United States Immigration and Customs Enforcement’s (ICE) $2 million contract with the Israeli commercial spyware vendor Paragon Solutions has been suspended and is undergoing a compliance review, according to information obtained by WIRED. The contract’s suspension represents the first evaluation of the Biden administration’s executive order that limits the federal government’s use of spyware.
The one-year agreement, involving Paragon’s US subsidiary in Chantilly, Virginia, and ICE’s Homeland Security Investigations (HSI) Division 3, was finalized on September 27 and was initially reported by WIRED on October 1. By October 8, HSI had issued a stop-work order on the contract to assess its adherence to Executive Order 14093, as indicated by a spokesperson from the Department of Homeland Security.
The executive order, signed by President Joe Biden in March 2023, seeks to limit the utilization of commercial spyware technology by the US government while advocating for its “responsible use” in alignment with human rights protection. The Department of Homeland Security did not specify whether the contract—which includes provisions for a “fully configured proprietary solution including license, hardware, warranty, maintenance, and training”—involves the use of Paragon’s primary product, Graphite. This powerful spyware tool is reported to extract data largely from cloud backups.
A senior US administration official, possessing direct insight into the executive order’s application and requesting anonymity, mentioned the administration’s immediate engagement with DHS to determine the scope and compliance of the contract with executive order requirements.
Paragon Solutions did not reply to WIRED’s inquiry for comments regarding the contract’s review. The process outlined by the executive order mandates a comprehensive review of due diligence about both the vendor and the tool, examining potential issues such as counterintelligence, security, and risks of improper use. Furthermore, the order dictates that an agency cannot utilize the spyware operationally until at least seven days after this information is provided to the White House, or until consent is granted by the president’s national security adviser.
The senior official indicated that the Department’s leadership will have to make a decision based on the gathered information and facts, which could lead to a conclusion that this particular vendor and tool do not infringe on the requirements of the executive order.
