Senator Demands Answers On ICE Hack Tool

Military analysts at computers in a command center — Photo: Gorodenkoff / Shutterstock

When a domestic law-enforcement agency quietly acquires military‑grade spyware that can covertly take over smartphones, the core question is no longer just what the tool can do, but what it does to the constitutional boundary between government power and private life.

Key Points

ICE acknowledged in writing that it purchased and used Paragon Solutions’ Graphite spyware, a tool designed to hack phones and access even encrypted data.
Senator Gary Peters is pressing for answers on why ICE obtained such capabilities, under what legal authority, and with what safeguards, citing serious privacy and civil-liberties risks.
Graphite and similar tools can enable complete device takeover: reading messages, harvesting photos, tracking locations, and activating microphones and cameras without the user’s knowledge.
ICE justifies the purchase as necessary for high‑priority investigations, especially fentanyl trafficking and other serious crimes, but has withheld most operational details and redacted key contract documents.
The controversy sits inside a broader pattern: U.S. agencies adopting commercial spyware in secret, followed by reactive oversight battles over legality, targeting rules, and the rights of both citizens and non‑citizens.

What ICE Bought: Graphite and the Power of Modern Spyware

At the center of Senator Peters’ concerns is ICE’s contract with Paragon Solutions, an Israeli spyware vendor whose flagship product, Graphite, belongs to the same family of tools as the now‑infamous Pegasus system. Public contract records and rights‑group investigations show ICE entered into a roughly $2 million agreement with Paragon in 2024 for a “proprietary solution” widely understood to be Graphite or a closely related capability.

Graphite is designed to infiltrate smartphones and defeat end‑to‑end encryption by compromising the device itself rather than the communication channel. Once implanted, it can reportedly extract encrypted messages, call logs, contact lists, photos, and other data, track a target’s location in real time, and even activate microphones and cameras covertly. Some deployments use “zero‑click” exploits—meaning the target need not tap a malicious link—for the malware to gain control.

From a technical perspective, that capability erases the practical security people assume from using secure messaging apps. It shifts the threat model from “Who can intercept my traffic?” to “Who can own my phone?” When a U.S. agency wields such a tool, it is effectively purchasing the ability to turn the most intimate device most people carry into a government listening post.

ICE’s Stated Justification: Fentanyl and Encrypted Crime

ICE did not publicly disclose its use of Graphite when it signed the contract. The admission came later, in an April 1 letter from Acting Director Todd Lyons to members of Congress, which outlets like NPR, Bloomberg, and TechCrunch obtained and reported on. In that letter, Lyons acknowledged he had approved both the purchase and operational use of the spyware, tying it explicitly to Homeland Security Investigations’ efforts to disrupt fentanyl trafficking and other serious transnational crimes.

Lyons described a familiar law‑enforcement challenge: sophisticated criminal networks using encrypted apps and digital platforms to coordinate operations, launder money, and evade interception. According to his account, Graphite and related tools are part of a “range of technological tools” intended to pierce that shield in high‑stakes investigations, especially those involving fentanyl—a drug now implicated in tens of thousands of overdose deaths annually.

ICE has also folded the spyware into a broader surveillance toolkit that includes facial recognition, phone location tracking, and social‑media monitoring systems, all justified as essential to tackling terrorism, gangs, traffickers, identity thieves, and other serious offenders. In public statements, the agency insists these technologies are used “while respecting liberties and interests” and in coordination with its legal office.

Why Senator Peters Is Alarmed

For Senator Gary Peters, who has spent years digging into Department of Homeland Security surveillance practices, ICE’s assurances ring incomplete at best. In a series of oversight efforts, Peters has highlighted that ICE spent millions of taxpayer dollars on spyware from a company whose tools have been used by foreign governments against journalists, dissidents, and political opponents. He notes that ICE has refused to provide Congress with basic information about how the spyware is used, on whom, and under what legal authority.

In press statements and hearings, Peters frames the concern in both constitutional and practical terms. The same functionality that lets ICE read an encrypted chat between cartel operatives would also let it secretly monitor the phone of a U.S. citizen engaged in lawful protest or political organizing. That is not a speculative risk; human-rights researchers have already documented commercial spyware, including Paragon’s products, used abroad against journalists and civil society actors.

Peters’ questions are concrete: Did ICE obtain warrants or other judicial authorization before deploying Graphite against specific targets? What internal approvals are required? Are U.S. persons—including citizens and lawful residents—off‑limits absent a higher standard? How long is data retained, and who can access it? Thus far, many of those answers remain either classified, redacted, or simply unprovided.

Opacity by Design: Contracts, Redactions, and Executive Orders

One reason Peters and other lawmakers are pressing so hard is the extraordinary opacity surrounding the Paragon contract. When journalists and advocacy groups sought the underlying documents, ICE released heavily redacted records that obscured product details, deployment parameters, and many terms of use, prompting at least one lawsuit to challenge the secrecy.

The contract itself has had a complicated life cycle. ICE initially signed the deal during the latter part of the Biden administration, then suspended it under an executive order that restricted U.S. government use of commercial spyware linked to human-rights abuses or national-security risks. The Trump administration later jettisoned that order, allowing the contract to be reactivated and paving the way for the operational deployment Lyons described to Congress.

That sequence illustrates a structural problem: the effective reach of powerful surveillance tools can change with the stroke of a pen, while external oversight lags behind. An executive order can constrain spyware acquisitions; a different administration can discard those constraints, leaving Congress scrambling to understand what is already in the field.

The Civil-Liberties Risk: Phones as Government Sensors

Privacy and civil liberties advocates argue that tools like Graphite pose a qualitatively different threat from conventional wiretaps. A wiretap captures the content of phone calls or specific communication channels; full device compromise exposes the totality of someone’s digital life—real‑time location, years of messages, photos, health data, cloud backups, and ongoing ambient audio from the microphone.

Groups including the Electronic Frontier Foundation, Human Rights Watch, and the Knight First Amendment Institute have warned that deploying commercial spyware against people inside the United States—citizens and non‑citizens alike—risks violating constitutional protections against unreasonable searches and chills freedoms of speech, association, and the press. Even if ICE follows its own rules, the mere possibility that a government agency can silently commandeer a phone may deter people from contacting advocacy groups, organizing protests, or speaking candidly with journalists.

For immigrant communities in particular, the fear is amplified. ICE is not a general‑purpose police agency; it enforces immigration and customs laws and has been repeatedly criticized for heavy‑handed tactics and due‑process violations. Giving such an agency a tool able to burrow into phones raises obvious questions about selective enforcement, profiling, and the targeting of vulnerable populations who have limited ability to challenge surveillance in court.

Sen. Gary Peters is demanding that ICE explain why it has purchased commercial spyware capable of covertly taking control of phones as well as collecting messages, photographs, location information and other personal data. https://t.co/RoCAXumwFA

— CBS Mornings (@CBSMornings) July 24, 2026

How This Fits a Larger Pattern of Spyware and Oversight

The ICE–Paragon episode is not an outlier; it fits a broader pattern that has emerged around government use of commercial spyware. Typically, an agency quietly acquires a powerful hacking tool through a contract shrouded in technical jargon and classification. Rights groups and investigative journalists later uncover the purchase, often through procurement databases or whistleblowers. Lawmakers then ask basic questions about legality, targets, and safeguards, while the agency defends the tool as indispensable for serious investigations and insists internal controls are sufficient.

This dynamic has played out internationally with Pegasus, Predator, and other products, where subsequent reporting revealed use against activists, opposition politicians, and journalists, not just terrorists or organized criminals. In the United States, the House and Senate have already scrutinized other DHS practices, such as warrantless purchases of Americans’ location data from data brokers, which skirt traditional Fourth Amendment warrant requirements by exploiting the commercial data marketplace rather than going directly to carriers.

Senator Peters’ oversight work situates ICE’s spyware use inside that lineage of “work‑around” surveillance practices—highly capable, legally contested, and initially hidden. His argument is not that law enforcement should be technologically blind, but that democratic accountability requires clear rules before—not after—agencies buy tools that can, in effect, put a government agent in every pocket.

What Meaningful Oversight Would Look Like

The debate now is drifting toward what guardrails would be proportionate to the power of software like Graphite. Based on Peters’ demands and civil‑liberties proposals, several elements recur. First, explicit statutory limits: Congress can specify when and how commercial spyware may be used, requiring individualized court orders for any deployment against devices in the United States and banning use for immigration enforcement alone absent a serious criminal nexus.

Second, transparency to lawmakers: agencies like ICE would have to disclose to relevant committees how many times spyware is used, in what kinds of investigations, and with what outcomes, subject to appropriate classification rules. That includes providing unredacted contracts and internal policies for confidential review, so elected officials can judge necessity and proportionality.

Third, independent technical and legal audits: external inspectors general, privacy offices, or court‑appointed experts should test whether the tools are operating within their claimed limits and whether deployed configurations match what policymakers approved. In the spyware context, where vendors often customize capabilities, this kind of verification is essential.

Finally, remedies and redress: if spyware is misused—for example, deployed without proper authorization or against protected activities—affected individuals should have a path to challenge that surveillance and seek relief. Without remedies, rules are little more than policy aspirations.

Why Peters’ Questions Won’t Go Away

Even if ICE eventually shutters its Paragon contract—as DHS has at times suggested—Peters’ scrutiny is unlikely to end with this one vendor. The underlying issue is structural: commercial spyware gives domestic agencies capabilities that outstrip the legal frameworks built for an era of wiretaps and pen registers. As long as vendors can offer turnkey device‑hacking services, agencies will be tempted to buy them, and oversight will arrive late, if at all.

For a 40‑something reader who has integrated a smartphone into every facet of daily life, the stakes are personal, not abstract. The same device that manages banking, health records, family photos, political donations, and private conversations can, with the right exploit, become an all‑access pass for the state. Senator Peters is effectively asking whether the United States will set the rules for that future deliberately through law, or drift into it through a series of opaque contracts and after‑the‑fact hearings.