A question we're often asked: can German authorities like the BKA (Germany's Federal Criminal Police Office) or the state criminal police offices (LKA) still get into a GrapheneOS device, even when commercial vendors like Cellebrite hit their limits? We took a look at the publicly available information on this.
German authorities use the same commercial tools
By everything that is publicly documented, German investigative agencies have no independent, secret decryption technology that goes beyond what commercial vendors like Cellebrite, MSAB, or GrayKey deliver. Various state criminal police offices — for instance Berlin's LKA with its mobile-forensics unit, Dezernat 71 — use precisely these commercial extraction tools, the same ones deployed in other countries.
A roughly 900 GB collection of internal Cellebrite support requests that became public in 2024 shows the same thing: German investigators turn to Cellebrite's customer support when they run into technical problems — evidence that they rely on the same commercial ecosystem as every other agency worldwide, not on some in-house specialist technology.
A documented case: when even ZITiS can't get in
As far back as 2020 it became public that, in the investigation into a far-right series of attacks, neither the police nor ZITiS (the Central Office for Information Technology in the Security Sphere) — the federal agency specialized in exactly such cases — could decrypt a seized, encrypted device. This shows that even with specialized agencies at their back, German investigators are not automatically able to break modern encryption.
What this means for GrapheneOS
Because the BKA and LKA demonstrably rely on the same commercial tools as everyone else who uses these systems, essentially the same applies to them as we describe in our article on GrapheneOS vs. Cellebrite: a GrapheneOS device kept up to date is, by today's public state of knowledge, unusually resistant to the available forensic extraction methods — regardless of which agency is operating the tool.
The honest caveat
We can't rule out that authorities possess non-public capabilities that are not (yet) documented — as a matter of principle, that cannot be proven from the outside. What we can responsibly say: there is currently no public evidence of an independent BKA or LKA capability to decrypt current GrapheneOS devices that goes beyond the known commercial tools. And it is precisely with those tools that the available documents show clear limits.
Sources: netzpolitik.org — Police and ZITiS cannot decrypt suspects' devices (2020), netzpolitik.org — Cellebrite at a Bavarian authority (2022), Vice — How German investigators crack seized smartphones