ICE Just Admitted It Uses Spyware That Reads Encrypted Messages

Green digital code streaming down a dark screen representing intercepted encrypted data — Photo via Unsplash

TL;DR: ICE acting director Todd Lyons sent a letter to Congress on April 1 confirming, for the first time, that ICE actively uses Paragon's Graphite spyware. The tool reads encrypted Signal and WhatsApp messages using zero-click exploits. No link, no tap, no warning. Lyons says it's for fentanyl trafficking. But his letter didn't answer basic questions about who gets targeted, what legal authority ICE uses, or whether the spyware has been deployed against people inside the United States. The EFF warns ICE could use administrative subpoenas to hack phones of protesters and activists.

What the Letter Actually Says

On April 1, 2026, ICE acting director Todd Lyons responded to an October inquiry from three Democratic members of the House Committee on Oversight and Government Reform: Reps. Summer Lee, Sara Jacobs, and Robert Garcia ^[1].

The letter is the first time ICE has officially acknowledged using Graphite.

Lyons framed the tool's deployment as a response to "the unprecedented lethality of fentanyl" and foreign terrorist organizations using encrypted platforms to operate. He stated ICE's use complies with constitutional requirements and coordinates with the agency's legal office ^[1].

He also certified that Graphite "does not pose significant security or counterintelligence risks", a requirement under the 2023 executive order that the Biden administration used to temporarily halt the contract ^[2].

What the letter didn't say: who ICE has targeted, how many times the tool has been deployed, whether it's been used against people inside the United States, and what specific legal authority ICE relies on to hack phones.

What Graphite Does to Your Phone

Graphite is a zero-click spyware tool made by Israeli firm Paragon Solutions. "Zero-click" means the target doesn't have to do anything. No suspicious link. No malicious attachment. The spyware arrives silently through vulnerabilities in messaging apps themselves ^[3].

Once on your phone, Graphite extracts:

Messages from Signal, WhatsApp, Telegram, and other encrypted apps
Call logs and contact lists
Photos, videos, and stored files
Real-time microphone access
GPS location data

The encryption doesn't matter. Graphite reads messages after they're decrypted on your screen. End-to-end encryption protects messages in transit. Graphite compromises the endpoint.

How We Got Here

The contract has a messy history:

September 2024: ICE signs a $2 million contract with Paragon Solutions at the end of the Biden administration ^[4]
Late 2024: The Biden administration pauses the contract for compliance review against a 2023 executive order barring spyware that threatens human rights ^[4]
Late 2024: U.S. private equity firm AE Industrial Partners acquires Paragon Solutions ^[1]
January 2025: WhatsApp reveals approximately 90 journalists and civil society members were targeted with Graphite globally ^[3]
Fall 2025: The Trump administration revives the contract ^[1]
October 2025: Three House Democrats ask ICE directly whether it uses Graphite
April 1, 2026: Lyons' letter confirms active use, six months after the question was asked

The Questions ICE Won't Answer

Rep. Summer Lee didn't mince words: "The response I received from ICE makes one thing clear. They are moving forward with invasive spyware technology inside the United States" ^[1].

She expressed frustration that Lyons dodged the substantive questions. The letter confirms the tool exists and is active, but reveals nothing about:

Targeting criteria: Who qualifies? Only suspected fentanyl traffickers, or anyone ICE deems a person of interest?
Legal basis: Does ICE obtain warrants, or does it rely on administrative subpoenas that require no judicial oversight?
Domestic deployment: Has Graphite been used against people physically located in the United States?
Scope: How many times has it been deployed? Against how many targets?
Collateral capture: When you hack someone's phone, you capture messages from everyone they communicate with. How is that data handled?

Why the EFF Is Alarmed

Cooper Quintin, a senior researcher at the Electronic Frontier Foundation, zeroed in on the biggest gap in Lyons' letter. "The biggest concern now is that Lyons' response doesn't rule out ICE using an administrative subpoena to deploy this malware against people living in the United States as part of their ideological battle against constitutionally protected protest" ^[1].

Administrative subpoenas don't require a judge's approval. ICE issues them unilaterally. If Graphite can be deployed under that authority, there's no judicial check on who gets hacked.

Maria Villegas Bravo of the Electronic Privacy Information Center warned that the U.S. lacks sufficient regulations preventing government abuse, and that purchasing Graphite "strengthens markets exploited by foreign governments" ^[2].

Translation: when the U.S. government buys spyware, it validates the entire commercial spyware industry: the same industry that sells to authoritarian regimes targeting journalists, dissidents, and human rights workers.

Paragon's Track Record

Paragon markets itself as the "ethical" spyware company, the anti-NSO Group. But the evidence tells a different story.

In January 2025, WhatsApp notified roughly 90 users (journalists and members of civil society across multiple countries) that they'd been targeted with Graphite ^[3]. Citizen Lab's forensic investigation confirmed specific victims in Italy, including journalists and humanitarian rescue workers ^[5].

Their targets included people documenting refugee rescues in the Mediterranean and criticizing Italian immigration policy. That's the "ethical" company ICE is paying $2 million.

After the exposure, Paragon claimed it stopped working with Italian government agencies. Then AE Industrial Partners bought the company, gave it an American corporate parent, and the Trump administration activated the ICE contract.

One Tool in the Arsenal

Graphite doesn't exist in isolation. It's the latest addition to ICE's expanding surveillance toolkit:

Cellebrite ($11M): Physically cracks locked phones after seizure
Palantir ImmigrationOS ($30M): Fuses all surveillance data into targeting profiles
Mobile Fortify: Street-level facial recognition against 200 million photos
Location data brokers: Warrantless phone tracking through ad tech

Cellebrite requires seizing the phone. Graphite doesn't. It works remotely, silently, without the target ever knowing. That's what makes it different. That's what makes it dangerous.

What You Can Do

Update Everything. Now.

Zero-click exploits depend on unpatched vulnerabilities. WhatsApp already patched the Paragon exploit, but only for users who updated. Install iOS, Android, and app updates immediately.

Enable Lockdown Mode (iPhone)

Apple's Lockdown Mode disables many features spyware exploits. It restricts message previews, JavaScript, and network protocols. Enable it in Settings > Privacy & Security.

Reboot Daily

Many zero-click implants don't survive a reboot. Restarting your phone daily won't stop a determined attacker from reinfecting, but it raises the cost and leaves more forensic traces.

Take Apple/Google Warnings Seriously

Both companies send threat notifications when they detect state-sponsored attacks. If you get one, contact a digital security organization like Citizen Lab or Access Now immediately.

The Bottom Line

ICE told Congress it uses spyware that reads encrypted messages. It told Congress this is about fentanyl. It did not tell Congress who it's targeting, how often, under what legal authority, or whether Americans' phones are being hacked.

The same spyware was used against journalists covering refugee rescues. The company that made it is now owned by a U.S. private equity firm. The administration that paused the contract over human rights concerns is gone. The one that revived it won't answer questions.

That's where we are.

References

Published: April 8, 2026