At its simplest - they attack the middleman. Most crooks aren't tech nerds, they're not a lot smarter with technical devices than your average user. So all the

At its simplest - they attack the middleman. Most crooks aren't tech nerds, they're not a lot smarter with technical devices than your average user. So all the cops need to do is go after the central server and then quietly hijack it. After that the choices are pretty much endless. If they used non-standard encryption, ggez, they're probably not smarter than the police. If they did, chances are that the server has an OTA mechanism to update the message application on the phone, so just push out a malicious update that quietly just resends every message to a police controlled server and uploads all messages still stored on the device. Less useful (not as much access to historical messages) but still very useful for tracking criminal activity if you run the tracking net for long enough.