Documents reviewed by WIRED reveal that the US Immigration and Customs Enforcement has established a contract worth $2 million with Paragon Solutions, an Israeli provider of commercial spyware.
The one-year agreement was initiated between the US subsidiary located in Chantilly, Virginia, and the Homeland Security Investigations Division of ICE on September 27. This contract encompasses a “fully configured proprietary solution that includes license, hardware, warranty, maintenance, and training.”
Paragon secured the contract under the FAR 6.302-1 provision, which is designated for services that are uniquely innovative and not obtainable through the standard competitive procedures.
It remains unclear if this contract pertains to the implementation of Paragon’s leading product, Graphite—software that allegedly retrieves data mainly from cloud backups—or any other of the company’s offerings. Neither ICE nor Paragon have responded to WIRED’s inquiries for comments at this time.
This is not Paragon’s first government agency contract. The New York Times reported in December 2022 that the US Drug Enforcement Administration had used Graphite. Similarly, an intelligence publication reported in March 2023 that Paragon had landed a major contract in Singapore worth “tens of millions of dollars.”
Paragon’s contract comes amid a comprehensive effort by the US government to reshape the commercial spyware market over the past three years. Measures have included placing spyware vendors like NSO Group and Intellexa on the so-called Entity List to prevent any US companies from doing business with them; enacting a visa restriction policy against multiple individuals “who have been involved in the development and sale of commercial spyware or who are immediate family members of those involved,” and imposing consecutive rounds of sanctions against spyware vendors.
Many of these efforts followed President Joe Biden signing an executive order in March 2023 that effectively restricted the US government’s use of commercial spyware technology while promoting its “responsible use” that aligns with the protection of human rights.
On a global level, the US is leading an initiative stipulated in the “Joint Statement on Efforts to Counter the Proliferation and Misuse of Commercial Spyware,” which now counts 21 signatories, including Germany, France, UK, Japan, and South Korea, while it recently announced that it would fund governments and civil society groups around the world to develop spyware-related research and regulation.
Paragon, which describes itself as a meticulous spyware manufacturer, appears to be adapting to the US government’s international initiative for responsible surveillance. On the website of its US branch, the company claims to offer its clients “ethically based tools,” while one of its investors insists that the software delivers “advanced capabilities that enhance global safety.”
Additionally, Paragon asserts that it restricts its data extraction from targeted devices to “conversations on chat applications,” and that it “collaborates exclusively with law enforcement and intelligence agencies that uphold the principles of a progressive democracy, which encompasses only 39 nations.”
Founded in 2019 by veterans from the Israeli Defense Forces’ elite Unit 8200, the company has also attracted investment from former Israeli Prime Minister Ehud Barak, who is reported to own a significant share of Paragon.
The company has attracted funding from Battery Ventures, a Boston-based firm recognized as one of the leading venture capital organizations in the world, and two of its founders have previously been associated with Blumberg Capital, another prominent US venture capital firm.
Israeli media reported in June that a US private equity fund specialized in security companies is in discussions to acquire Paragon, with the company’s valuation estimated at $1 billion.
To maintain its distinctive US-approved, “ethical” branding, Paragon has undertaken “deliberate efforts” since its founding to penetrate the US market, notes the Atlantic Council.
In 2019, while Paragon was working on Graphite, the company sought the expertise of WestExec Advisors, a notable consulting firm from Washington, DC, co-established by former officials from the Obama administration, including the current US Secretary of State Antony Blinken. They were brought in to guide the firm’s “strategic approach to the US and European markets,” as a company executive told the Financial Times. Avril Haines, who previously worked at WestExec, is currently the US director of national intelligence.
In a bid to stay in the good favor of the US government, Paragon in February 2023 hired Holland & Knight, another lobbying firm based in DC known for its effective track record in avoiding sanctions, as some reports indicate. The disclosure of lobbying expenses shows a minimum spending of $280,000 in 2023 and 2024 for this initiative.
The absence of the spyware vendor from any entity list and the lack of sanctions against its executives by the Biden administration indicate that Paragon has been effective in its lobbying efforts.
Moreover, Biden’s executive order provides sufficient leeway for the use of tools like Graphite. When a senior official from the US administration was questioned concerning potential misuse of Paragon’s main product, they stated that the executive order “requires the heads of agencies to review any activity that might be relevant,” implying that lawful applications are not ruled out.
In the meantime, the company is expanding and is promoting various job openings in Israel. In the United States, Paragon has increased its footprint since the executive order was signed, actively recruiting intelligence professionals, including former CIA and FBI agents at its subsidiary, with the intent of securing new contracts. Recent reports from February 2024 have verified this ongoing growth.
Paragon’s contract worth $2 million with ICE serves as concrete evidence that the company’s strategy is yielding results. However, it remains uncertain whether the application of Graphite will be consistent with the safeguarding of human rights, privacy, and democratic values.
