What happened
Immigration and Customs Enforcement has confirmed it is using powerful spyware capable of intercepting encrypted messages. Acting director Todd Lyons disclosed the programme in an April 1 letter to three Democratic members of the House Oversight Committee.
The tool is Graphite, made by Israeli company Paragon Solutions. It can extract data from encrypted messaging apps without the user’s knowledge. ICE signed a $2 million contract with Paragon at the end of the Biden administration.
Why it matters
The disclosure marks the first official acknowledgement that a US law enforcement agency is deploying Graphite. Encrypted messaging is used by billions of people worldwide, and the tool’s capabilities extend far beyond drug trafficking investigations.
Lyons justified the programme by citing “the unprecedented lethality of fentanyl and the exploitation of digital platforms by transnational criminal organisations.” He said he approved the use of “cutting-edge technological tools” to address the threat.
The debate
Supporters of the programme argue it fills a critical intelligence gap. Fentanyl traffickers have increasingly moved operations onto encrypted platforms, making traditional surveillance methods ineffective. Homeland Security Investigations, the unit using the tool, handles transnational drug cases.
Privacy advocates and civil liberties groups counter that spyware of this calibre has a history of misuse. Paragon’s technology has faced scrutiny in other countries where similar tools have been deployed against journalists and political dissidents. Critics argue there are insufficient safeguards to prevent mission creep.
The three Democrats who initially raised concerns in October had asked specifically about Graphite after reports surfaced of the contract. The letter from Lyons did not detail what oversight mechanisms govern the tool’s use.
What happens next
Congressional oversight committees are expected to press for details on how Graphite is being deployed, who authorises its use, and what legal framework governs interception of encrypted communications on US soil. The disclosure is likely to intensify the broader debate over government surveillance powers in the post-encryption era.