When Encryption Protects Privacy and a Phone Does Not

When German police obtained WhatsApp, Telegram, and Signal messages in recent investigations, it wasn’t because they were able to defeat the applications or their cryptography. Law enforcement officers used the official companion clients the companies ship for laptops, the same WhatsApp Web and Signal Desktop sessions ordinary users turn on when they want a keyboard. Ann-Marie Corvin’s Cybernews report and Andre Meister’s Netzpolitik investigation describe the same sequence a person uses to put WhatsApp or Signal on a laptop. An investigator opens WhatsApp Web, Telegram Web, or Signal Desktop, enters the target’s phone number, and waits for the service to demand proof that the account has approved a new client. That proof is a QR code on the computer, which the phone must scan from inside the app, or a short code shown in the app or sent by SMS.

Police then complete that step in three ways: they scan the QR code themselves while the handset is on a desk during questioning; they intercept an unencrypted SMS pairing code through a telephone tap; or the target is induced to scan a QR code that is actually the investigator’s or attacker’s link request. After approval, the provider treats the extra machine as an authorized copy of the account and delivers messages to it in readable form, often with the stored archive. On Signal, a new linked device can also see about forty-five days of recent chats. The couple questioned as witnesses in 2020 left the station with their phones; WhatsApp Web on a BKA computer kept receiving their messages. The suspected dealer in Lower Saxony found the extra Telegram session within hours, after the archive had already been copied.

None of this has anything to do with the security guarantees provided by the applications, and that is what governments exploit.

Private communication is a condition of human dignity. People need a space in which a medical detail, a political argument, a source relationship, or an ordinary intimacy is not automatically available to an employer, a platform, or a government ministry. Constitutions and human-rights law treat that space as a right because a person who must assume every sentence will be logged cannot speak as a free citizen. A limited, court-supervised intercept in a serious criminal investigation can be reconciled with that right. Routine collection, pressure on companies to weaken the tools that make private speech possible, and methods that sweep in months of old messages sit in a different category, one that is more aligned with the suppression of free speech.

Russia and China treat unofficial encryption as a governance problem and build identification, blocking, and punishment around it. Several governments that describe themselves as open are moving along a parallel track. The United Kingdom has spent years demanding technical access that would punch through or sit beside strong encryption. Australia’s assistance and access regime lets the state compel help from device and software makers. In the European Union, successive “chat control” proposals have tried to require scanning of content before it is encrypted. Germany’s Customs Criminal Office ran a messenger-linking pilot from late 2023 and, in August 2025, made the method a standing tool, citing results against serious and organized crime. Criminal-procedure scholars, including Christian Rückert at the University of Bayreuth, argue that cloning an account and pulling stored history looks more like a search of a computer system than a classic live wiretap. The German Federal Court of Justice has already refused to treat at least one such operation as an ordinary telecommunications intercept. The operational practice is ahead of a settled legal theory.

End-to-end encryption is the main technical means ordinary people have to keep the carrier and the service operator out of the text of a conversation. Signal remains the reference implementation: encryption is on by default, the protocol has been studied in public for a decade, and the service is built to store as little as possible about who talked to whom. WhatsApp uses the same protocol family for standard chats, but ongoing lawsuits question whether the implementation has been doctored to enable Meta to read WhatsApp messages. Telegram’s default mode does not. That hierarchy is real, but it also stops at the edge of the phone.

The encrypted messaging protocol governs what happens to a message between two applications. It does not govern malware on the handset, a second laptop added to the account, a notification database kept by the operating system, or a person who can be talked into scanning a code. Justin Hendrix, Cooper Quintin, Caroline Sinders, Leila Wylie Wagner, Tim Bernard, and Ami Mehta make that separation explicit in What is Secure? Analysis of Popular Messaging Apps (June 2023). An application can implement sound cryptography up to its boundaries, with users remaining exposed through either attacks on the device or configuration choices chosen for convenience (e.g., backups, design choices, seized devices, spyware, etc.). Their fieldwork with journalists and other high-risk users found that people often cannot tell where the application’s protection boundary ends. That confusion has political uses. If the public concludes that private speech is impossible, fewer people will insist on using the tools, and fewer will object when legislatures try to pass laws that restrict their usage. Alternately, if the erroneous belief that installing an encrypted app is all that’s needed to preserve privacy is propounded, fewer people will take the additional steps needed: looking at the device list, the lock screen, or the postponed operating-system update.

The incidents that produce “Signal is broken” headlines cluster in three places, and the application’s own security is rarely, if ever, among them.

First, there are the incidents in which commercial spyware takes over the phone. Implants in NSO Group’s Pegasus family of spyware, and later products aimed at iOS and Android, arrive through defects in the operating system or in other applications, frequently iMessage, HomeKit, or image-parsing code. Citizen Lab’s forensic reports on Pegasus infections document full access to data on the device after the implant is running, including messages the messaging app has already decrypted for display. The CISA alert of 24 November 2025 describes spyware and related tooling aimed at users of mobile messengers, delivered through phishing, malicious device-linking QR codes, impersonation of Signal and WhatsApp, and zero-click exploits that require no action from the target. Once the operating system is compromised, chat history, live messages, files, microphone, and location are available on the same terms as any other local data.

Account linking adds an extra authorized endpoint. Google’s Threat Intelligence Group documented Russia-aligned groups dressing device-link QR codes as group invites, security alerts, or pairing pages. The victim scans a code that Signal treats as a legitimate request to add a desktop. From that moment the service delivers each new message to the attacker’s client because that is what multi-device support is for. Meister’s files show German police using the same type of feature with physical access or intercepted SMS codes. Verfassungsschutz and the Federal Office for Information Security have told the public to inspect Signal’s linked-device list and remove unknowns, which is an admission that the failure mode is an approved session, not a broken cipher.

Social engineering and physical custody complete the set. Campaigns that impersonate “Signal Support” ask for the on-screen pairing code. Other campaigns hunt the recovery key that unlocks an encrypted backup. Forensic products used after a phone is seized and unlocked record what the handset already holds, including iOS notification previews of incoming Signal texts that can survive after the app is deleted. Those copies live in Apple’s store, outside Signal’s control.

Engineering papers describe how the application layer can fail even when application cryptography is sound. Jan Wichelmann, Sebastian Berndt, Claudius Pott, and Thomas Eisenbarth, in Help, my Signal has bad Device! (2021), showed that Signal’s multi-device registration, while convenient, can let an attacker who already has long-term identity material and API credentials register a fully working extra device. Cas Cremers, Charlie Jacomme, and Aurora Naska, in Formal Analysis of Session-Handling in Secure Messaging: Lifting Security from Sessions to Conversations (USENIX Security 2023), showed that the Double Ratchet’s recovery properties in a single session do not automatically apply to the bundle of sessions the app presents as one conversation, and that a cloned client can remain in that conversation after a supposed healing period. Those results bound what the product can promise on a phone that has been copied or on an account that accepts a new device too easily. Again, they leave the cryptographic core intact and uncompromised.

Signal remains an essential tool for private speech. Default encryption, minimal metadata, sealed sender, and disappearing messages raise the cost of bulk surveillance and of casual inspection by the service itself. People who need that protection should keep using it, and they should treat the device and the account settings as part of the same discipline.

There are practical steps users can take to minimize device-associated vulnerabilities. Install operating-system and app updates in a timely manner; zero-click chains die when the underlying bug is patched. Decline configuration profiles and sideloaded packages that arrive as a favor or as “support.” Disable lock-screen previews of message content so a borrowed or seized phone does not leave incoming texts in the system notification store. Use a long device passcode. Turn on Signal’s registration lock and PIN. Open the linked-devices screen on a fixed schedule and remove anything you did not add. Start pairing only from inside the app you already have open. Treat an unsolicited QR code that claims to restore, verify, or join a group as a request to hand someone else a live copy of your account. For conversations in which a mistake would be costly, compare safety numbers through a second channel you already trust. If you are a plausible target, assume that unlocked physical access is enough time to start a second session. Keep backup recovery material off the same inbox that receives phishing mail.

A consumer phone will always be a large, networked computer with other apps, a screen, and a human operator. People facing organized targeting sometimes isolate high-risk conversations on a dedicated device or keep them off phones entirely. Everyone else can still refuse two cheap conclusions: that private speech is a fantasy, and that an app icon is a complete defense.

Courts can require a legal basis that matches what linking actually does, including the import of stored history. Legislatures that claim to value open debate can leave working end-to-end encryption alone. Newsrooms can name the layer that failed, the implant, the extra desktop, the scanned code, so the next incident is not filed as proof that the protocol collapsed. The right to a private conversation still depends on the protocol remaining legal, on the phone remaining under the user’s control, and on users taking responsibility for their privacy.