German customs used device-linking to silently monitor WhatsApp and Signal accounts

Germany’s Customs Office has reportedly used device-linking features in WhatsApp Web and Signal Desktop to connect a police-controlled computer to suspects’ accounts without breaking encryption, according to reporting cited by Bruce Schneier. Once linked, messages were delivered to the controlled device while remaining encrypted for the user’s primary device.

Access to the target account required either physical access to the suspect’s phone or interception of verification codes via state-sanctioned phishing or SMS surveillance, the report states.

The method relies on user consent to link a new device, but experts note that users often lack visibility into active device links. Schneier argues that a visible list of connected devices with timestamps and the ability to revoke links would improve user awareness and control.

Commenters on the post observe that both WhatsApp and Signal already provide features to display and manage linked devices, including removal capability and activity timestamps, at least on some platforms.

The underlying interception technique is described as an old class of attack that predates modern messaging apps, analogous to telephone network “tee-offs” such as SS7 vulnerabilities discussed publicly since at least 2016.

Discussion of the post frames the challenge as systemic: enabling real-time group communication inherently requires centralized message handling, which creates opportunities for law enforcement or other actors to insert themselves without breaking cryptography.