German police can read WhatsApp, Telegram and Signal chats without breaking encryption! German investigators - including the Federal Criminal Police (BKA) and especially Customs Criminal Office (ZKA) - have a working method to access encrypted conversations in WhatsApp, Telegram and Signal without cracking the encryption itself. They do not decrypt the traffic and do not always need a classic state trojan on the phone. Instead they attach an additional authorized client to the target’s account: WhatsApp Web, Telegram’s web or desktop client, or Signal Desktop. The messenger treats the police computer as a legitimate linked device and delivers messages in plaintext. End-to-end encryption remains technically intact. Authorization is obtained in several ways: • Physical access to the suspect’s or a witness’s phone (for example during an interview). Officers scan the WhatsApp Web QR code or confirm the link inside the app. • Intercepting the SMS verification code through ordinary telephone surveillance (TKÜ). • In some cases, phishing. Once the extra session is live, investigators see new messages in real time. Many clients also automatically sync chat history (Signal typically the last 45 days; WhatsApp and Telegram depend on the client and settings). Documented examples include police using a phone to secretly activate WhatsApp Web on a service computer, and “Aufschaltung” of Telegram accounts that gave access to message archives. In August 2025 ZKA made the technique (“Messenger-Überwachung”) a standard tool after a pilot that began in late 2023. The practice became widely known after netzpolitik published an internal ZKA directive in early September 2026. In January 2026 Germany’s Federal Court of Justice (BGH) classified this covert linking as Quellen-TKÜ (source telecommunications surveillance), not ordinary wiretapping. Under that legal category investigators may collect only new messages written after the court order. Automatic download of the existing chat history exceeds Quellen-TKÜ and would require the stricter online-search warrant (§ 100b StPO). Lawyers and privacy advocates argue the current practice often oversteps that line precisely because the official web and desktop clients pull the archive by default. Users can still detect the extra session in the messenger’s linked-devices settings and revoke it.​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​ Read my article about OpSec ⬇️(Officer's Notes)