ICE uses – Immigration and Customs Enforcement confirmed last month that its expanding surveillance work includes spyware, saying it has been approved for Homeland Security Investigations to disrupt foreign terrorist groups and fentanyl traffickers. The agency’s only cle
For the first time, Immigration and Customs Enforcement acknowledged it has spyware in its arsenal—and almost immediately the details got tangled in questions that won’t go away.
Last month, ICE said its growing surveillance technology includes spyware. The agency framed the use as part of work by Homeland Security Investigations to disrupt foreign terrorist groups and fentanyl traffickers. Privacy and civil rights advocates, though, are looking past the stated mission. They worry the Trump administration could end up reversing restrictions the U.S. had imposed on some of the most notorious commercial spyware makers.
Steve Feldstein, a senior fellow at the Carnegie Endowment for International Peace, described the shift as erosion. “We’re starting to see erosion. ” he said. warning that “in the coming year. months. we could see further changes that would really put a damper on what I think has been a really important effort to try to hold this industry to account.”.
During the Biden administration, Feldstein said the U.S. reached a high-water mark in pushing back on the industry. That effort included blacklisting and sanctioning some spyware companies and personnel. an executive order limiting the government’s use of commercial spyware. and an international agreement with other democratic countries meant to counter misuse.
Those steps came after revelations that foreign governments used spyware not only against national security threats, but also to spy on political rivals, diplomats, human rights activists and journalists.
Now, ICE’s admission arrives with critics watching a pattern of changes—some of them tied to companies that had previously been punished. Feldstein pointed to the possibility that the counterweight the U.S. built under Biden could shrink.
So far. the Trump administration has lifted sanctions that Biden’s Treasury Department had instituted against three people affiliated with Predator. and it has temporarily revived an ICE contract with the Israeli-founded spyware company Paragon Solutions that had been paused by the Biden administration.
Privacy advocates are also focused on NSO Group. The company makes Pegasus, which researchers have said can turn a phone into a recording device in addition to accessing its contents. Advocates fear NSO Group could be next—because NSO Group is already positioning itself in Washington.
NSO Group has hired a close ally of President Trump as its chairman and is lobbying the administration. The company is on a Department of Commerce so-called “blacklist. ” but it told the public last fall that American investors had acquired the Israeli-founded company. though its current status remains unclear.
“This has been a really troubling period for U.S. actions on spyware,” Michael De Dora, the U.S. advocacy manager for Access Now, said. “There’s a concern that in the coming year. months. we could see further changes that would really put a damper on what I think has been a really important effort to try to hold this industry to account.”.
De Dora argued the Trump administration is not likely to confront the spyware industry forcefully. “There’s no way to look at the facts without seeing that this administration is not going to forcefully work to counter spyware—and actually might be quite comfortable using it and also lifting punishment that has been doled out to spyware violators. ” he said.
What ICE has said—and what remains unclear—centers on contracts, not just assertions.
The Paragon Solutions story is messy. and it ends on a date that raises immediate questions about what ICE can still do. In 2024, ICE signed a now-ended $2 million contract with Paragon Solutions for an unspecified product. The Biden administration put that contract on hold quickly to investigate whether it complied with a 2023 executive order signed by the former president that prohibits federal agencies from purchasing commercial spyware that poses a significant security risk to the U.S. or risks misuse by foreign governments.
Paragon Solutions created a spyware tool called Graphite. described as enabling government agencies to remotely hack into a cell phone without the user knowing or even clicking a link. Last year, WhatsApp found more than 90 users in various countries were targeted with Paragon Solutions spyware. Independent researchers then confirmed that devices of journalists and activists in Italy were targeted with Graphite.
Last August, the Trump administration reinstated the ICE contract with Paragon Solutions and lifted the stop work order. By then, the company had been acquired by an American private equity firm and merged with another company, REDLattice. A notice in federal procurement documents says the Paragon Solutions contract was modified on Jan. 20 this year to close out the contract.
But what “closed out” means in practice is at the center of the dispute. The contract closure could mean services from the original Paragon Solutions deal are no longer available. Or the services could have been rolled into a different arrangement—potentially with a third party that bundles multiple services together. That would make it harder to track ICE’s relationship with Paragon Solutions or its parent entities on procurement websites.
The notice “raises more questions than answers. ” said Julie Mao. an attorney with the nonprofit law firm and advocacy group Just Futures Law. “Particularly since Director Lyons confirmed that ICE continues to use commercial spyware. we do not know whether ICE has ceased using Paragon spyware. continues operations under another contract. or uses some other spyware company that ICE has failed to disclose to the public.”.
Mao’s organization is suing under the Freedom of Information Act for records related to the contract.
A Department of Homeland Security spokesperson told NPR in a statement that the agency had not “entered another contract with Paragon Solutions. Inc.” Yet because Paragon Solutions has been acquired. the significance of that statement is unclear. DHS did not respond to follow-up questions asking if the answer meant ICE had stopped having access to Paragon-developed tools.
NPR could not find evidence of a contract between REDLattice and ICE on federal procurement websites.
The confusion echoes broader complaints about transparency. Mao said it is “part of a long history of ICE and DHS secreting away its surveillance programs from the American public and Congressional oversight.”
The legal uncertainty doesn’t stop at Paragon.
In 2022, The New York Times reported the Drug Enforcement Administration was using Graphite. DEA did not respond to an NPR inquiry about whether it has a current contract for the tool.
Sen. Ron. Wyden, a Democrat from Oregon, has also pressed for answers. His staff have been trying for weeks to schedule a briefing with Paragon Solutions’ American owner, AE Industrial Partners, but the company stopped responding, according to Wyden’s spokesperson Keith Chu.
At the center of this is ICE leadership’s account of authorization.
When ICE’s departing acting Director Todd Lyons responded in writing on April 1. his letter made clear he had approved Homeland Security Investigations to use spyware. He did not name the tool. Lyons’ approval letter said he had signed off on “cutting-edge technological tools that address the specific challenges posed by the Foreign Terrorist Organizations’ thriving exploitation of encrypted communication platforms.” It also said the agency “complies with all requirements” laid out in the 2023 executive order.
The letter said: “Any use of the technology will comply with constitutional requirements and be coordinated with the ICE Office of the Principal Legal Advisor.”
But the letter has not settled the questions critics want to see answered. Activists and lawmakers have asked how broadly HSI agents are using spyware. whether it is being used domestically or only against targets in other countries. and what kind of authorization agents must seek before deploying it.
Congress has already demanded visibility.
Earlier this year, Democratic lawmakers led by Rep. Summer Lee. a Democrat from Pennsylvania. wrote to the Department of Homeland Security asking for all communications related to its use of spyware. That included communications about Paragon Solutions’ Graphite, the targets of any spyware use, and the legal justification.
Lee told NPR she was concerned about inappropriate use, pointing to the Trump administration’s emphasis on combatting “antifa” that many fear could be used to justify a crackdown on political opponents.
Earlier this month. the Trump administration released a counterterrorism strategy that targets “violent left-wing extremists. ” along with drug cartels and Islamist terror groups. while not mentioning violence from the far right—long considered by many to be a major domestic threat. Federal officials also attempted to portray multiple U.S. citizens who were shot by federal immigration agents earlier this year as domestic terrorists.
Lee said the emphasis makes transparency even more urgent. “We already know that Trump has already attempted to change the definition of what a terrorist, or domestic terrorist is,” she said. “So is this just anybody who opposes Trump’s administration, its policies, can this be used against them?”
Maria Villegas Bravo of the Electronic Privacy Information Center said Lyons’ letter still leaves her without the assurance that the constitutional safeguards people expect are being followed.
“It is unclear to her based on Lyons’ letter whether HSI agents using spyware are getting a warrant and proving probable cause first. ” the reporting described. Villegas Bravo said. “They should be—they’re legally required to because you have a Fourth Amendment protection in the content stored on your phone.” She added. “But we have no insight into what’s going on.”.
In a statement, the unnamed DHS spokesperson said ICE employs technology while “respecting civil liberties and privacy interests,” and that DHS law enforcement methods abide by the U.S. Constitution, including the Fourth Amendment.
Behind all of this is a separate, fast-moving track: punishment and restraint.
Last December, the Treasury Department removed three senior figures affiliated with Intellexa, the maker of Predator, from a U.S. sanctions list they had been added to in 2024. One of those individuals later was convicted in Greece in February in connection to Predator abuses in that country. Privacy advocates described that reversal as a blow to the Biden-era effort to rein in the spyware industry.
Villegas Bravo told NPR the lifted sanctions represented “a real backslide.”
Now, her focus and others’ focus is whether other restrictions could be undone—especially around NSO Group. She said she is concerned NSO Group is trying to curry favor with the current administration and get another contract.
“I’m very concerned that NSO group is trying to curry favor with the current administration and trying to get another contract,” Villegas Bravo said.
The NSA’s real-world use of Pegasus has also drawn attention. The Federal Bureau of Investigation piloted using Pegasus in late 2020 and the first half of 2021, The New York Times reported.
Pegasus has also been linked to misuse in various countries and has been found on devices of activists and journalists. That includes devices of people close to Washington Post contributor Jamal Khashoggi, who was murdered in a Saudi embassy in Turkey in 2018.
At the same time, NSO Group is still tied to court battles. The company is currently appealing a court order that bars it from hacking WhatsApp messages stemming from a lawsuit Meta, WhatsApp’s parent company, brought against it.
In that court case and other public statements, the NSO Group has said its goal is to gain business from the American government.
“It is reasonably foreseeable that a law enforcement or intelligence agency of the United States will use Pegasus,” the company wrote in a legal filing.
NSO Group’s leadership has shifted in a way that critics say makes the company more politically connected. David Friedman—who once served as Trump’s bankruptcy lawyer and later as his ambassador to Israel—became the chairman of NSO Group late last year. That appointment came shortly after the company announced it had been acquired by U.S. investors, though the current status remains unclear.
During the Biden administration, the White House warned against American companies acquiring NSO Group. Lee wrote to the Department of Commerce earlier this month asking for a briefing on discussions about the purchase of NSO Group by an American company. and the potential for U.S. government agencies to use the company’s tools.
In her letter, Lee wrote that “The Trump Administration appears to be broadly receptive to using commercial spyware to infiltrate cell phones and allowing U.S. investment in sanctioned spyware companies like NSO Group.”
The immediate question hovering over ICE’s spyware admission isn’t only what tools are being used. It’s why the paperwork looks like it’s changing faster than the public can track.
When ICE says spyware use is approved under constitutional requirements and coordinated with legal advisors. critics want to know how those safeguards play out on the ground. When the Paragon Solutions contract is shown as closed out on Jan. 20 this year. the public wants to know whether that means the capability is gone—or just moved somewhere else. under a different label.
The answer, so far, hasn’t arrived.
Immigration and Customs Enforcement ICE Homeland Security Investigations spyware Graphite Paragon Solutions Todd Lyons Summer Lee NSO Group Pegasus David Friedman Predator Intellexa Commerce Department Entity List Freedom of Information Act Fourth Amendment warrant fentanyl traffickers foreign terrorist organizations