German authorities use account cloning to access encrypted chats

German investigative authorities, including the police and customs, are reportedly using a method known as ‘account cloning’ to access encrypted communications on platforms such as WhatsApp and Signal.

According to internal documents from the Customs Investigation Bureau (ZKA) released by Netzpolitik.org, investigators can gain secondary access to target accounts by using standard messenger functions. This is achieved by setting up a web client or desktop application on an investigator's computer and obtaining authorization through intercepted confirmation SMS messages or by surreptitiously scanning a QR code from a target's smartphone.

The practice is legally controversial. Legal experts suggest the method may be unconstitutional because it exceeds the scope of permitted telecommunications surveillance. A primary concern is that setting up a secondary access point automatically synchronizes all historical chat messages, whereas the Federal Court of Justice has previously ruled that source-based surveillance should only capture ongoing communication.