Executive Summary
Recent disclosures indicate that German law enforcement agencies, including the Zollkriminalamt (ZKA) and Bundeskriminalamt (BKA), have institutionalized a technique known as 'Messenger Surveillance' or 'Account Cloning.' This method bypasses end-to-end encryption (E2EE) not by breaking the cryptography, but by leveraging native 'linked device' features (e.g., WhatsApp Web, Signal Desktop) to sync a target's communication to an adversary-controlled machine.
The attack chain involves gaining initial access through physical device manipulation, SMS-based verification code interception via traditional telephone surveillance, or state-sanctioned phishing attacks. Once a device is linked, the adversary can access historical message archives (up to 45 days in Signal), monitor real-time communications, and potentially send messages impersonating the target. Legal challenges in Germany have recently shifted the classification of these acts from standard telecommunications surveillance to high-threshold 'online searches' due to the integrity violations involved.
This trend represents a critical shift in adversary tradecraft against secure messaging platforms, moving away from resource-intensive malware (Staatstrojaner) toward the exploitation of native platform functionalities for persistent monitoring.