IC Technology & Surveillance — 2026-04-08

ICE Confirms Active Use of Paragon Graphite Zero-Click Spyware on Encrypted Communications Inside the US

ICE acknowledged deploying Paragon Solutions' Graphite zero-click spyware to access encrypted Signal and WhatsApp messages in domestic drug trafficking cases. The agency's April 1 letter to Congress confirmed active use but did not disclose targeting criteria, legal authority, frequency of deployment, or whether US citizens' phones have been compromised. House Democrats criticized the lack of transparency, and the EFF warned ICE may be using administrative subpoenas rather than warrants to deploy the malware. Citizen Lab researchers previously identified Graphite infections on devices belonging to Italian journalists and humanitarian workers.

Analysis
ICE's continued refusal to disclose targeting criteria, legal authority, or whether US citizens have been compromised is the operational gap, not the technology itself. The parallel between Graphite's zero-click capability and NSO Group's Pegasus leaves unresolved whether the executive order restricting commercial spyware use by federal agencies applies to ICE's deployment or DHS carved out an exception.
3 sources
  1. ICE Just Admitted It Uses Spyware That Reads Encrypted Messages - State of Surveillance
  2. ICE acknowledges it is using powerful spyware - Louisville Public Media
  3. ICE confirms it deployed Paragon spyware inside the United States for drug trafficking cases - Silicon Canals

View in full brief →

UNCLASSIFIED // OPEN SOURCE