ICE Director Defends Paragon Spyware Use to Counter Terrorist Encrypted Communications

ICE Acting Director Todd Lyons told three Democratic congresswomen that the agency deployed Paragon Solutions' Graphite spyware to counter foreign terrorists exploiting encrypted communications platforms, even as the agency separately framed the same tool to other audiences as a drug trafficking measure. The letter marked the first public confirmation that ICE purchased and used the surveillance product.

Lyons wrote that he approved ICE's criminal investigative unit, Homeland Security Investigations, to use "cutting-edge technological tools" to counter "foreign terrorist organizations' thriving exploitation of encrypted communication platforms." He added the deployments would "comply with constitutional requirements" and certified that the operational use "does not pose significant security or counterintelligence risks, or significant risks of improper use by a foreign government or foreign person."

The letter was addressed to Representatives Summer Lee of Pennsylvania, Shontel Brown of Ohio, and Yassamin Ansari of Arizona, who had written to DHS Secretary Kristi Noem in October 2025 warning that ICE would "abuse Graphite software to target immigrants, people of color, and individuals who express opposition to ICE's repeated attacks on the rule of law."

Paragon was founded in Israel in 2019 by former intelligence officers including Ehud Schneorson, former commander of Unit 8200, Israel's elite signals intelligence unit, and former Israeli Prime Minister Ehud Barak. ICE signed a $2 million contract with the company on September 27, 2024. The Biden administration suspended it in October 2024, one week after it became public, citing Executive Order 14093, which bars federal use of commercial spyware that poses significant security risks or enables human rights abuses. The Trump administration reactivated the contract in summer 2025, after Boca Raton-based AE Industrial Partners acquired Paragon in a deal reportedly worth approximately $900 million and merged it into REDLattice, a Virginia-based cyber intelligence firm whose board includes Andrew Boyd, a former senior CIA executive, and James McConville, the former U.S. Army Chief of Staff.

Graphite is zero-click spyware: it can compromise a target's device by sending a single message, with no user interaction required. Jeramie Scott, senior counsel at the Electronic Privacy Information Center, described the tool as providing "essentially complete access to your phone," including encrypted messages from Signal and WhatsApp, location data, and photographs, potentially in real time.

Paragon's track record outside the United States complicates the agency's assurances. In January 2025, WhatsApp notified approximately 90 people worldwide that their phones had been targeted via a Graphite exploit. Victims included Italian journalists Francesco Cancellato and Ciro Pellegrino, refugee rights activists Luca Casarini and David Yambio, and associates of Pope Francis. Italy's parliamentary intelligence committee, COPASIR, confirmed seven Italians were targeted before Paragon severed ties with Italian spy agencies. Citizen Lab identified suspected Graphite deployments in Australia, Canada, Cyprus, Denmark, Israel, and Singapore.

The Brennan Center for Justice noted the Supreme Court requires a probable cause warrant before the government searches a cellphone; no public information exists on whether ICE obtained such warrants before deploying Graphite remotely. The Electronic Frontier Foundation warned the tool would be turned on undocumented immigrants, legal immigrants, and U.S. citizens who had spoken out against ICE.

Lyons told interviewers that HSI intends to investigate anti-ICE protest networks: "We are going to track the money. We are going to track these ringleaders," claiming without evidence that many protesters were "professional agitators." HSI has separately contracted with Zignal Labs, a social media monitoring platform that ingests more than 8 billion posts. Together, the tools form a surveillance apparatus that civil liberties groups argue bears little resemblance to the counterterrorism framing Lyons offered to Congress.