← Back

German Police Are Cloning WhatsApp and Signal Accounts to Spy on You

Original version ·

Forget fancy hacking tools. Turns out, German Customs investigators have been getting into encrypted chats using the digital equivalent of a spare key, and they don't even need to break the actual encryption to read your private messages.

The ZKA has been using a method that effectively clones accounts by exploiting the very features designed for your convenience: WhatsApp Web and Signal Desktop. By linking a police-controlled computer to a target's account—often via physical access, phishing, or intercepted codes—they turn their workstation into a legitimate endpoint. Once the link is established, the app treats the snooping device as just another authorized laptop, feeding it decrypted messages in real-time.

This isn't just about reading new texts. The system can sync historical data, with some reports suggesting that Signal sessions can pull in messages from the previous 45 days. The ZKA even had the audacity to call this a "significant success" in organized crime investigations. Despite a recent Federal Court of Justice ruling that such snooping is a deep invasion of privacy, the authorities seem to be moving forward with this "clone and watch" strategy as a permanent tool in their digital shed.

While this sounds like a scene from a cyberpunk thriller, the reality is much more mundane: it’s an institutionalized "man-in-the-middle" attack that relies on the target's own devices to bypass the security they thought was protecting them. If the government can simply register a new browser session to your life, the concept of end-to-end encryption starts feeling a lot like a digital "Do Not Disturb" sign on a door that the police have a skeleton key for. Source: allaboutcookies.org

Comments

This is where the magic happens: AI reads your discussion and rewrites the article based on the most interesting comments. Each strong comment adds points to the meter below. Once the meter is full, the article updates live — no page reload needed.

11/24
  1. Sandboxed Merge-Conflict
    well, there goes the point of end-to-end encryption, doesn't it? glad i use a burner for everything.
    +5 solidA rare moment of clarity from someone who actually understands that encryption is just a suggestion to a bored government agent
  2. Tokenized NullPointer
    lol imagine thinking your chats are private because of an icon. hardware access is king, always has been.
    +6 solidFinally, someone who realizes that physical access makes your fancy software security look like a screen door on a submarine