April 1, 2026

ICE acting director confirmed to Congress the agency uses Paragon's Graphite spyware without disclosing permitted domestic targets or legal basis

In a letter dated April 1, 2026, ICE Acting Director Todd Lyons informed three House Oversight Committee members that Homeland Security Investigations is using Graphite, a zero-click spyware made by Israeli company Paragon Solutions capable of accessing encrypted messages without user interaction. The letter, a belated response to an October 2025 inquiry, did not specify who could be targeted domestically or the legal basis for the tool's use inside the United States. Civil-liberties groups including the Electronic Frontier Foundation and EPIC warned the tool could be deployed against protesters and journalists, not only the fentanyl traffickers cited as the primary justification.

Jurisdiction: Federal
Location: Washington, D.C.

Abuses documented

Actors

On April 1, 2026, ICE Acting Director Todd Lyons sent a letter to three Democratic members of the House Committee on Oversight and Government Reform confirming that Homeland Security Investigations is using Graphite, a commercial zero-click spyware tool made by Israeli firm Paragon Solutions, capable of silently accessing encrypted messages on a target's device without the user clicking on anything.

The letter was a belated response to an October 2025 inquiry from Rep. Summer Lee (D-Pa.) and two colleagues who had sought answers about ICE's potential spyware use. Lyons stated that HSI's use of "cutting-edge technological tools" targets transnational criminal organizations "particularly those involved in the trafficking of fentanyl," and certified the tool complies with a 2023 executive order barring spyware posing significant national security or misuse risks. Lyons did not specify which categories of individuals could be targeted, what judicial authorization is required, or the legal basis for domestic use against persons in the United States. ICE had first contracted with Paragon Solutions at the end of the Biden administration for approximately $2 million, paused the contract under a presidential review, then reactivated it in fall 2025 under the Trump administration.

Civil-liberties organizations responded with alarm. Cooper Quintin of the Electronic Frontier Foundation warned that Lyons' letter "doesn't rule out ICE using an administrative subpoena to deploy this malware against people living in the United States as part of their ideological battle against constitutionally protected protest." Maria Villegas Bravo of EPIC noted the U.S. lacks sufficient regulations to prevent abuse of the technology against constitutional and human rights. Rep. Lee said Lyons' response made "one thing clear: they are moving forward with invasive spyware technology inside the United States," and expressed disappointment that Lyons failed to answer who could be targeted or the legal basis for doing so. WhatsApp had previously disclosed in early 2025 that approximately 90 journalists and civil-society members in multiple countries were targeted with Graphite; Citizen Lab researchers confirmed journalists and humanitarian workers in Italy were among those infected, leading Paragon to end its Italian government contracts in 2025.

Updates

2026-05-22 — DHS contradicted Lyons, claiming ICE has no relationship with Paragon Solutions [3]

By May 22, 2026, the Department of Homeland Security told NPR that "ICE has no relationship with Paragon Solutions, Inc. or with the company that acquired them" — directly contradicting Lyons' April 1 confirmation. DHS did not explain the discrepancy or clarify whether the contract had been terminated in the weeks following the April 1 letter.

Why we recorded this

ICE's confirmation that it has deployed commercial zero-click spyware against domestic targets, without disclosing legal authorization or who may be surveilled, represents a concrete failure of oversight over a surveillance capability with documented history of misuse against journalists and civil society abroad. Absent clear statutory limits and judicial oversight requirements, the agency retains unilateral authority to deploy a tool capable of silently accessing encrypted communications on any targeted device. Civil-liberties organizations and the congressional members who sought answers both warned that this power could be, and may already be, trained on constitutionally protected protest activity — and ICE's own letter declined to rule it out.

Sources

ICE acknowledges it is using powerful spyware — NPR primary accessed July 20, 2026
ICE says it bought Paragon's spyware to use in drug trafficking cases — TechCrunch primary accessed July 20, 2026
DHS says ICE has 'no relationship' with spyware maker Paragon Solutions — NPR primary accessed July 20, 2026