German authorities reportedly used the device-linking features in WhatsApp and Signal to add a police-controlled computer to suspects’ accounts and receive future messages without breaking end-to-end encryption. According to the report cited here, access can be gained through temporary physical access to a phone, interception of one-time verification codes through state-authorized phishing, or SMS interception via telecom surveillance; no CVE is involved because the tactic abuses built-in account-linking workflows.
Why it matters: This affects ordinary users of encrypted messaging apps because a linked device can silently copy future chats if someone gains brief access to a phone or its verification codes. Users should regularly check linked-device lists and secure SMS and account-recovery paths, while defenders and rights groups should treat this as a lawful-intercept and surveillance risk rather than a cryptographic break.
Bruce Schneier
2026.09.29
100% relevant
This article establishes a distinct surveillance story about authorities using legitimate linked-device features in secure messaging apps as an interception method, rather than exploiting a software vulnerability or covering an already tracked policy case.
← Back to all stories