Meet the Spyware Companies Preparing to Unleash Their Tech During Trump’s 2nd Term

Originally Published at The Last American Vagabond

A small but growing number of private companies selling digital tools to hack smartphones and messaging apps, like WhatsApp and Signal, are likely to benefit financially from the incoming Trump administration.

In late September, the US Immigration and Customs Enforcement signed a $2 million one-year contract with controversial Israeli spyware vendor Paragon Solutions. The contract involved Paragon’s US subsidiary based in Chantilly, Virginia and ICE’s Homeland Security Investigations Division 3.

Paragon claims its tools can help law enforcement and governments remotely crack encrypted messaging platforms like WhatsApp, Telegram, Signal, and Facebook Messenger.

The agreement calls for Paragon to provide ICE with a “fully configured proprietary solution including license, hardware, warranty, maintenance and training.” The agreement was first reported on by Wired.

Within weeks of the ICE-Paragon contract becoming public Wired reported the contract was under review by the White House to see if it violates a 2023 Executive Order issued by the Biden administration. Executive Order 14093 was signed by President Joe Biden in March 2023 as part of an ongoing US government effort specifically aimed at restricting the use of commercial spyware by U.S. agencies.

The EO says the US government will continue to promote the “responsible use” of spyware that aligns with promoting “democratic values”. Despite the U.S. government efforts to prosecute journalists like Julian Assange, the EO claims the U.S. has an interest in “promoting respect for human rights; and defending activists, dissidents, and journalists against threats to their freedom and dignity.”

The Biden administration has also made efforts to impact the commercial spyware market, including placing spyware vendors like Israeli firm NSO Group and Intellexa on the “Entity List” which prevents any US companies from doing business with them. The Biden White House has also implemented a visa restriction policy for individuals “who have been involved in the development and sale of commercial spyware or who are immediate family members of those involved.”

Following the Wired report in October, The New Yorker reported in early November that,

“A source at Paragon told me that the deal followed a vetting process, during which the company was able to demonstrate that it had robust tools to prevent other countries that purchase its spyware from hacking Americans—but that wouldn’t limit the U.S. government’s ability to target its own citizens.“

Emily Tucker, the executive director at the Center on Privacy and Technology at Georgetown Law, told Vanity Fair that an “impending disaster” between privacy and the growth of the spyware industry was inevitable.

“You may believe yourself not to be in one of the vulnerable categories, but you won’t know if you’ve ended up on a list for some reason or your loved ones have,” Emily Tucker warned. “Every single person should be worried.”

By October 31st, More than 30 civil society and digital rights organizations and spyware experts signed a letter which calls on the Department of Homeland Security to release details about its $2 million contract with Paragon.

“We are seriously concerned that this contract may not comply with EO 14093 and may lead to violations of both domestic and international law,” the official statement reads.

The signatories of the letter include Access Now, American Friends Service Committee (AFSC), Amnesty International, Asian Americans Advancing Justice (AAJC), Center for Democracy & Technology, Center on Privacy & Technology at Georgetown Law, Committee to Protect Journalists (CPJ), Defending Rights & Dissent, Electronic Frontier Foundation, Electronic Privacy Information Center (EPIC), Fight for the Future, Free Press, and Restore The Fourth.

The letter notes that the contract with Paragon relates to Homeland Security Investigations (HSI) within ICE, “suggesting that HSI is the primary intended user of Graphite”. Graphite is Trojan horse software developed by Paragon that can extract data from encrypted messaging apps like WhatsApp, Facebook Messenger, Signal, and Telegram.

“Publicly available information has not indicated that HSI has robust oversight to ensure that it does not use spyware in a way which infringes the rights of people in America,” the letter reads. “Even if Homeland Security Investigations uses Graphite solely to support investigations into serious crimes, the agency does not enjoy blanket discretion to deploy spyware.”

The New York Times reported in December 2022 that the US Drug Enforcement Administration (DEA) had already made use of Graphite.

Paragon: Another Israeli Intelligence Connected Firm

Paragon claims that it limits its extraction of information from targeted devices “to conversations on chat apps” and that it “works solely with police forces and intelligence agencies that meet the standards of an enlightened democracy, which includes only 39 countries.” Even if the public were to take Paragon’s words as gospel, the reality is that even so-called “enlightened democracies” have a tendency to target journalists and activists who expose government corruption.

In 2021, Forbes first reported on the existence of Paragon and noted that many of Paragon’s employee LinkedIn profiles reveal their connections to Israeli intelligence. Paragon’s cofounder, director, and chief shareholder Ehud Schneorson was a former commander of Israel’s elite Unit 8200. Paragon’s CEO Idan Nurick and CTO Igor Bogudlov are also former members of Israeli intelligence.

Former Israeli prime minister Ehud Barak is also listed as a cofounding director and investor. Barak is known for his connections to Israeli firms Toka and Carbyne911 (now Carbyne). He is also infamous for accompanying Jeffrey Epstein on his private plane dozens of times.

In addition to the investment from Ehud Barak, Paragon has also received significant financial resources from Boston-based investment firm Battery Ventures. Forbes reported that two anonymous senior employees at companies in the Israeli surveillance industry said Battery Ventures invested between $5 and $10 million. Battery’s Israel-based vice president Aaron Rinberg is also listed as a “board observer” at Paragon.

Battery is known for its financial investments in several successful companies, including Coinbase, Groupon, Splunk, SkullCandy and Pokémon Go creator Niantic.

While Paragon is not yet a household name known by the average American, the company is experiencing a rise in support and purchases of its products. A June 2024 report claimed that Paragon was valued at over $1 billion USD.

Is the Trump Admin Preparing to Deploy Spyware and Facial Recognition?

Almost immediately after Donald Trump secured a second term in the White House, ICE issued a call for private companies to submit plans to improve the agency’s surveillance infrastructure. The move is likely a response to Trump’s continued calls for the “largest deportation operation” in American history.

Forbes recently reported that in the three months leading to the 2024 Presidential election, ICE signed $20 million in contracts for spyware, surveillance, and forensics tech that will likely be used to track down people who Trump has promised to deport.

Forbes reviewed numerous ICE contracts and found agreements to purchase technologies that can surveil phone calls, texts, and social media activity, as well as identify individuals through facial recognition. In the last five months alone, ICE agreed to the largest federal purchase orders to date.

In addition to the spyware, Biometric Update also reported that ICE issued a Request for Information (RFI) for biometric monitoring devices as part of its Intensive Supervision Appearance Program (ISAP), a program to track noncitizens who are released from DHS custody. ICE is seeking methods to verify biometrics with a smartphone or tablet using facial recognition or other biometric means.

ICE is specifically looking for vendors to provide “devices that can track participant activities and movements via geolocation, offer identity verification, and offer one- or two-way communications capabilities to assist ICE with ensuring compliance with release requirements and court orders.”

These types of location tracking devices are useful not only to ICE but to the private prison companies who stand to benefit from an increase in holding facilities for illegal immigrants. The CEO of Geo Group, one of the biggest private prison contractors, recently estimated that the company could make as much as $400 million annually under Trump’s presidency by filling beds with individuals accused of illegal immigration. Pam Bondi, Trump’s pick for attorney general, is a former lobbyist for the GEO Group.

Paragon is not the only company getting in on the lucrative contracts with the U.S. government. Let’s take a brief look at a few of the companies who may play a role in Trump’s efforts to deport millions of illegal immigrants during his 2nd term.

Boldend

The secretive firm Boldend is based in San Diego, California and their only customer is the U.S. government. Forbes reported in February 2022 that Boldend had the capability to hack WhatsApp.

“In straddling both the offensive and defensive worlds, Boldend is positioning itself as one of a handful of “full spectrum cyber” businesses focused on protecting and attacking both government and corporate clients,” Forbes reported.

That same report notes that a presentation from defense contractor Raytheon included a slide which claimed that Boldend was backed by Peter Thiel via his Founders Fund. Thiel is the Bilderberg Group Steering Committee member who co-founded private surveillance firm Palantir.

While this investment has not been publicly acknowledged, two sources familiar with the company confirmed to Forbes that Boldend was funded by Thiel’s company. One source claimed Thiel invested more than $10 million in the early stages of the business.

Cellebrite

Cellebrite is another Israeli firm which signed a contract with ICE worth $9.6 million for “forensic equipment and services.” Cellebrite is known for its ability to exploit vulnerabilities in cellphones, both iOS and Android. The company has worked with the FBI, the London Metropolitan Police Service and the Russian government.

Cellebrite told Forbes the company’s new contract was with Homeland Security Investigations, a law enforcement agency within DHS.

Clearview AI

Clearview AI is another controversial surveillance firm with backing from Peter Thiel’s Founders Fund. The facial recognition company first ignited controversy when it was revealed they had scraped Facebook to build the world’s largest database of face prints. Law enforcement and governments can purchase access to the database.

In September, Clearview AI partnered with ICE for its largest federal contract at $1.1 million.

In January 2021, TLAV reported that Clearview AI’s technology was being used to identify and locate individuals who participated in the January 6th riots. It is extremely likely that this technology will also be used to pursue illegal immigrants.

Magnet Forensics

In August, Canadian firm Magnet Forensics signed a $5 million contract with ICE on licenses for Graykey, an Android and iPhone hacking tool.

Pen-Link

U.S. based company Pen-Link also signed a deal with ICE worth nearly $5 million in exchange for licenses from Pen-Link. As Forbes previously reported, Pen-Link has sophisticated wiretapping systems set up on phone lines across the U.S. and is reportedly working on social media surveillance projects for the U.S. government.

The Offensive Spyware Market

The type of software sold by Paragon is known as spyware because it is explicitly aimed at helping the user gain unauthorized remote access to an internet-enabled device for surveillance and data extraction.

According to a September 2024 report from the Atlantic Council, the vast majority of the spyware vendors and associated entities are based in Israel, India, and Italy. However, the largest cluster of vendors (43.9 percent) is concentrated in Israel.

These companies include NSO Group, Saito Tech (formerly Candiru Ltd), Cognyte, Solutions, MerlinX, Quadream Inc./InReach Technologies Limited, Blue Ocean Technologies, and Interionet.

While supporters of the industry argue that spyware can be used as a legitimate law enforcement and intelligence tool, critics point to the fact that such technology has been used by governments around the world to expand their surveillance powers beyond their own physical borders. This increases the ability for governments to track, arrest, kidnap, and kill their citizens. The main targets of spyware deployed by governments are journalists, activists, and politicians.

The major difference between previous leaks regarding government surveillance of cellphone and internet traffic — like those revealed by whistleblower Edward Snowden — and the commercial spyware industry is that these tools are being developed by private companies and sold to law enforcement and government agencies around the world. This means that even governments without the technological capacity to develop their own spy tools can purchase spyware to achieve the same ends.

One prime example of commercial spyware being used to target individuals is the Pegasus spyware sold by Israeli firm NSO Group. In 2020, more than 50,000 phone numbers belonging to individuals identified as “people of interest” by nations using Pegasus was leaked to Amnesty International and Forbidden Stories.

This data was then distributed to 17 media outlets under the name “The Pegasus Project”, including The Guardian, Le Monde, The Washington Post, Frontline, The Wire, and Proceso. Their reporting revealed that NSO Group developed and supplied their Pegasus spyware to international governments which in turn used the tool to target government officials, journalists, activists, academics, and embassy workers.

The reporting from The Washington Post showed that Pegasus was used to target the wife of journalist Jamal Khashoggi months before he was murdered. Pegasus leadership has denied their spyware was used in the murder.

In February, Poland’s Prime Minister announced that the previous government had deployed NSO Group’s Pegasus to hack opposition politicians.

In 2022 it was reported that the FBI had purchased a license to use Pegasus. FBI Director Christopher Wray claimed the purchase was only for research and development purposes.

“To be able to figure out how bad guys could use it, for example,” he told Senator Ron Wyden, Democrat of Oregon, according to a transcript of the hearing that was recently declassified.

However, internal FBI documents and court records obtained by The New York Times showed that FBI officials attempted to use Pegasus in 2020 and 2021 in their own criminal investigations. After the Times reported on the secret purchase and attempted use of Pegasus the FBI conducted an internal investigation to uncover who used the tools only to find out that the FBI itself contracted with vendor Riva Networks.

In fact, the FBI contracted with Riva Networks to track drug smugglers in Mexico using Landmark, another NSO Group technology known for tracking cell phones.

Needless to say, the American public should assume this type of technology will continue to be pursued by the U.S. intelligence community.