Skip to content

Linked Devices Are the Backdoor Encryption Did Not Close

Netzpolitik documents German police reading Signal, WhatsApp, Telegram, and Threema through linked devices. Encryption stayed intact. The second screen did not.

By THEYDIDNTASK
Linked Devices Are the Backdoor Encryption Did Not Close
Linked Devices Are the Backdoor Encryption Did Not Close

TL;DR

  • —A Netzpolitik document describes customs and police logging into messengers as a linked device instead of breaking encryption.
  • —The method is a second session: a phished code, a coached QR scan, or a web client tied to the suspect's number.
  • —Signal lets you review linked devices in Settings and unlink unfamiliar sessions. Account login protections do not replace this check.
The document On September 30, 2026, Privacy Guides summarized a Netzpolitik report on messenger surveillance by German police and customs. The technique does not break the Signal protocol, WhatsApp's Signal-based chats, Telegram, or Threema. It opens a linked session. Telegram sends a login code to existing devices, which can be phished. WhatsApp wants the link started in the app, then can be coached into accepting a device code. Signal links with a QR code, which can be scanned from a code the target was sent. Netzpolitik's reporting says customs tested this from the end of 2023, used it in investigations, and that the practice has been standing policy since August 2025. Check the devices that can read your messages On your primary phone, open Signal Settings and choose Linked devices. Review the list and unlink any device you do not recognize. Signal's unlinking instructions show the Android and iOS controls. Only scan a device-linking QR code when you intend to connect a device you control. Signal's documentation describes linking as an action in its own settings, with a device unlock before scanning. A login protection does not make an already linked session disappear. Related: access to a seized phone Our GrayKey report covers a separate vendor claim about preserving access to an iPhone's forensic state. That story concerns access to a seized device; this one concerns a second messenger session. The detailed GrayKey coverage is kept in that report. Updated October 3, 2026: clarified that linked sessions are visible in device settings, added Signal's official instructions, and consolidated the separate GrayKey coverage into its own report.

Sources