German customs has been secretly and permanently using a messenger account monitoring tool as of August 2025, a leaked directive shows.
The document, which was published by Netzpolitik, shows that the German Customs Criminal Office (ZKA) tested the method, known as account cloning, from late 2023, and decided to make it a permanent tool in its investigations.
The method means that police can access and read messages on messengers such as WhatsApp, Signal, and Telegram without having to install spyware on a person’s phone.
This type of surveillance involves the police creating a clone of an account, effectively opening a second access point to a person’s existing account without their knowledge, and without the need to break encryption. It has been reported that investigators have managed to do this by getting physical access to a phone and activating WhatsApp Web. Verification codes sent by some services can also be intercepted and used to log in; this has been documented with Telegram.
Once access is gained, the amount of data available depends on the service. For example, Telegram’s cloud chats can be accessed, but not Secret Chats that are device-specific and end-to-end encrypted.
The agency’s directive, dated February 20, 2026, mentions organized crime as the target.
The document instructs staff to keep the knowledge of the technique restricted to those who need to know about it in order to perform their duties.
The directive cites a July 2020 Federal Court of Justice ruling that found the technique to be a form of ordinary telecommunications surveillance, and not the more serious, and harder to justify, source telecommunications surveillance.
However, a January 20, 2026 decision by the same court found that covert access to a Telegram account falls into the latter category. In that case, police managed to copy messages that were sent before the court order had been issued, which the court found to be inadmissible as evidence.
The ruling said that in order to obtain this type of historical data, police would have had to have the stricter online search warrant, which they did not. The court also noted that technical safeguards must be in place to ensure that messages that predate the judicial order are not accessed.
However, when the ZKA issued its directive, it cited the older ruling as the legal basis for the technique.
And when asked about the method and the January ruling, a customs spokesperson said the information was “classified and cannot be published.”
Another German law enforcement agency, the BKA, also refused to provide any operational details, saying only that it acts in accordance with the law and court rulings, and that its activities are overseen by prosecutors and judges.
A security warning issued in February 2026 by Germany’s BSI cybersecurity agency and BfV domestic intelligence agency talks of a probably state-sponsored phishing campaign targeting senior politicians, military and diplomatic officials, as well as investigative journalists.
The warning described the attacks as exploiting the “legitimate functions” of messenger apps, and not using malware or technical vulnerabilities. The goal was to gain access to group chats and contact networks, and the agencies urged users to immediately remove any unknown devices from their accounts.
But when it comes to its own activities, the government is not as forthcoming. Marcel Emmerich, an MP from the Green Party, asked how many times federal police, the BKA, and customs had used account cloning in 2025.
But the government refused on September 3, saying that doing so would reveal its capabilities to those under investigation, who would then change their behavior and frustrate the efforts of the police.
The MP was not even given access to the information in a classified form, which he could then not have revealed to the public.
