German authorities use account cloning for messenger surveillance

German law enforcement agencies, including the Zollkriminalamt (ZKA) and the Bundeskriminalamt (BKA), have integrated a method known as ‘account cloning’ into their regular investigative operations. This technique allows authorities to monitor encrypted messenger services like WhatsApp, Signal, and Telegram by using official web or desktop clients to establish a secondary access point to a target's account. This process can be achieved by intercepting SMS verification codes or scanning QR codes from seized devices, bypassing the need for expensive state Trojans.

The Federal Court of Justice (BGH) ruled on January 20, 2026, that this practice constitutes ‘source telecommunications surveillance’ (Quellen-TKÜ). Under this legal classification, authorities are permitted to monitor real-time communication but are strictly prohibited from accessing historical chat logs. Despite this ruling, reports indicate that some agencies continued to operate under older legal interpretations for a period following the decision.

Separately, WhatsApp has announced it will end support for Android 5.x devices starting September 8, 2026. Users with older operating systems will need to upgrade to Android 6.0 or newer to continue using the service, a move driven by technical and security requirements.