[{"data":1,"prerenderedAt":404},["ShallowReactive",2],{"navigation-docs_en":3,"/en/blog/wire-bund-signal-bundestag-vs-nfd-messenger-sovereign-2026-posts_en":51,"/en/blog/wire-bund-signal-bundestag-vs-nfd-messenger-sovereign-2026-surround-posts_en":393},[4],{"title":5,"path":6,"stem":7,"children":8,"page":25},"En","/en","en",[9],{"title":10,"path":11,"stem":12,"children":13,"page":25},"Docs","/en/docs","en/1.docs",[14,26],{"title":15,"path":16,"stem":17,"children":18,"icon":25},"Getting Started","/en/docs/getting-started","en/1.docs/1.getting-started/1.index",[19,21],{"title":20,"path":16,"stem":17,"children":-1},"Introduction",{"title":22,"path":23,"stem":24,"children":-1},"Migration Roadmap","/en/docs/getting-started/migration-fahrplan","en/1.docs/1.getting-started/2.migration-fahrplan",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"Technologies","/en/docs/technologies","en/1.docs/2.technologies",[31,35,39,43,47],{"title":32,"path":33,"stem":34,"children":-1},"Nextcloud","/en/docs/technologies/nextcloud","en/1.docs/2.technologies/1.nextcloud",{"title":36,"path":37,"stem":38,"children":-1},"Matrix / Element","/en/docs/technologies/matrix","en/1.docs/2.technologies/2.matrix",{"title":40,"path":41,"stem":42,"children":-1},"ONLYOFFICE","/en/docs/technologies/onlyoffice","en/1.docs/2.technologies/3.onlyoffice",{"title":44,"path":45,"stem":46,"children":-1},"Ubuntu Linux","/en/docs/technologies/ubuntu","en/1.docs/2.technologies/4.ubuntu",{"title":48,"path":49,"stem":50,"children":-1},"Keycloak","/en/docs/technologies/keycloak","en/1.docs/2.technologies/5.keycloak",{"id":52,"title":53,"authors":54,"badge":60,"body":62,"date":336,"description":337,"extension":338,"faq":339,"howto":355,"image":385,"meta":387,"navigation":388,"path":389,"seo":390,"stem":391,"__hash__":392},"posts_en/en/3.blog/30.wire-bund-signal-bundestag-vs-nfd-messenger-sovereign-2026.md","Wire Bund replaces Signal in the Bundestag – why the BSI VS-NfD approval of 2026 becomes the new standard for sovereign government communication",[55],{"name":56,"to":57,"avatar":58},"europioneer Team","/",{"src":59},"/favicon.svg",{"label":61},"Secure communication",{"type":63,"value":64,"toc":326},"minimark",[65,69,113,118,141,145,183,187,225,229,264,268,283,287],[66,67,53],"h1",{"id":68},"wire-bund-replaces-signal-in-the-bundestag-why-the-bsi-vs-nfd-approval-of-2026-becomes-the-new-standard-for-sovereign-government-communication",[70,71,72,73,77,78,81,82,85,86,89,90,93,94,97,98,101,102,101,105,108,109,112],"p",{},"When the ",[74,75,76],"strong",{},"Federal Office for Information Security (BSI)"," published its approval of ",[74,79,80],{},"Wire Bund"," for classified information at the ",[74,83,84],{},"VS – for official use only (VS-NfD)"," level on ",[74,87,88],{},"27 April 2026",", the news was initially picked up only in trade publications. Five months later, in September 2026, Wire Bund has become the political centrepiece of a structural rebuild of German government communication. The trigger was a ",[74,91,92],{},"large-scale phishing operation against roughly 300 political Signal accounts"," – among them those of Bundestag President Julia Klöckner and two federal ministers – widely attributed to Russian state-adjacent actors. The Bundestag administration has drawn the consequence and is ",[74,95,96],{},"replacing Signal as the standard messenger with Wire",". For the first time at scale, German federal politics runs on a BSI-approved, European messenger platform. For ",[74,99,100],{},"municipal administrations",", ",[74,103,104],{},"schools",[74,106,107],{},"law firms"," and ",[74,110,111],{},"SME IT directors",", this is more than a Berlin personnel matter – it is the reference decision that will set the direction for the next twelve months.",[114,115,117],"h2",{"id":116},"what-actually-happened-in-2026-and-what-is-technically-new-about-it","What actually happened in 2026 – and what is technically new about it",[70,119,120,121,124,125,128,129,132,133,136,137,140],{},"The ",[74,122,123],{},"Signal incident"," in spring 2026 was not an attack on the cryptographic foundation of the messenger. The ",[74,126,127],{},"Signal protocol and end-to-end encryption"," held up. The ",[74,130,131],{},"process"," was attacked – specifically the \"linked-device\" flow in which users pair their chat history to an additional device. Attackers compromised around 300 accounts through fake support messages and manipulated QR codes. The real problem: Signal is cryptographically strong, but ",[74,134,135],{},"not a BSI-approved solution",", is run as an ",[74,138,139],{},"open-source app from a private-sector foundation",", and provides no German contracting party, no German operating model and no formalised update chain. Wire Bund provides exactly that: hardened client builds, German operation, clear responsibilities, formal audits and – with approval in place – BSI clearance for VS-NfD. For federal bodies Wire Bund is currently the only messenger solution with this clearance.",[114,142,144],{"id":143},"why-this-matters-for-municipalities-clinics-schools-and-smes-not-just-federal-ministries","Why this matters for municipalities, clinics, schools and SMEs – not just federal ministries",[70,146,147,148,151,152,155,156,159,160,163,164,167,168,171,172,177,178,182],{},"VS-NfD is formally assigned to the federal and state level. But the ",[74,149,150],{},"technical requirements behind it"," – end-to-end encryption, a German contracting party, an audited update chain, controlled client distribution, separation of metadata and content, defined operating processes – are the reference architecture for any communication layer that carries personal or particularly sensitive data. For a law firm handling client data covered by ",[74,153,154],{},"§203 of the German Criminal Code"," (professional secrecy), a clinic subject to ",[74,157,158],{},"§22 KHG",", a school administration with staff council data, a municipality with critical-infrastructure duties or a manufacturing SME with design data, using ",[74,161,162],{},"Microsoft Teams"," or ",[74,165,166],{},"WhatsApp Business"," is not just a matter of convenience but a ",[74,169,170],{},"structural compliance gap",". The detailed argument is in our post on ",[173,174,176],"a",{"href":175},"/en/blog/microsoft-365-copilot-law-firms-tax-advisors-professional-secrecy-2026","Copilot in law firms and tax advisor offices","; the underlying US legal problem is set out in the post on the ",[173,179,181],{"href":180},"/en/blog/cloud-act-2026","US CLOUD Act",".",[114,184,186],{"id":185},"what-wire-bund-covers-technically-and-what-it-does-not","What Wire Bund covers technically – and what it does not",[70,188,189,190,193,194,197,198,201,202,205,206,101,209,163,212,215,216,220,221,182],{},"Wire fully covers the classic ",[74,191,192],{},"messenger functions",": encrypted 1:1 chats, group chats, voice and video calls, screen sharing, file exchange into the two-digit gigabyte range, calendar integration and ",[74,195,196],{},"federated rooms"," across separate Wire instances. In the VS-Bund variant, metadata is separated, server logs are kept auditable and client builds are delivered through a controlled deployment channel. What Wire does ",[74,199,200],{},"not"," replace is the ",[74,203,204],{},"collaboration layer inside documents"," – for that the established target stack of ",[74,207,208],{},"Nextcloud with Collabora Online",[74,210,211],{},"OpenDesk",[74,213,214],{},"LibreOffice"," remains the answer; the underlying structure is described in our comparison of ",[173,217,219],{"href":218},"/en/blog/nextcloud-vs-onedrive-sharepoint","Nextcloud versus OneDrive and SharePoint",". Wire and Nextcloud are complementary, not redundant. Together they form the sovereign replacement of a classic Microsoft Teams deployment; the systematics are covered in depth in ",[173,222,224],{"href":223},"/en/blog/microsoft-teams-alternative","Microsoft Teams alternative",[114,226,228],{"id":227},"the-nis2-and-bsi-grundschutz-frame-in-2026","The NIS2 and BSI Grundschutz frame in 2026",[70,230,120,231,234,235,238,239,242,243,101,246,101,249,252,253,256,257,259,260,182],{},[74,232,233],{},"NIS2 transposition"," (NIS2UmsuCG) has been in force since ",[74,236,237],{},"6 December 2025"," and requires documented security measures from roughly 29,500 companies in Germany. The 2026 update to the BSI Grundschutz building blocks sharpened building block ",[74,240,241],{},"APP.5"," (Groupware and Messenger): ",[74,244,245],{},"end-to-end encryption",[74,247,248],{},"a German contracting party",[74,250,251],{},"verifiable client provenance"," and a ",[74,254,255],{},"documented update process"," are the standard candidates for satisfying the building block for every organisation under NIS2. Wire Bund meets all criteria; ",[74,258,162],{}," structurally fails the \"German contracting party\" and \"verifiable client provenance\" criteria from a BSI perspective. The contradiction between NIS2 and Microsoft 365 is worked out in detail in our post on ",[173,261,263],{"href":262},"/en/blog/nis2-gdpr-microsoft-paradox","NIS2, GDPR and the Microsoft paradox",[114,265,267],{"id":266},"the-post-quantum-deadline-end-of-2028-as-a-hard-date","The post-quantum deadline – end of 2028 as a hard date",[70,269,270,271,274,275,278,279,282],{},"The BSI approval of Wire Bund runs until the ",[74,272,273],{},"end of 2028",". The reason for the time limit is the missing ",[74,276,277],{},"post-quantum cryptography",". The current X3DH and Double-Ratchet based protocols are secure against classical adversaries but not against a future cryptographically relevant quantum computer. Wire has communicated a concrete ",[74,280,281],{},"post-quantum roadmap","; BSI will only renew the approval if hybrid procedures (classical plus PQ) are in production by the end of 2028. For IT leadership that means: the switch to Wire Bund is not a terminal station but an intermediate stage with a defined next milestone. For WhatsApp and Teams no comparable public PQ roadmap is available for the same period.",[114,284,286],{"id":285},"what-to-do-in-autumn-2026-in-concrete-terms","What to do in autumn 2026 in concrete terms",[70,288,289,290,101,292,101,295,108,297,300,301,304,305,308,309,312,313,316,317,321,322,325],{},"For ",[74,291,111],{},[74,293,294],{},"school administrations",[74,296,107],{},[74,298,299],{},"municipalities",", we recommend three steps. First, the ",[74,302,303],{},"structured inventory"," along the seven-step guide above – experience shows it delivers a solid picture in less than two weeks and the basis for the paper to the executive board, university presidium or municipal council committee. Second, an ",[74,306,307],{},"analysis of Microsoft and WhatsApp data flows"," via ",[173,310,311],{"href":311},"/microsoft"," to make the specific access and metadata situation from your own network visible – this is regularly the decisive body of evidence in front of data protection officers and supervisory authorities. Third, a ",[74,314,315],{},"structured provider selection"," via the categorised ",[173,318,320],{"href":319},"/alternativen","alternatives matrix"," and a first conversation via ",[173,323,324],{"href":324},"/contact"," on migration planning. Anyone with a running Wire pilot by the turn of 2026/2027 and the BSI Grundschutz argumentation documented in-house is not only NIS2-compliant, but closes a compliance gap that supervisory authorities are likely to start actively checking from 2027.",{"title":327,"searchDepth":328,"depth":328,"links":329},"",2,[330,331,332,333,334,335],{"id":116,"depth":328,"text":117},{"id":143,"depth":328,"text":144},{"id":185,"depth":328,"text":186},{"id":227,"depth":328,"text":228},{"id":266,"depth":328,"text":267},{"id":285,"depth":328,"text":286},"2026-09-22T00:00:00.000Z","After the Russian phishing attack on 300 Bundestag Signal accounts, parliament is switching to Wire Bund. What the BSI VS-NfD approval means for public sector and SMEs.","md",[340,343,346,349,352],{"q":341,"a":342},"What is Wire Bund and how does it differ from the public Wire app?","Wire Bund is a specifically hardened variant of the Wire messenger for the German federal administration, approved by the Federal Office for Information Security (BSI) on 27 April 2026 for the processing and transmission of classified information at the \"VS – for official use only\" (VS-NfD) level. Unlike the public Wire app, Wire Bund runs entirely inside a BSI-aligned infrastructure, with a German contracting party, controlled client builds, hardened update processes and a deployment separation from the Wire cloud. The approval is limited to the end of 2028 because mandatory post-quantum cryptography is only being added step by step.",{"q":344,"a":345},"What triggered the Bundestag switch from Signal to Wire?","In spring 2026 around 300 political Signal accounts were compromised, including the accounts of Bundestag President Julia Klöckner and two federal ministers. Signal itself was not hacked; the attack targeted how users handled fake support and verification requests (social engineering exploiting the \"linked-device\" flow). The incident accelerated the political debate about a BSI-approved alternative. Wire Bund had just been approved for VS-NfD at the same time and is currently the only messenger with this clearance for federal agencies.",{"q":347,"a":348},"What does the VS-NfD approval mean in practice for municipalities, schools and SMEs?","VS-NfD is the lowest classified information level and formally applies only to federal and state authorities. But the requirements behind the system – end-to-end encryption, a clear update chain, a German contracting party, verifiable client builds, separation of metadata and content – are a sound building block for every organisation that handles personal data or sensitive business secrets. For municipalities with critical-infrastructure duties, schools with staff council data, medical practices, law firms, tax advisors and manufacturing SMEs with design data, a VS-NfD-capable messenger is the clear reference. It solves the fundamental problem that Microsoft Teams and WhatsApp Business are subject to US access law and are structurally unsuitable for confidential communication.",{"q":350,"a":351},"Can Wire Bund fully replace Microsoft Teams?","Wire covers the core functions of 1:1 chat, group chat, encrypted voice and video calls, screen sharing, file exchange and calendar integration, making it a direct replacement for Teams as a communication layer. What Wire does not replace is the collaboration layer inside documents – this still needs Nextcloud with Collabora Online, OpenDesk or a LibreOffice-based solution. In practice Wire is therefore typically deployed together with a Nextcloud or OpenDesk stack. This is the pattern the Bundestag administration and the initiatives described in our post on [Operation Sovereignty in the Bundestag](/en/blog/bundestag-operation-sovereignty-microsoft-exit-2026) follow.",{"q":353,"a":354},"When does a public body have to migrate from Teams or Signal to Wire Bund?","There is no general legal obligation today. Two frameworks nonetheless create de facto deadlines. First, the NIS2 transposition has required documented security measures for communication systems since December 2025; the 2026 update to the BSI Grundschutz building blocks explicitly names end-to-end encryption and a German contracting party. Second, the German Digital Ministers Conference has announced guidelines on communication software in the public sector for autumn 2026. Public bodies with VS-NfD needs should pilot Wire Bund by the end of 2026; SMEs should introduce a European sovereign alternative to Teams and WhatsApp by the first half of 2027 as part of their NIS2 compliance work at the latest.",{"name":356,"description":357,"totalTime":358,"steps":359},"Introduce Wire Bund or an equivalent VS-NfD-capable messenger in a public body, law firm or SME","Seven steps for IT leadership and data protection officers to move from a Teams, WhatsApp Business or Signal baseline to a sovereign communication layer built on Wire Bund.","P90D",[360,363,367,370,373,379,382],{"name":361,"text":362},"Map communication channels and sensitivity levels","Create a matrix of every communication channel currently in use – Teams, WhatsApp Business, Signal, private WhatsApp groups, SMS, email – and attach the actual categories of content exchanged on each one (appointments, personal data, HR questions, contract negotiations, client matters, VS-NfD content). The result is a clear view of which channels structurally fail your requirements. Experience shows that 30 to 60 per cent of WhatsApp and Teams conversations carry content that belongs on a VS-NfD-capable system.",{"name":364,"text":365},"Consolidate the legal frame and the 2026 BSI Grundschutz update",{"Line up the relevant foundations":366},"the BSI Grundschutz building block \"APP.5 Groupware and Messenger\", the BSI approval list for VS-NfD communication, the NIS2 transposition, the applicable state data protection laws and – for regulated professions – §203 of the German Criminal Code, the BRAO for law firms and §22 of the Hospital Financing Act (KHG) for clinics. The result is the target classification level of your future standard communication.",{"name":368,"text":369},"Define the requirements profile and target architecture","Define the requirements profile along five dimensions – confidentiality (E2E, VS-NfD capability), availability (operating location, failure model), integrity (client signing, update chain), auditability (audit log, compliance export) and interoperability (federation, open interfaces). Wire Bund satisfies four out of five in a federal body; the third dimension \"own update chain\" requires an explicit decision in a state administration or SME environment between SaaS operation and self-hosting in a German data centre.",{"name":371,"text":372},"Select the operating model – federal SaaS, state IT service provider or German provider","For federal bodies the default path is using the central Wire Bund offering under the existing framework agreement. State administrations can go via their state IT service provider (Dataport, ITDZ Berlin, Datenzentrale Baden-Württemberg and others). Municipalities, law firms and SMEs pick a BSI C5-certified German operator with a Wire Bund or Wire Enterprise offering; alternatively self-hosting on an existing VMware or Proxmox cluster with the Wire server is possible, provided internal IT can sustain the update chain.",{"name":374,"text":375},"Run a pilot with a clearly scoped user group",{"Roll Wire out in a pilot with 30 to 120 users from a defined area – HR, executive leadership, IT security, data protection or the procurement office are typically good candidates":376},{" The pilot runs for four to eight weeks in parallel with the existing messenger":377},{" Target":378},"90 per cent of the internal messages of this group move to Wire without endangering collaboration. The pilot is the fastest way to surface technical and organisational misjudgments.",{"name":380,"text":381},"Roll out in waves along the organisation","After a successful pilot the rollout proceeds in waves along the organisational structure. Each wave covers 200 to 800 users, runs for two to three weeks and is accompanied by a short training (30 to 45 minutes). In parallel Teams is disabled for chats or switched into an operating mode that only covers the remaining collaboration features. WhatsApp Business and private WhatsApp groups with work content are closed by directive and archived.",{"name":383,"text":384},"Handle interoperability with external partners and the post-quantum roadmap","Address external communication with law firms, tax advisors, authorities of other states, customers and suppliers. Wire supports guest accounts and federated rooms; moving bilateral channels into Wire is the second rollout step and typically takes 6 to 12 months. Also track the post-quantum roadmap of your provider – the current Wire Bund approval expires at the end of 2028 and will only be renewed with added post-quantum procedures.",{"src":386},"https://images.unsplash.com/photo-1526628953301-3e589a6a8b74?w=1200&q=80",{},true,"/en/blog/wire-bund-signal-bundestag-vs-nfd-messenger-sovereign-2026",{"title":53,"description":337},"en/3.blog/30.wire-bund-signal-bundestag-vs-nfd-messenger-sovereign-2026","A2GXYpRlu-9pauEuSIU1xz40FZdtJtO1CB7M8mmr-x0",[394,399],{"title":395,"path":396,"stem":397,"description":398,"children":-1},"EU Commission and gematik Adopt Matrix – What This Means for German SMEs","/en/blog/eu-commission-matrix","en/3.blog/3.eu-commission-matrix","More and more European institutions are migrating to Matrix/Element for secure communication. A trend that should also guide German SMEs.",{"title":400,"path":401,"stem":402,"description":403,"children":-1},"openDesk hits the municipal mainstream in 2026 – Neuburg an der Donau, Oberkirch and the Swiss Federal Chancellery decision as the DACH tipping point for Germany's 10,500 municipalities","/en/blog/opendesk-municipal-mainstream-neuburg-oberkirch-swiss-federal-chancellery-2026","en/3.blog/31.opendesk-municipal-mainstream-neuburg-oberkirch-swiss-federal-chancellery-2026","On 23 Sep 2026 Behörden Spiegel documents Neuburg's openDesk switch, Switzerland approves 3,000 seats. What that means for Germany's 10,500 municipalities.",1791876238528]