courts question whether the surveillance is legal

The ZKA directive cites a 2020 court decision that treated account cloning as a form of conventional telecommunications surveillance.

Germany’s Federal Court of Justice rejected that interpretation in a January 2026 ruling. The court found that secretly linking to a Telegram account without involving the service provider or user qualifies as source telecommunications surveillance, a more invasive category subject to stricter safeguards.

The timing raises questions. The ZKA directive was dated February 20, one month after the court’s ruling, yet it still relied on the older interpretation.

German IT criminal law professor Christian Rückert also argues that ordinary messenger clients cannot satisfy the law’s technical restrictions. These apps may copy conversations from before a surveillance order, import contact lists, and allow investigators to send messages as the account owner.

German law requires authorities to technically prevent themselves from collecting unauthorized information or altering the targeted system, but simply promising not to use those capabilities is insufficient.

Check which devices can read your conversations

Linked-device surveillance can be difficult to notice, but it leaves a trail inside your account settings.

On WhatsApp, open Settings > Linked Devices and log out of anything you do not recognize. WhatsApp provides instructions for reviewing and removing linked devices.

Signal users can open the app’s settings and select Linked Devices. Signal recommends removing every listed device if you are unsure whether it belongs to you.

Avoid sharing verification codes or scanning QR codes sent by another person. Signal also recommends enabling its registration lock, keeping the app updated, and refusing unexpected requests for PINs, passwords, or recovery keys.

End-to-end encryption remains valuable, but every linked phone and computer becomes another place where someone can read your private conversations. It is worth checking exactly who has a seat at the table.

4.8

AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.

Editorial Rating

Claim Deal

On DeleteMe's website

2026 Editors’ Choice

Best Data Removal for Businesses

Privacy Protection

DeleteMe

PROMOTION: Use the Code PARTNER20 for 20% Off

• Data removal service that covers 89–986 sites and re-scans every quarter to catch anything that reappears
• Sends quarterly privacy reports showing what info was found, which brokers had your data, and how long each removal took
• Includes email masking so you can share a stand-in address instead of your real one

Author Details

Thomas Kent

About the Author

Thomas Kent is a multi-disciplined reporter with over a decade of experience covering online platforms, digital trends, and consumer-facing tech. Tom focuses on digital privacy, data tracking, and user behavior, with a particular interest in how cookies, online surveillance, and platform design shape the modern internet experience. His reporting takes a research-driven, news-focused approach, translating complex technical topics into clear, accessible insights.