Device Linking as Wiretap: German Customs Reads WhatsApp and Signal

What was reported

Schneier on Security highlights reporting by netzpolitik.org, which published a document from Germany's Zollkriminalamt (customs criminal office). According to that reporting, investigators use the companion-device features that messaging apps ship for ordinary users: WhatsApp Web, Signal Desktop, and the web clients offered by Telegram and Threema. They register a police-controlled computer as an additional device on the suspect's account. Messages are then delivered to that computer as they would be to a legitimate laptop, so there is no need to crack the encryption.

Per the reporting, the Zollkriminalamt tested the approach in a pilot project starting at the end of 2023. Since August 2025 it has been permanently available to customs investigation units. A professor of IT criminal law quoted in coverage considers the practice unlawful, and the legal questions are separate from the technical ones. We cover only the technical side here.

Why this is not an encryption break

End-to-end encryption protects messages in transit and at rest on the provider's servers. It cannot tell a legitimate endpoint from an illegitimate one that the account holder was tricked or coerced into authorising. A linked device is a fully trusted endpoint, so the attack moves from cryptography to enrollment.

The reporting describes three routes to enrolment. Each one targets the approval step rather than the cipher:

• Physical access to an unlocked phone, so the link can be approved directly.
• Verification-code interception through what coverage describes as state-sanctioned phishing.
• SMS interception, where the code arrives by text and can be captured on the telephone network.

Why it matters beyond law enforcement

Nothing in this technique is exclusive to a state actor. Any adversary who can briefly hold an unlocked phone, or who can socially engineer a user into approving a link prompt, gets the same read access. Criminals and stalkers already abuse linked-device features this way. For security teams, the point is that a messaging account is only as strong as its enrolment flow and the device-management hygiene around it.

For high-risk staff such as executives, journalists, incident responders and anyone handling sensitive negotiations, a linked-device audit should be a routine control, not something done after a suspected compromise.

Practical mitigations

1. 1Review Settings → Linked devices in WhatsApp and Signal (Telegram: Settings → Devices). Remove anything you do not recognise.
2. 2Never approve a link prompt or share a verification code you did not initiate yourself.
3. 3Prefer app-based or passkey-style verification over SMS wherever the app offers it, since SMS codes can be intercepted on the network.
4. 4Keep phones locked with a short auto-lock, and do not hand over an unlocked device.
5. 5Include messaging apps in mobile device management and security awareness programmes for high-risk roles.

Limits of what is known

This is reporting based on a leaked internal document and secondary coverage. We have not independently verified how often the method is used or against whom. The defensive advice holds regardless, because the enrolment weakness is a general property of the design.