ICE Bought Spyware From the Same Industry That Preceded a Journalist's Murder

The tool doesn't ask permission before it starts listening.

I want you to sit with a name before I tell you the rest of this story, Hanan Elatr.

She was married to Jamal Khashoggi, the journalist murdered inside the Saudi consulate in Istanbul in 2018. Months before his death, forensic analysis later confirmed, an agency in the United Arab Emirates installed Pegasus spyware on her phone while she was detained, blindfolded, and interrogated for seventeen hours at the Dubai airport. She didn't know it happened until years later. Her husband was killed shortly after.

Now ask yourself this; if a piece of software has a documented history of appearing in someone's life right before real violence follows, what does it mean when a government agency in your own country signs a contract to use a tool built by the same industry?

That's not a rhetorical question. It's happening right now, and I think you deserve to understand exactly what "happening" means, without exaggeration and without panic.

What Actually Happened With ICE

U.S. Immigration and Customs Enforcement signed a two million dollar contract in 2024 with Paragon Solutions, an Israeli spyware company, to acquire a tool called Graphite, which can covertly activate microphones and turn a phone into a listening device. The Biden administration paused the contract under a "stop work order"; reviewing whether it complied with an executive order restricting U.S. agencies from using spyware that could violate human rights.

That pause held for almost a year. Then, in August 2025, ICE lifted it. Part of what made that possible; a Florida-based private equity firm acquired Paragon and merged it with a Virginia-based intelligence contractor, which allowed the company to be reclassified as a domestic vendor rather than a foreign one, a technical shift that let ICE sidestep the restrictions that had paused the deal in the first place. By April 2026, ICE's own acting director confirmed to Congress that the agency is actively using the tool, describing its use in cases involving fentanyl trafficking.

I want to be precise here, because precision is the whole point of this piece. Paragon's Graphite tool is not the same product as NSO Group's Pegasus, the software used against Khashoggi's wife. They are different companies, different products, built by different teams. But they belong to the same industry, built on the same premise; covert access to a person's phone, sold to governments, largely outside public oversight.

So here's my next question; does the difference between "different company" and "same industry" actually make you feel safer? Or does it just mean the specific brand name changed?

Why the Khashoggi Case Matters to This Story

I'm not telling you ICE's use of Graphite will lead to violence. That would be an irresponsible leap, and I won't make it. What I am telling you is why this industry's track record should shape how carefully we watch what happens next.

Pegasus spyware was placed on Hanan Elatr's phone by a foreign government agency, using a tool from a company with almost no public accountability, months before her husband's murder. She later sued NSO Group, saying the surveillance "ruined her life". That's not speculation. That's forensic fact, confirmed independently by Citizen Lab and reported by the Washington Post.

The lesson from that case isn't "spyware always leads to murder". The lesson is that this entire category of tool operates with almost no visibility to the public, and by the time anyone finds out how it was used, the damage is often already done.

Ask yourself honestly; if a tool with this history is now active inside a U.S. agency, is "trust the process" really a satisfying answer? Or do you deserve to know more before you're asked to accept that answer?

What You Can Actually Do With This Information

I never want you to walk away from a story like this feeling powerless. Fear without action just sits in your chest and does nothing. So here's what actually matters.

• You don't need to be a target of ICE to care about how spyware contracts get approved, paused, and quietly reactivated with almost no public debate

• Every time a spyware company gets reclassified to dodge oversight rules, the story deserves to be tracked, not forgotten a week later

• The organizations holding this accountable, the Electronic Frontier Foundation, Citizen Lab, and investigative outlets like TechCrunch and NPR, deserve your attention and your support, because they're doing the work most people don't have time to do themselves

• You can check your own phone for signs of compromise, and I'll walk you through exactly how to do that in a separate piece I've written specifically on this

This is exactly the kind of story that fades from the news cycle in a week unless people like you keep asking questions about it. That's the whole point of this platform. Not fear. Awareness that turns into action.

Before You Go

I want to know what you think. Does knowing the industry's track record change how you feel about a domestic agency using this kind of tool? Or does the "different company" distinction genuinely put your mind at ease?

Drop it in the comments. And if this story left you wanting to understand the bigger picture, read the companion piece I wrote on how you can check your own device for spyware, using real tools, verified by independent security testers, not marketing claims.

Stay sharp. Stay loud.

➡️ Related: [Europe's Spyware Watchdogs Are Being Spied On]

➡️ Get our free Spyware Red Flags checklist: tech4grownups.com/spyware-checklist

➡️ Join the free Tech 4 Grown-Ups community: tech4grownups.com/community

➡️ Listen to the full podcast episode: [Your AirPods May Be Tracking You - SignalTrace and Surveillance] 

CITATIONS / SOURCES

1. TechCrunch - ICE Reactivates Contract With Spyware Maker Paragon: https://techcrunch.com/2025/09/02/ice-reactivates-contract-with-spyware-maker-paragon/

   
   

2. EFF - Statement on ICE Use of Paragon Solutions Malware: https://www.eff.org/deeplinks/2025/09/eff-statement-ice-use-paragon-solutions-malware

   
   

3. El País - Graphite, the Israeli Spyware Acquired by ICE: https://english.elpais.com/usa/2025-09-05/graphite-the-israeli-spyware-acquired-by-ice.html

   
   

4. NPR - ICE Acknowledges It Is Using Powerful Spyware: https://www.npr.org/2026/04/07/nx-s1-5776799/ice-spyware-privacy

   
   

5. Washington Post - A UAE Agency Put Pegasus Spyware on Phone of Jamal Khashoggi's Wife: https://www.washingtonpost.com/nation/interactive/2021/hanan-elatr-phone-pegasus/

   
   

6. Washington Post - Khashoggi's Widow Sues Israeli Firm Over Spyware: https://www.washingtonpost.com/technology/2023/06/15/khashoggi-nso-widow-lawsuit/