IC Technology & Surveillance — 2026-04-08
ICE Confirms Active Use of Paragon Graphite Zero-Click Spyware on Encrypted Communications Inside the US
ICE acknowledged deploying Paragon Solutions' Graphite zero-click spyware to access encrypted Signal and WhatsApp messages in domestic drug trafficking cases. The agency's April 1 letter to Congress confirmed active use but did not disclose targeting criteria, legal authority, frequency of deployment, or whether US citizens' phones have been compromised. House Democrats criticized the lack of transparency, and the EFF warned ICE may be using administrative subpoenas rather than warrants to deploy the malware. Citizen Lab researchers previously identified Graphite infections on devices belonging to Italian journalists and humanitarian workers.
ICE's continued refusal to disclose targeting criteria, legal authority, or whether US citizens have been compromised is the operational gap, not the technology itself. The parallel between Graphite's zero-click capability and NSO Group's Pegasus leaves unresolved whether the executive order restricting commercial spyware use by federal agencies applies to ICE's deployment or DHS carved out an exception.