In one case, police linked the accounts of witnesses, not only the suspect.
Two parents walked into a German police station in January 2020 to testify as witnesses about their daughter.
They handed their phones to the officers so messages from her could be read and photographed.
While they had the phones, the officers quietly paired WhatsApp Web with both accounts through a page run by the federal criminal police.
They kept reading the parents' messages after the couple went home. This is just one of many stories.
Messages arrive decrypted on the police computer, and in some configurations officers can send messages as the account holder.
A classified customs order shows that linking an official machine to a target's WhatsApp, Signal or Telegram account, through the same multi-device feature that runs the desktop apps, became standard practice at Germany's customs police in 2025, after a pilot that began in 2023.
The irony of it all is that German security agencies warn the public about this exact attack when criminals or foreign services run it.
They tell you to check your linked devices and remove any you don't recognise.
No parliament has passed a law on any of these German police practices, in which they scan the pairing QR code off the phone during questioning, pull the verification code out of an SMS intercept, or phish it.
The Federal Court of Justice ruled in January that secretly attaching to an account counts as source interception, which rules out hoovering up chats from before the order.
