ICE Acknowledges Contract with Spyware Firm
A letter dated April 1, 2026 may be one of the most significant, and alarming, surveillance disclosures in recent memory. In it, ICE Acting Director Todd Lyons confirmed to Congress that his agency is deploying Graphite, a powerful spyware capable of hacking into encrypted messages on a target’s phone without said target ever clicking a link. The revelation didn’t arrive in a vacuum. As we have previously covered, this revelation is just the latest chapter in a long, bipartisan expansion of federal surveillance powers and their law enforcement agencies.
While Lyons insisted that ICE’s Homeland Security Investigations (“HSI”), is using the technology as part of its larger mission to disrupt and dismantle foreign terrorist organizations, “particularly those involved in the trafficking of fentanyl,” it raises concerns for privacy experts and advocates. Recall that the controversial Section 702 of the Foreign Intelligence Surveillance Act (“FISA”) gives the government authority to target non-U.S. persons outside the country and intercept their electronic communications, emails, texts, phone calls, without a traditional warrant, so long as the stated purpose is gathering foreign intelligence, but that can often entangle US residents and citizens who interact with any foreign actors. Graphite, made by the firm Paragon Solutions, uses what is known as “zero-click” technology, meaning it can infiltrate an encrypted device and read its messages without the target ever interacting with a malicious link. Paragon Solutions signed a contract with the previous Biden Administration, but that contract was then put on pause over national security concerns before the Trump administration revived it last fall. It is among the most invasive commercial surveillance tools in existence. In fact, Meta disclosed in early 2025 that roughly 90 journalists and civil society members in multiple countries had been targeted with Graphite over WhatsApp, the popular double-encrypted messaging app. As Cooper Quintin of the Electronic Frontier Foundation lays out, “The biggest concern now is that Lyons’ response doesn’t rule out ICE using an administrative subpoena to deploy this malware against people living in the United States” and that, “An extremely invasive surveillance capability such as this should require the strongest judicial oversight and confirmation that such intrusion is necessary and [a] proportionate response to the crime being investigated.” US House of Representative member Summer Lee, one of the lawmakers who had asked ICE about its spyware use back in October 2024, was direct in her assessment of Lyons’ response against those who may protest the government and that they, “deserve more than secrecy and deflection from an agency with a long record of overreach and abuse.” A Department of Homeland Security official refuted the characterization, stating that the agency “is a law enforcement agency” and that using technology, “aids in the arrest of criminal gang members, child sex offenders, murderers, drug dealers, identity thieves and more, all while respecting civil liberties and privacy interests.” This revelation comes amongst a growing concern over federal law enforcement practices, with legislators debating whether to close a separate loophole that allows federal agencies to purchase bulk data about millions of Americans from commercial data brokers, without a warrant and without most Americans’ knowledge.
What this revelation makes clear is that the government has the tools and what it believes to be the appropriate authorization in certain instances to surveille its residents and citizens without judicial oversight, a troubling development for anyone who believes in the protections of the Fourth Amendment. All hope is not lost for privacy advocates and United States residents/citizens, even with these expansive powers as there are many challenges a skilled attorney can make to argue that law enforcement agencies’ use of Graphite and similar technologies amount to unconstitutional searches. There are still meaningful constraints against wholesale investigations without proper procedure first taking place. Anyone who learns they may have been surveilled or is facing criminal charges as the result of the use of monitoring technology should hire an experienced criminal defense attorney who can scrutinize law enforcement’s actions and ensure that your constitutional rights were not violated in the process.
