ICE Acting Director Todd Lyons confirmed in an April 1 letter to Congress that Homeland Security Investigations uses spyware capable of intercepting encrypted messages. The tool is Graphite, built by Israeli firm Paragon Solutions, purchased under a $2 million contract signed at the end of the Biden administration. The Trump administration revived the contract after a brief pause. Lyons justified its use as targeting 'the specific challenges posed by the Foreign Terrorist Organizations' thriving exploitation of encrypted communication platforms.'
The justification is fentanyl. The application will be broader. Every surveillance power in American history followed this trajectory. The question is not whether ICE will expand Graphite's use beyond drug traffickers. The question is how fast.
ICE signed a $2 million contract with Paragon Solutions for Graphite spyware. Biden's team signed it; Trump's team activated it.
Verified
Who
Todd Lyons — ICE Acting Director who confirmed Graphite use in an April 1, 2026 letter to Congress.
What Is Graphite and Why Does Zero-Click Matter?
Graphite uses zero-click technology. It does not require the target to open a link, download a file, or take any action. It penetrates encrypted messaging apps and extracts content from the device. WhatsApp disclosed in early 2025 that Paragon's tool targeted approximately 90 journalists and civil society members across multiple countries. Researchers at the Citizen Lab at the University of Toronto identified specific journalists and humanitarian aid workers in Italy whose phones were infected through WhatsApp messages. Italy terminated its contract with Paragon in 2025 after public outcry.
WhatsApp disclosed that Graphite targeted approximately 90 journalists and civil society members worldwide in early 2025.
Verified
The United States picked up where Italy left off. Paragon Solutions was purchased in late 2024 by American private equity firm AE Industrial Partners and merged with cybersecurity company REDLattice. The spyware that was too controversial for Italy found a willing buyer in ICE.
The Patriot Act Promised Sunsets. Twenty-Five Years Later, It Is Still Here.
“The people most at risk, including immigrants, Black and brown communities, journalists, organizers, and anyone speaking out against government abuse, deserve more than secrecy and deflection. — Rep. Summer Lee
Congress passed the Patriot Act in October 2001 with sunset provisions. Legislators promised temporary powers for a temporary emergency. Those sunsets were extended in 2005, 2010, 2011, and 2015. The surveillance infrastructure built for al-Qaeda was repurposed for drug investigations, financial crimes, and domestic protest monitoring. Section 215, which authorized bulk collection of phone metadata, operated for fourteen years before Congress modified it. The NSA collected billions of records on American citizens who had no connection to terrorism.
Who
Cooper Quintin — EFF senior staff technologist who warned ICE could deploy Graphite using administrative subpoenas without judicial approval.
Bipi NewsReal-Time, Evidence-Based News Reports
Unlimited access to your personalized investigative reporter agent, sourcing real-time and verified reports on any topic. Your personalized news feed starts here.
Create Free AccountFISA courts, created in 1978 to provide judicial oversight of foreign intelligence surveillance, approved 99.97 percent of government requests between 1979 and 2019. The oversight mechanism became a rubber stamp. The Foreign Intelligence Surveillance Act is now up for reauthorization, and Congress is debating whether to close the loophole that allows federal agencies to purchase bulk data on Americans from commercial brokers without a warrant.
Who Decided Americans' Encrypted Messages Could Be Read?
Lyons' letter did not specify who could be targeted with Graphite. Rep. Summer Lee, who co-authored the October 2025 inquiry, said in a statement that ICE provided no answer to her questions about targeting criteria or legal basis for domestic use. Lee identified the populations most at risk: 'immigrants, Black and brown communities, journalists, organizers, and anyone speaking out against government abuse.'
Lyons wrote that use 'will comply with constitutional requirements' and be coordinated with ICE's legal advisor. Cooper Quintin, senior staff technologist at the Electronic Frontier Foundation, identified the gap: Lyons did not rule out using an administrative subpoena to deploy Graphite. Administrative subpoenas require no judicial approval. ICE issues them internally. The 'constitutional requirements' language provides no specific constraint.
The biggest concern now is that Lyons' response doesn't rule out ICE using an administrative subpoena to deploy this malware against people living in the United States as part of their ideological battle against constitutionally protected protest. — Cooper Quintin, Electronic Frontier Foundation
ICE's Surveillance Arsenal Grew 400 Percent Under Two Administrations
Bipi NewsThink Further on BIPI.
Where seeking the truth is a journey, not a destination.
Learn moreGraphite joins an expanding portfolio. The Electronic Frontier Foundation documented ICE's surveillance shopping spree in January 2026: new contracts for location tracking, social media monitoring, facial recognition, and data broker access signed in 2025 alone. NPR reported in March 2026 that ICE had 'spun a massive surveillance web' that extended to American citizens who protested the agency's immigration enforcement actions. The agency purchased bulk commercial data on millions of Americans without warrants.
Maria Villegas Bravo, a lawyer with the Electronic Privacy Information Center, identified the national security paradox: 'By paying for Graphite, the U.S. is helping to bolster the market for technologies that are being exploited by foreign governments to undermine the privacy of messaging applications and carry out invasive surveillance of phones.' The tool designed to protect Americans weakens the encryption infrastructure that protects Americans.
Biden Signed the Order. Trump Authorized the Use.
Biden signed Executive Order 14093 in March 2023, barring the use of commercial spyware that poses national security risks or risks of misuse by foreign governments. The Biden administration then signed the Paragon contract. The Trump administration then activated it. Lyons certified in his letter that he had determined Graphite does not pose significant security or counterintelligence risks. One executive's safeguard became the next executive's permission slip.
The bipartisan nature of surveillance expansion should alarm everyone. Republican administrations build the tools. Democratic administrations normalize them. The next administration inherits both the tools and the precedent. No administration in modern history has voluntarily reduced its own surveillance capabilities.
The Freedom at Stake Is Encrypted Communication Itself
Encrypted messaging exists because people need private communication. Journalists protect sources. Lawyers protect clients. Activists protect members. Families protect conversations. When a government acquires the power to bypass encryption at will, the value of encryption drops to zero for anyone the government decides to target. The fentanyl justification makes the initial deployment politically convenient. The precedent makes every subsequent deployment legally easy. Consent was never sought from the people whose communications are now accessible. Nobody voted to give ICE the power to read encrypted messages. Congress did not authorize it by statute. An agency head approved it in a letter, citing an emergency that will never end, using a tool that will never be returned.
