PENTESTY · EDITORIAL ANALYSIS · · 4 min read
WhatsApp and Signal: who approved the computer receiving messages?
Encryption protects communication in transit, while the business must also decide which devices may join an account and verify when their access ends.
By Pentesty
The September reporting and the judicial case's limits
On September 2, 2026, Netzpolitik reported police use of additional account access, subsequently covered by Cyber Security Brazil. Germany's January 20 decision in 3 StR 495/25 examines a Telegram case and limits on collecting and using messages predating the judicial order. It does not demonstrate broken WhatsApp or Signal encryption or establish a general surveillance permission.
A linked device also participates in the trust relationship
The WhatsApp multi-device architecture documentation describes a separate identity for each device in encrypted communication. Signal documents reviewing and removing linked devices. These features raise a business question: who may add a device, and for what purpose? Check the interfaces and synchronized history for the product and version actually used.
Consider a team communicating with suppliers from a reception computer. The account, the person responsible for its number and the computer's users may have different owners. Record those relationships and approval of the link. Receiving a laptop or having a screen lock password should not be treated as evidence of account access approval.
Connect each link to a business decision
Define which communications belong on the channel, which devices may receive them and who reviews exceptions. A support request to connect a computer should be recognizable and verifiable through an agreed channel. Train people to stop unexpected requests, without treating urgency or the appearance of technical support as authorization.
Keep a minimal record of the account, approved device, owner, purpose and review date. Avoid copying conversations merely to demonstrate that a link exists. The PhantomSub analysis discusses another boundary: what an integration does after receiving a session. Here, the focus is approving and removing the participating device itself.
Test revocation with test accounts and synthetic messages
Plan an authorized exercise using test accounts, controlled devices and content without personal data. Agree in advance who may link, remove and verify access. Use different messages before and after removal to distinguish local history from new delivery. Do not involve an employee's personal account or recreate police investigation techniques.
- Before: confirm which devices participate in the test account and which operations are expected.
- Removal: follow the available official procedure and record the owner, time and displayed result.
- After: check whether the removed device receives new synthetic messages and record the observed condition.
- Continuity: confirm that approved devices still perform their legitimate task without reactivating the removed link.
End access and address previous copies separately
Losing future access and eliminating information already received are different outcomes. A revocation test does not demonstrate the disappearance of screenshots, exports or copies beyond the company's reach. Record the observed limit and assign retention and disposal questions to the owner of the device and information.
Handover of connected assets offers a useful comparison: handing over the object and ending digital associations require separate checks. Include this review in role changes, equipment returns and contract termination. Repeat the sample after changes to the application, policy or support procedure, retaining only the evidence needed.
Frequently asked questions
Does the case prove that WhatsApp or Signal encryption was broken?
No. The discussion concerns additional account access and participating devices. The cited decision addresses Telegram and a specific proceeding; it does not demonstrate a cryptographic flaw in those other services.
What inventory helps review device links?
Connect each account to its approved device, owner and purpose. Compare that record with the links visible in the application the company uses, without collecting personal conversations to complete the inventory.
Does removing a device delete everything it already received?
Verify revocation in terms of future access. Previous copies require separate handling; the exercise does not demonstrate deletion of content outside the organization's reach.
How can the result be demonstrated without exposing real messages?
Use test accounts and synthetic messages, record removal times and observe subsequent delivery. Document devices, versions, results and the authorized sample's limits.
Sources and references
- BGH: decision 3 StR 495/25, January 20, 2026
- Meta Engineering: WhatsApp multi-device architecture
- Signal: linked devices
- Netzpolitik: September 2 reporting on messenger access
Original Pentesty analysis, published October 16, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.