ICE Authorised Commercial Spyware Later Linked to a Tool That Can Hack Phones and Read Encrypted Chats Without a Click

Todd Lyons, then-acting director of US Immigration and Customs Enforcement (ICE), told members of Congress he had approved Homeland Security Investigations to use 'cutting-edge technological tools' against foreign terrorist organisations and fentanyl-trafficking networks exploiting encrypted apps.

His 1 April 2026 letter did not name the product. It answered congressional questions about Paragon Solutions' Graphite after ICE awarded a $2 million sole-source contract for a 'fully configured proprietary solution' to Paragon Solutions (US) Inc.

The letter said those groups were exploiting encrypted communications platforms, and that any use of the technology would comply with constitutional requirements and be co-ordinated with ICE's Office of the Principal Legal Advisor.

Later reporting identified the tool discussed in connection with the letter as Paragon's Graphite. Lyons did not name Graphite.

What Graphite Can Do

According to researchers, WhatsApp and other reporting on the technology, Paragon's Graphite spyware can remotely compromise phones using so-called zero-click techniques, meaning a target does not necessarily have to open a malicious link or otherwise interact with the attack.

Once a phone is compromised, spyware operating on the device can access information available to the handset and its applications. That can include messages handled by end-to-end encrypted services such as WhatsApp and, according to descriptions of Graphite's capabilities, Signal.

The technique does not require the spyware to break encryption while messages are being transmitted. Instead, it targets the device itself, where messages and other information can already be accessible.

WhatsApp said on 31 January 2025 that it had disrupted a Paragon-linked campaign and reached out to about 90 users in more than two dozen countries. The company said the campaign took place in December 2024 and that it had 'high confidence' the users were targeted and 'possibly compromised'.

Researchers at the University of Toronto's Citizen Lab forensically confirmed Graphite on devices used by people in Italy, including activists Luca Casarini and Giuseppe (Beppe) Caccia.

Italian prosecutors later reported that consultants had found WhatsApp-database anomalies compatible with Graphite on three Android devices used by Casarini, Caccia and journalist Francesco Cancellato.

Italy's Parliamentary Committee for the Security of the Republic (Copasir) said Italian intelligence services had lawfully targeted Casarini and Caccia and found no evidence that journalist Cancellato had been targeted by Italian intelligence.

Separately, prosecutors who inspected a server used by Italy's domestic intelligence agency, AISI, reported that it showed operations against Casarini and Caccia on the night of 14 December 2024, but no trace of an operation against Cancellato.

Those overseas cases document Graphite-related activity outside the United States. They do not establish that ICE used it against journalists, activists or protesters in the US.

ICE's Authorisation and the Paragon Contract

Lyons certified that HSI's operational use of the specific tool did not pose significant counterintelligence or security risks, or significant risks of improper use by a foreign government or foreign person.

The certification was made under Executive Order 14093, signed on 27 March 2023. The order restricts US government operational use of commercial spyware presenting significant counterintelligence or security risks or significant risks of improper use by foreign governments or persons.

Federal procurement records show ICE awarded Paragon Solutions (US) Inc. a $2 million sole-source contract in late September 2024. Contract 70CTD024P00000012 covered a fully configured proprietary solution including a licence, hardware, warranty, maintenance and training.

The contract was signed on 27 September 2024, with a recorded period of performance from 30 September 2024 to 29 September 2025.

ICE placed the contract under a stop-work order on 8 October 2024 while the purchase was reviewed under the government's commercial-spyware restrictions. The order was lifted on 30 August 2025. Procurement records later listed the contract as closed, with its last modification dated 20 January 2026.

Paragon was acquired by US private equity firm AE Industrial Partners in December 2024. The deal included plans to combine Paragon with Virginia-based cybersecurity firm REDLattice, also styled Red Lattice. There is no public evidence that REDLattice later received a new ICE spyware award.

DHS Has Not Explained Whether Access Continues

The contract's recorded performance period ended on 29 September 2025, and procurement records list it as closed after a 20 January 2026 modification. Lyons' 1 April 2026 letter came after both the performance period and the recorded close-out.

The letter describes an approval of procurement and operational use. It does not date that approval or say whether the use occurred under contract 70CTD024P00000012, after the recorded close-out, or through another arrangement. The public record therefore leaves open how the technology Lyons described related to the Paragon contract.

On 22 May 2026, the Department of Homeland Security told NPR that 'ICE has no relationship with Paragon Solutions, Inc. or with the company that acquired them'.

DHS also said ICE had not entered another contract with Paragon, but declined to say whether the agency could still access Paragon-developed tools through a third party or whether it had moved to another commercial spyware supplier.

Senator Gary Peters requested records on ICE's purchase and use of Graphite in a letter dated 23 July 2026, released on 24 July. Senator Ron Wyden and Representative Greg Casar asked the Government Accountability Office on 21 August 2026 to examine how federal agencies, including HSI, acquire and use hacking tools and spyware.