Graphite, the Israeli spyware acquired by ICE

The U.S. Immigration and Customs Enforcement (ICE) agency has reactivated a $2 million contract with Paragon Solutions, an Israeli-founded spyware company whose products can hack any cell phone. The agreement includes a fully configured software package, including licensing, hardware, training, and ongoing maintenance.

The original contract with Paragon was signed in September 2024 during the Biden administration, but was put on hold after reports emerged that the technology, known as Graphite, had been misused abroad. Biden’s March 2023 executive order explicitly restricted U.S. agencies from employing spyware vendors whose tools posed “significant counterintelligence and security risks” or had been misused by foreign governments to suppress dissent.

For months, the deal remained under review. However, Florida-based private equity firm AE Industrial Partners acquired Paragon and merged it with Virginia-based intelligence contractor REDLattice, paving the way for its reinstatement. Paragon is now considered a domestic partner rather than a foreign vendor, as it not only has U.S. ownership but also deep ties to former CIA officials and military personnel, according to multiple reports.

Public contracting announcements show that ICE’s Homeland Security Investigations cyber division quietly lifted the suspension order on August 29.

What Graphite can do

Graphite is one of the most powerful commercial spy tools available. Once installed, it can take complete control of the target’s phone and extract text messages, emails, and photos; infiltrate encrypted apps like Signal and WhatsApp; access cloud backups; and covertly activate microphones to turn smartphones into listening devices.

Although companies like Paragon insist their tools are intended to combat terrorism and organized crime, past use suggests otherwise. Earlier this year, Graphite was linked to a surveillance campaign in Italy targeting at least 90 journalists, migrant rights activists, and even associates of Pope Francis. Paragon severed its ties with Italy following public outrage, but the incident heightened skepticism about Graphite’s potential misuse.

WhatsApp, owned by Meta, revealed in early 2025 that it had thwarted a hacking campaign that used Paragon’s tools. The company also sent Paragon a cease-and-desist letter following a legal battle it previously won against its rival, Israeli spyware provider NSO Group, the creator of Pegasus — a program used in multiple countries to spy on journalists and activists.

ICE’s growing power

ICE’s acquisition of Graphite is part of efforts to expand its enforcement operations under Homeland Security Secretary Kristi Noem. The Department of Homeland Security (DHS) has already taken steps such as increasing surveillance of immigrants’ social media accounts, and reports have emerged about plans to use various technologies to track hundreds of thousands of immigrants.

The addition of Graphite to ICE’s technological arsenal raises concerns that the agency could use it to monitor immigrant communities, activists, or political opponents. Critics point out that ICE already has contracts with large surveillance companies like Palantir and Babel Street, which provide tools for analyzing massive amounts of personal data. Graphite’s hacking capabilities take that surveillance to an unprecedented level.

Additionally, because Paragon markets its technology to multiple governments, foreign intelligence services could gain information about the very tools now used by the U.S. John Scott-Railton, a researcher at the Citizen Lab at the University of Toronto, said: “As long as the same mercenary spyware tech is going to multiple governments, there is a baked-in counterintelligence risk.”

Paragon, for its part, claims it only works with democratic governments and rejects clients that misuse its products. However, the company has refused to disclose its client list or provide details on measures to prevent abuse.

Digital rights advocacy groups argue that the U.S. risks undermining its own credibility by adopting tools it once condemned. “Americans should be deeply concerned about how the administration could use this new tool for the purposes of domestic repression,” Michael De Dora of Access Now told The Washington Post.

Sign up for our weekly newsletter to get more English-language news coverage from EL PAÍS USA Edition