www.it-connect.fr
How German Police Read WhatsApp, Signal, and Telegram Messages Without Spyware
In Germany, police and customs authorities are able to read users' WhatsApp, Signal, and Telegram conversations without having to install spyware or break encryption. What is their secret? The answer lies in a native feature that is being shamelessly misused.
Monitoring messaging apps is a sensitive topic, whether in France or elsewhere. An internal document from the Zollkriminalamt (ZKA), the central customs investigation office, was revealed by a German media outlet (netzpolitik.org), shedding more light on the methods used in Germany. This classified text, dated February 20, 2026, describes the techniques used to read the messages of targeted individuals.
The principle is simple. WhatsApp, Signal, Telegram, and Threema all offer a desktop app. All of them, except Signal, also provide a web client. Investigators then add a second device that they control to the target's account. The messages then arrive in plain text on this machine controlled by the police. End-to-end encryption is not broken, since this machine is now part of the message distribution chain.
According to the document, the ZKA has been testing this method since late 2023. "The tool has proven itself and has led to considerable investigative successes in the field of serious and organized crime", says the ZKA, which made it permanent on August 1, 2025. The same text calls for an "extremely sensitive" handling of the topic so as not to compromise its use. Oops... That failed...
Three Ways to Link a Device Without the Target Knowing
So how do they link a device to an account without the victim being notified? That's the question you should be asking yourself. This is all the more true because to add a device, the existing account must approve the connection, whether via a QR code or a confirmation code.
Three different scenarios are presented:
- Physical access to the smartphone. In January 2020, a couple questioned as witnesses handed their phones to police so they could photograph messages from their daughter. Meanwhile, WhatsApp Web was quietly activated and linked to a computer at the BKA, the federal criminal police.
- Phishing. The code can be obtained through phishing, just as a hacker would do. In early 2026, the BSI and the BfV warned about phishing campaigns via Signal carried out by a likely state-backed actor. I also reported in December 2024 on the compromise of Jean-Noël Barrot's smartphone, which reportedly clicked on a malicious link received on Signal.
- SMS interception. When the code arrives by SMS, it can be intercepted.
The problem is that these tools are not designed for investigators. They are designed for the user, and this is not just passive "listening" since the police could write messages in the user's name.
A Fragile Legal Basis
No law explicitly provides for this method. It is even highly questionable. In 2020, in the couple's case, the examining judge at the Federal Court of Justice (BGH) had attached the use of this technique to classic telecommunications surveillance. On January 20, 2026, the BGH rejected that interpretation.
"Monitoring and recording Telegram conversations through a secret tap, without the involvement of the service provider or the user, constitutes telecommunications surveillance at the source", the ruling states.
The issue is not so much read access as write access. In fact, police could just as easily send a message, delete an existing message, and so on... This goes a step beyond simple monitoring. Above all, messaging apps do not have this read-only mode designed for investigators.
Ultimately, for users, the workaround is the same as against phishing: regularly check the list of linked devices and remove any unknown ones.
What do you think?
