Immigration and Customs Enforcement has confirmed for the first time that it is actively using Graphite, a powerful commercial spyware made by Israeli firm Paragon Solutions, to intercept encrypted messages on targeted devices. The acknowledgement, contained in a letter sent by ICE acting director Todd Lyons to members of Congress on 1 April 2026, opens up a set of serious questions about surveillance powers, civil liberties, and the oversight of law enforcement technology in the United States.
What Is Graphite and How Does It Work?
Graphite is a category of spyware known as “zero-click” surveillance software — meaning it can gain access to a targeted device without the user ever clicking on a link or downloading a file. Once installed, it can read encrypted messages on platforms including Signal and WhatsApp, effectively bypassing the end-to-end encryption that millions of people rely on to protect their private communications. It can also access photos, emails, location data, and essentially everything stored on or transmitted through an infected device.
Paragon Solutions, the Israeli company behind Graphite, describes it as a tool sold exclusively to governments for legitimate law enforcement and intelligence purposes. But the tool’s capabilities are largely indistinguishable from those of Pegasus, made by NSO Group — a spyware that has been linked to the surveillance of journalists, human rights workers, and political opponents around the world.
What ICE Has Confirmed
Lyons’ letter to Congress confirmed that ICE has been using Graphite to intercept communications of fentanyl traffickers. The stated justification is counter-narcotics enforcement, with the agency framing the tool as a targeted weapon against drug trafficking networks. The letter stated that any use “will comply with constitutional requirements” and be coordinated with the ICE Office of the Principal Legal Advisor.
What the letter did not answer was equally significant. It provided no information about the legal authority used to deploy the tool, which individuals or groups have been targeted, how many devices have been infected, or whether the spyware has been used against people located inside the United States. Those omissions have drawn sharp criticism from civil liberties organisations and members of Congress.
Why Civil Liberties Groups Are Alarmed
The Electronic Frontier Foundation and other privacy advocates have raised the concern that ICE’s use of such powerful surveillance technology could extend far beyond drug trafficking. ICE has dramatically expanded its enforcement activities under the Trump administration, and the agency has deployed an array of surveillance tools — including Cellebrite phone-cracking hardware ($11 million contract), Palantir’s ImmigrationOS platform ($30 million), and mobile facial recognition software — as part of a wide-ranging mass deportation programme. The worry is that administrative subpoenas, which have a lower evidentiary threshold than warrants, could potentially be used to deploy Graphite against a much broader range of targets, including protesters and activists.
In early 2025, WhatsApp revealed that around 90 journalists and civil society members in multiple countries had been targeted with Graphite. Researchers at The Citizen Lab at the University of Toronto identified specific journalists and humanitarian workers in Italy whose devices had been infected. Paragon subsequently ended its contract with Italian government agencies.
The Broader Surveillance Picture
ICE’s admission comes as the agency has assembled what critics describe as an unprecedented domestic surveillance apparatus. Location data brokers are being used for warrantless phone tracking through advertising technology. Facial recognition is being deployed at the street level. Palantir’s platform fuses multiple data sources into targeting profiles. Graphite now sits atop this stack as a tool capable of reading the most private communications of anyone it is pointed at.
The Biden administration had placed the Paragon contract under review in 2024, citing an executive order designed to prevent the use of commercial spyware that posed national security risks or risks of misuse by foreign governments. The Trump administration lifted those restrictions upon taking office, allowing the contract to proceed.
What Happens Next
Congressional oversight is now the primary check on how ICE uses this technology. At least one senior lawmaker has formally written to the agency demanding answers to the questions Lyons’ letter left unanswered. How broadly Graphite has been deployed, under what legal authority, and against whom are questions that deserve clear public answers. The confirmation of its use is, in some ways, the beginning of the accountability process — not the end of it.