Messenger Monitoring: How German Police Read WhatsApp, Signal and Telegram Without a Trojan

Executive Summary

On 2 September 2026 Netzpolitik published a classified directive from Germany's Zollkriminalamt (ZKA), the Customs Criminal Office, dated 20 February 2026 and marked "Verschlusssache – Nur für den Dienstgebrauch." It records that the ZKA trialled "Messengerüberwachung," messenger monitoring, from late 2023, that the trial "proved itself and led to significant investigative successes in the area of serious and organised crime," and that on 1 August 2025 the capability was moved into the permanent line structure of a new unit, Operative Dienste, DVIII.C.212, where it is now "permanently available to the investigative units of Customs." The directive describes the method in one sentence: recording data exchanged over instant messengers "without having to infiltrate the IT system with surveillance software (Quellen-TKÜ)." The ZKA does this "using the technical administrative assistance of other federal authorities."

The technique is not exotic. WhatsApp, Telegram and Threema offer web clients; Signal offers a desktop app. Each lets a second device attach to an existing account. Investigators attach a computer they control. What the apps require to permit that is a confirmation, a QR code scanned by the phone or a code delivered in-app or by SMS, and the documents describe three ways police obtain it: physical access to the phone, interception of an SMS code through ordinary telephone surveillance, or phishing. Once linked, the police device receives every message the account sends or receives from then on, and, for most of these apps, the stored history as well. It can also send messages as the account holder and see the contact list. Netzpolitik first documented the BKA using this on WhatsApp in 2021, from a BKA paper dated 2018; the 2026 documents show a second federal agency adopting it as standard practice.

Two court records anchor the story. In January 2020 a married couple, questioned as witnesses about their daughter, voluntarily handed their phones to officers so messages from her could be photographed. According to the file, while the phones were in police hands "the computer-based application WhatsApp Web was covertly activated via a website provided online by the BKA, so that the messages can be read on a BKA computer." The couple were not suspects. In March 2022 a BKA officer "connected" to the Telegram account of a suspected doping dealer in Lower Saxony under a warrant that expressly authorised capture of "retrograde communications data" delivered when a new device registers; before the suspect noticed and removed the device a few hours later, chats from 26 November 2021 to 30 March 2022 had been copied. On 20 January 2026 the Bundesgerichtshof, ruling on that case as 3 StR 495/25, held that covert attachment to a messenger account is source telecommunications surveillance under §100a(1) sentences 2 and 3 StPO, that it may capture only content generated after the judicial order, that the warrant's authorisation of history could not change that, and that the four months of pre-order chats were inadmissible. The court reached that conclusion, its own text notes, "irrespective of the technical details of the approach, which were not disclosed by the investigating authorities."

The ZKA directive, dated one month after the BGH ruling, cites as its legal basis the 2020 investigating-magistrate decision that the BGH had just overturned. Professor Christian Rückert, whose commentary the BGH relied on, argues the vendor tools cannot lawfully be used at all: the statute requires agencies to "technically ensure" that they neither capture history nor alter the target system, and a WhatsApp Web session can do both. The federal government has twice refused to tell the Bundestag how often the method is used, in July on grounds of "unreasonable effort" and on 9 September because the answer would be "particularly in need of secrecy" and touch "the welfare of the state to a particularly high degree." The BKA's own commentary records the countermeasure: the linked-devices screen in the app shows every attached device and lets the user remove it. The doping dealer used it within hours.

Verification of Claims

1. Claim: The ZKA made messenger monitoring a permanent capability on 1 August 2025. → Verified → ZKA directive of 20 February 2026, published in full by Netzpolitik: the pilot "was transferred as of 01.08.2025 into the line structure in the new Operative Dienste unit (DVIII.C.212)."

2. Claim: The method uses the messengers' own multi-device features rather than malware. → Verified → ZKA directive: recording "without having to infiltrate the IT system with surveillance software." BKA paper of 4 June 2018 (Netzpolitik, May 2021): "the entire process is carried out using regularly usable functions of the WhatsApp software." Rückert, MüKoStPO §100b Rn. 38: investigators "use a web client … and register there with the telephone number of the affected person."

3. Claim: Police linked a witness couple's WhatsApp accounts to a BKA computer during a voluntary phone inspection in January 2020. → Verified → Case file passage quoted by Netzpolitik: on 12 January 2020 the couple "voluntarily handed over their mobile phones for a short period" and "WhatsApp Web was covertly activated via a website provided online by the BKA." The investigating magistrate at the BGH ruled on the measure on 9 July 2020 (2 BGs 468/20).

4. Claim: The BGH ruled that history seized through covert attachment is inadmissible. → Verified → BGH, Beschluss 20 January 2026, 3 StR 495/25, headnote: covert attachment "without involvement of the information service provider or user" is Quellen-TKÜ; "only content that arose from the time of the judicial order may be accessed"; unlawful collection beyond that "leads in the individual case to the unusability of the content collected." Facts: chats from 26 November 2021 to 30 March 2022 secured; only those after the 21 March 2022 order were lawful.

5. Claim: The ZKA directive relies on a legal position the BGH had already overturned. → Verified → Directive, 20 February 2026: "According to the legal opinion of the BGH, the technique constitutes a measure under §100a(1) sentence 1 StPO … (BGH Beschluss v. 9.7.2020 – 2 BGs 468/20)." BGH, 20 January 2026: the investigating magistrate's view "is not to be followed"; the measure falls under sentences 2 and 3.

6. Claim: The technique can read a Signal account's previous 45 days of messages. → Verified as an official warning → BSI and Bundesamt für Verfassungsschutz warning of April 2026, quoted by Netzpolitik: attackers "gain additional access to the message contents of the last 45 days." The warning concerns a "presumably state-controlled" phishing campaign, not German police; the mechanism is identical.

7. Claim: Police can send messages from the linked account. → Verified as capability → Rückert, MüKoStPO §100b Rn. 38: "theoretically it would also be possible for investigators to send messages themselves via the account." BSI/BfV: attackers can "send messages in the name of the target person." No case of police doing so is documented.

8. Claim: The BKA has used SMS interception to take over Telegram accounts in dozens of cases. → Partially verified → Netzpolitik states it, citing the Oldschool Society prosecution; the underlying documents are not published. Rückert's commentary confirms SMS interception as a method in general terms.

9. Claim: Federal agencies refuse to disclose how often the method is used. → Verified → ZKA to Netzpolitik: "classified and cannot be published." BKA: "we provide no information in the area of IT surveillance as a matter of principle." Justice Ministry (Staatssekretärin Kramm), July: answer impossible "because of the unreasonable effort." Interior Ministry (Staatssekretärin Ludwig), 9 September: "particularly in need of secrecy."

10. Claim: German police "hacked" WhatsApp or "broke" encryption. → False → Every document describes use of a documented feature with a valid confirmation. No cryptographic weakness is involved; the encryption terminates at a device the user did not know was theirs.

Timeline

Operation Anatomy

The feature being used

Every major messenger supports multiple devices per account. The phone holds the identity; a laptop or browser attaches to it. The attachment is authorised once, by the phone: WhatsApp and Threema show a QR code in the web client for the phone to scan; Signal shows a QR code for the phone's Linked Devices screen; Telegram sends a code to the existing session or, for accounts without one, by SMS. After that, the new device holds its own keys and receives every message. It appears in the account's device list and can be removed there.

Nothing is broken. The end-to-end encryption works exactly as designed, terminating at each linked device. The intervention is at the moment of authorisation.

Three ways to get the confirmation

The device. The 2018 BKA paper describes logging in "using the target person's phone." The 2020 case shows how that access is obtained in practice: the phones were handed over for another purpose, photographing messages, and the link was made during the minutes the officers held them. The confirmation page was "a website provided online by the BKA," which suggests a purpose-built front end rather than web.whatsapp.com itself.

The SMS. Telegram, and other services in some configurations, deliver a login code by text message. A conventional telecom interception order on the phone line, which the doping suspect was already under from 12 January 2022, captures it. Netzpolitik reports the BKA has used this route against Telegram "in dozens of cases," including the Oldschool Society terror prosecution.

Phishing. The BSI/BfV warning of April 2026 describes a state-linked campaign using forged support messages and prepared QR codes to make users link an attacker's device themselves. Netzpolitik notes the same technique is available to police and that the ZKA directive's reference to "operational-tactical deployment" and "specially trained personnel" is consistent with it. No documented German police case uses phishing.

What the linked device receives

The apps differ, and the difference is the legal problem. A linked WhatsApp Web session syncs recent history; Telegram, cloud-based, delivers the account's stored chats; Signal delivers the previous 45 days. In the Aurich case, the Telegram link on the night of 30 March 2022 yielded chats back to 26 November 2021, four months before the link and four months before the order. The apps also expose the contact list and permit sending. Rückert's point is that these are not incidental: the statute requires agencies to "technically ensure" they cannot exceed what is authorised, and a vendor client has no such setting.

How the BGH characterised it

The court did not need the technical details to classify the measure. Because the data was obtained not from the provider under §100a(4) but "by 'attachment' to the Telegram account via a BKA case officer," and because a messenger service used by the target is itself an information-technology system, creating "a further access" is an intervention with technical means in that system. That is Quellen-TKÜ, sentences 2 and 3, with its limit to post-order content. Anything earlier is only reachable by an online search under §100b, ordered by a special chamber of the Landgericht, which was never sought.

The countermeasure

Rückert, describing the method's "criminalistic disadvantage": the affected person "can see in the settings of the app which devices are connected and can also log these devices off." The BSI/BfV advice is the same: check the linked-devices list regularly and remove anything unknown. The doping suspect did this within hours. By then the history had been copied, which is the part the BGH later excluded.

Actor Profile

• Agencies: Zollkriminalamt, unit DVIII.C.212 Operative Dienste, as coordinating centre for Customs investigations; Bundeskriminalamt as the "other federal authority" providing technical assistance and as operator in the 2020 and 2022 cases; state police (Lower Saxony in the Aurich case) as requesting units.
• Legal basis claimed: §100a(1) sentence 1 StPO (ordinary telecom interception), per BGH 2 BGs 468/20 of 9 July 2020, as stated in the ZKA directive of 20 February 2026.
• Legal basis held by the BGH: §100a(1) sentences 2–3 (Quellen-TKÜ), with §100a(5) sentence 1 no. 1 limiting capture to post-order content; history requires §100b.
• Legal basis per Rückert: neither; vendor tools cannot satisfy the "technically ensure" requirement of either provision, so use of them is unlawful and agencies would need purpose-built software.
• Scale: Unknown. Refused to press, refused to parliament twice. The ZKA directive says deployments are "extremely resource-intensive" and must be prioritised via a questionnaire.
• Secrecy: Directive: "extremely sensitive handling is required, also within Customs … 'need to know' applies." Requests from federal and state police for assistance must go through the ZKA "to ensure protection of the method, which has the highest priority."
• MITRE ATT&CK techniques (verified on attack.mitre.org, 12 September 2026; applied descriptively to a state technique):
  • T1078 Valid Accounts (a second authorised device on a legitimate account)
  • T1111 Multi-Factor Authentication Interception (SMS login codes via telecom intercept)
  • T1598 Phishing for Information (linking codes; documented for the state-linked campaign, not German police)
  • T1557 Adversary-in-the-Middle (the linked device as a permanent second endpoint)

Technical Indicators

# There are no network indicators; the "attacker" device is a legitimate
# linked client. Detection is user-side.
where_to_look:
  whatsapp: Settings > Linked devices
  signal: Settings > Linked Devices
  telegram: Settings > Devices (Active sessions)
  threema: Settings > Threema Web (sessions)
what_to_look_for:
  - a device or session you did not add
  - a "web" or "desktop" session while you use only a phone
  - a session created at a time your phone was out of your hands
  - Telegram: a login code SMS you did not request
history_exposed_on_link:
  signal: "previous 45 days (BSI/BfV)"
  telegram: "cloud chat history (BGH facts: ~4 months captured)"
  whatsapp: "recent history synced to linked device"
capabilities_of_linked_device:
  - read all subsequent messages
  - read synced history
  - view contact list
  - send messages as the account
ip_addresses: []
domains: []
file_hashes: []

Legal and Regulatory Response

Courts. BGH, 20 January 2026, 3 StR 495/25, is the controlling decision. It sets aside the Aurich conviction on the counts that rested on pre-order Telegram logs, classifies covert attachment as Quellen-TKÜ, and excludes the history. It cites the Bundesverfassungsgericht's "Trojaner II" decision of 24 June 2025 (1 BvR 180/23) for the principle that Quellen-TKÜ is defined by access to the system rather than by malware, and for the rule that the relevant time is the Quellen-TKÜ order, not an earlier interception order. The 2020 investigating-magistrate ruling (2 BGs 468/20) that had classified the method as ordinary interception is expressly rejected.

Agencies. The ZKA directive post-dates the BGH decision by 31 days and cites the rejected 2020 ruling. Asked whether the decision changed anything, the ZKA said the information is classified; the BKA said it "always follows the current legal situation and its interpretation by the courts." Neither has said whether history capture has stopped or how "technically ensure" is met.

Parliament. Green MP Marcel Emmerich asked the federal government in July 2026 how often messenger monitoring had been used; the Justice Ministry answered only for the Federal Prosecutor and declined on effort grounds. A second question in September, covering BKA, Customs and Federal Police for 2025, was refused by the Interior Ministry as "particularly in need of secrecy": even confirming which surveillance measures exist "allows conclusions about tactical and technical capabilities or capability gaps."

Legislature. No statute names the technique. Rückert's analysis is that it engages the IT-Grundrecht (Art. 2(1) with Art. 1(1) GG) in addition to Art. 10 GG, that this is a "wesentliche" fundamental-rights question the legislature must decide, and that it "cannot be circumvented by creative interpretation of §100a(1) sentence 1, not even by the Bundesgerichtshof."

Providers. No statement from Meta, Signal, Telegram or Threema on the German documents has been reported. All four recommend reviewing linked devices.

Impact Assessment

• Permanent federal capability — Confirmed. ZKA since 1 August 2025; BKA since at least 2018.
• Number of accounts monitored — Unknown. Refused at every level.
• Non-suspects monitored — Confirmed, one case: the 2020 witness couple.
• History captured beyond the order — Confirmed, one case: four months (Aurich). Netzpolitik reports "dozens" of Telegram cases via SMS interception; not independently documented.
• Evidence excluded — Confirmed. Aurich counts II.7 and II.8 set aside.
• Practice changed after the BGH ruling — Unknown. The February directive suggests not; agencies decline to say.
• Detectability by the target — Confirmed. Linked-devices list; the Aurich suspect removed the device within hours.
• Cost to agencies — Reported. "Extremely resource-intensive"; prioritised by questionnaire.

Lessons and Defensive Recommendations

For anyone who uses a messenger for anything sensitive

• Open the linked-devices screen now and again after any occasion your phone was out of your control: a police interview, a border crossing, a repair, a lost-and-found. Remove anything you do not recognise. This is the entire countermeasure and it works.
• Enable a registration lock or PIN (Signal Registration Lock, WhatsApp two-step verification, Telegram two-step verification). It does not stop a QR-code link made with your unlocked phone, but it stops SMS-code takeover.
• Treat a request to scan a QR code, from anyone, as a request to give that person your account.
• On Telegram, be aware that a linked device receives your cloud history, not just new messages; Secret Chats do not sync.

For lawyers

• If a client's messenger content is in a German file, ask when the attachment occurred and when the §100a order was made. Anything sent before the order is excluded under 3 StR 495/25, whatever the warrant said. Ask how the agency "technically ensured" it could not send or alter; on Rückert's analysis, a vendor client cannot.

For messenger developers

• The linked-devices list is doing security work its designers may not have intended. Surface new links loudly on the primary device, show creation time and client type, and consider requiring the PIN for linking as well as registration.
• History sync on link is a product decision with a legal consequence. A no-history link option would give both users and courts a cleaner line.

For policymakers

• Two federal agencies operate a surveillance technique that no statute names, that the highest criminal court has partly ruled unlawful, and whose frequency the government will not state to parliament. That is the finding.

Sources

1. Andre Meister, netzpolitik.org. "Messenger-Überwachung: Immer mehr Polizei überwacht Messenger wie WhatsApp", with full text of the ZKA directive of 20 February 2026 and the Rückert commentary excerpt. 2 September 2026, updated 9 September.
2. Bundesgerichtshof. Beschluss vom 20. Januar 2026 – 3 StR 495/25. ECLI:DE:BGH:2026:200126B3STR495.25.0.
3. HRRS. BGH 3 StR 495/25 – case page.
4. Andre Meister, netzpolitik.org. "Ohne Staatstrojaner: Polizei und Geheimdienste können WhatsApp mitlesen". 10 May 2021.
5. Christian Rückert. Münchener Kommentar zur StPO, 2nd ed., §100b Rn. 38–40a, "Zugriff auf Messenger-Chats durch 'Klonen' eines Accounts." 18 December 2023. Excerpt as published by netzpolitik.org (source 1).
6. Winfuture. "BSI und Verfassungsschutz warnen vor Angriffswelle auf Messenger". 21 April 2026. BSI guidance: Signal-Support.
7. Ann-Marie Corvin, Cybernews. "German police read Signal, Telegram, WhatsApp messages without breaking encryption". 11 September 2026.
8. heise online. "Überwachung ohne Staatstrojaner: Wie Behörden bei WhatsApp und Signal mitlesen". September 2026.
9. dejure.org. BGH, 20.01.2026 – 3 StR 495/25, Verfahrensgang und Fundstellen. NStZ 2026, 372.
10. MITRE ATT&CK. T1078; T1111; T1598; T1557. Accessed 12 September 2026.