Key Takeaways
- Sen. Gary Peters (D-MI), ranking member of the Senate Homeland Security Committee, sent a July 23, 2026 letter demanding DHS and ICE account for a $2 million sole-source contract giving ICE access to Graphite, a commercial spyware tool built by Paragon Solutions and now under the ownership of REDLattice.
- Graphite is a “zero-click” tool capable of covertly extracting encrypted messages, photos, location data, and live audio/video from a target’s phone without any action from the user — capabilities similar to those of NSO Group’s Pegasus.
- ICE first signed the contract in September 2024, paused it a month later over compliance concerns tied to a Biden-era executive order restricting spyware purchases, then reactivated it in 2025; ICE confirmed the tool’s approved status to Congress in April 2026.
- Peters has given DHS and ICE until August 7, 2026, to turn over contracts, privacy assessments, and records on the legal authority behind the tool’s use — but as a member of the minority party, he cannot compel compliance.
- DHS has defended the acquisition as a standard law-enforcement tool aimed at gangs, traffickers, and child exploitation networks, while declining to say whether Graphite has been deployed against U.S. citizens, journalists, or protesters.
Why This Matters Now
A single sentence in a July 23 congressional letter has reopened one of the most consequential surveillance debates in recent U.S. history: does the federal government’s chief immigration enforcement agency now possess the technical ability to secretly seize control of any American’s smartphone? Senator Gary Peters of Michigan, the top Democrat on the Senate Homeland Security and Governmental Affairs Committee, wants answers — and he wants them by August 7. At stake is not a theoretical capability but a confirmed, funded, and reportedly active contract between U.S. Immigration and Customs Enforcement and the maker of Graphite, a spyware platform in the same technical class as tools that have been used to hack the phones of journalists, dissidents, and human rights defenders around the world.
The Contract: A Timeline of Starts and Stops
According to Peters’ letter, first obtained by CBS News, ICE’s relationship with Paragon Solutions has moved in fits and starts since 2024. The agency signed an initial agreement in September of that year, only for the Biden administration to issue a stop-work order roughly a month later. That pause was reportedly tied to a review of whether the purchase complied with Executive Order 14093, a 2023 directive restricting federal agencies from buying commercial spyware linked to human rights abuses or foreign-government misuse.
The contract did not stay dormant. Reporting reviewed for this article indicates the agreement was reactivated in 2025, and by April 2026, ICE had confirmed to Congress — in writing — that it had approved procurement and use of the tool. The Knight First Amendment Institute at Columbia University, which tracks the matter closely, noted that the April disclosure came only after sustained congressional pressure, and even then ICE offered little detail about how, where, or against whom Graphite would be used.
The dollar figure attached to the deal — $2 million — was awarded on a sole-source basis, meaning ICE did not solicit competing bids from other vendors. Sole-source contracts are not inherently improper, but they typically draw closer scrutiny precisely because they bypass competitive review, and oversight advocates argue that scrutiny is especially warranted for a tool with Graphite’s capabilities.
What Graphite Actually Does
Graphite belongs to a small, controversial category of surveillance products often described as “zero-click” spyware — so named because a target does not need to click a malicious link, download a file, or take any visible action for the software to take hold. Once installed on a device, tools in this class can operate below the level of ordinary detection.
Based on technical assessments and prior documented deployments, Graphite’s confirmed or reported capabilities include the ability to:
- Extract messages from end-to-end encrypted apps, including WhatsApp, Signal, and Telegram, by reading them after decryption on the device itself rather than intercepting them in transit.
- Pull stored photos, documents, and email archives from the device.
- Continuously stream a device’s real-time GPS location.
- Remotely activate a phone’s microphone and camera, turning the device into a live listening and recording tool without any indicator visible to the user.
These capabilities place Graphite in the same technical bracket as NSO Group’s Pegasus and Cytrox’s Predator — two spyware tools that have been at the center of international scandals after researchers documented their use against journalists and political opponents in multiple countries. Graphite itself is not new to controversy: Meta-owned WhatsApp disclosed in early 2025 that it had disrupted a Paragon-linked campaign that targeted roughly 90 users of its messaging app, including journalists and activists, across various countries. Researchers at the University of Toronto’s Citizen Lab, along with Italian prosecutors, later verified that journalists and activists in Italy were among those targeted, a scandal that reportedly prompted Paragon to end its contract with Italian intelligence services after the country declined to let the company help investigate whether a specific journalist had been hacked.
The Core Fear: Domestic Use Against Americans
Peters’ letter is notable for what it does not allege as much as for what it demands. The senator has been explicit that he is not accusing ICE of having already used Graphite against U.S. citizens, journalists, or protesters. His concern is structural: that the agency has acquired a tool capable of that kind of targeting, has declined to explain the legal guardrails around its use, and has a documented institutional interest in tracking activity — including First Amendment-protected activity such as protests and social media posts — that would normally fall outside a traditional law-enforcement wiretap’s scope.
That concern is sharpened by past statements attributed to immigration enforcement personnel referencing the compilation of what Peters’ letter calls “nice little databases” on individuals — a phrase the senator cited directly as part of his rationale for pressing the inquiry. Traditional electronic surveillance in the U.S. operates under a dense layer of statutory and constitutional constraint: warrant requirements under the Fourth Amendment, minimization procedures, and judicial oversight through instruments like Title III wiretap orders. Commercial spyware, by contrast, does not fit cleanly into that existing legal architecture, and civil liberties advocates argue that the same Fourth Amendment protections the Supreme Court has extended to cell-site location data in Carpenter v. United States and to phone searches in Riley v. California raise serious questions about whether ICE’s use of a tool like Graphite could survive constitutional scrutiny absent a warrant.
A Fight That Already Played Out on the Senate Floor
This is not the first time the issue has surfaced in Congress. During debate over Republicans’ budget reconciliation package in June 2026, Peters pushed for a vote on an amendment that would have explicitly barred DHS from deploying commercial spyware like Graphite against United States citizens. The amendment failed along party lines, with Senate Republicans unanimously voting it down. That defeat left the legal question of domestic spyware use against Americans effectively unresolved at the statutory level, which is part of why Peters has now turned to a formal oversight letter rather than legislation as his next lever.
The July 23 letter also reveals a pattern of stalled communication predating this latest demand. Peters said his committee staff had requested briefings from DHS in December 2025 and from ICE in January 2026, and received no substantive response either time. That history of non-engagement is central to why the senator has now set a hard deadline — August 7, 2026 — for the agency to produce contracts, privacy impact assessments, civil rights reviews, and security policies tied to the Graphite deal.
It’s worth noting the practical limits of Peters’ authority here. As the ranking — not chairing — member of the committee, and with Democrats in the Senate minority, Peters cannot compel ICE or DHS to comply with his request. He can request documents and demand answers, and he can use the public pressure of a formal congressional letter to try to extract information, but any real teeth would require either Republican cooperation on the committee or a shift in the chamber’s political control.
DHS and ICE Push Back
DHS has responded to the criticism largely by reframing the acquisition as a routine investment in law-enforcement capability rather than a novel surveillance overreach. In comments to reporters, a DHS official — who was not publicly named in the exchange — described the department as a law-enforcement agency like any other, arguing that deploying advanced technology in support of investigations helps secure arrests connected to gang activity, child sex offenses, murder, drug trafficking, and identity theft, while asserting that such activity respects civil liberties and privacy interests.
That framing does not directly answer the central question Peters and civil liberties groups have posed: whether Graphite has been, or could be, turned toward domestic political speech rather than the criminal-network targets DHS cites. ICE has confirmed the tool’s approved status but has otherwise declined to detail who has been targeted, whether the software has been used domestically at all beyond the drug-trafficking investigations reportedly disclosed in April 2026, or what legal authority underpins any such use.
Civil Society’s Warning: “Misuse Is Not Hypothetical”
Outside groups have been considerably more direct than DHS in characterizing the stakes. Peters’ letter itself argues that misuse of Graphite is not hypothetical, pointing to the more-than-90 journalists and civil society figures previously targeted with the tool internationally. Nadine Farid Johnson, policy director at the Knight First Amendment Institute at Columbia University, has separately warned that spyware of this kind enables covert and effectively unlimited access to smartphone data, creating significant risks to free speech and privacy, and that such tools have a demonstrated history of being turned against journalists, human rights advocates, and political dissidents.
A coalition of civil rights organizations has raised similar alarms in a separate letter to the same Senate committee, describing Graphite as hacking software originally built for military use, capable of infiltrating essentially any mobile device and bypassing encrypted messaging apps entirely. House lawmakers — including Reps. Summer Lee, Shontel Brown, and Yassamin Ansari — sent their own letter to then-DHS Secretary Kristi Noem in October 2025, warning that the administration’s approach to immigration enforcement raised the risk that Graphite could be turned against immigrants, people of color, and individuals who publicly criticize ICE’s operations. That letter specifically invoked the Supreme Court’s Riley and Carpenter precedents as evidence that warrantless use of the tool against people in the U.S. would raise serious constitutional problems.
The Bigger Picture: A Pattern of Expanding ICE Data Tools
Graphite does not exist in isolation. It is the latest addition to a broader buildout of ICE’s data and surveillance capacity over the past two years, which has included an expanded facial-recognition relationship with Clearview AI, a Palantir-built platform reportedly worth $30 million internally referred to as “ImmigrationOS,” and continued use of phone-extraction technology from firms like Cellebrite. Advocacy groups tracking these contracts argue that each new tool has arrived with minimal public explanation and, in some cases, heavily redacted contract terms — a pattern one policy outlet described as ICE “massively expanding its domestic surveillance capabilities without a public explanation.”
Seen against that backdrop, the Graphite contract represents not an isolated acquisition but what Peters called in his letter one of the most significant expansions yet of the department’s surveillance ambitions — a assessment that reflects both the tool’s unusual technical reach and the broader trajectory of the agency’s investment in data-driven enforcement.
What Happens Next
The immediate marker to watch is August 7, 2026 — the deadline Peters has set for DHS and ICE to produce the requested documentation. Given that the agency has already gone unresponsive to two prior briefing requests, from DHS in December 2025 and ICE in January 2026, there is no guarantee the deadline will be met with substantive disclosure rather than another round of delay.
Beyond that date, three threads are likely to continue running in parallel. First, litigation: at least one Freedom of Information Act lawsuit tied to ICE’s surveillance contracts, including Paragon’s, is already working its way through federal court after plaintiffs alleged the agency failed to respond to records requests within the statutory timeline. Second, legislative pressure: having failed once on the Senate floor in June, Democrats may attempt another statutory restriction on domestic spyware use, though prospects remain dim without a change in the chamber’s partisan balance. Third, continued reporting: journalists and researchers, including at Citizen Lab, have a track record of independently identifying spyware targets even when the agencies involved decline to disclose them, and further technical findings could shape the debate regardless of what ICE chooses to release by the deadline.
For now, the core question Peters posed in his letter — not whether ICE has the capability, which is confirmed, but whether and how it intends to use that capability against people inside the United States — remains formally unanswered.
FAQ
What is Graphite spyware? Graphite is a commercial “zero-click” spyware tool developed by Paragon Solutions that can covertly extract encrypted messages, photos, and location data from a target’s phone and remotely activate its microphone and camera, without the user taking any action.
Why did ICE buy Graphite spyware? DHS has said the tool supports investigations into gangs, drug trafficking, human trafficking, and child exploitation, but ICE has not publicly detailed the specific cases or individuals the tool has been used against.
Has ICE used Graphite against U.S. citizens or journalists? Sen. Gary Peters has said he is not alleging that ICE has targeted Americans, journalists, or protesters with Graphite, but he is demanding the agency disclose whether it has done so, given the tool’s history of being used against journalists and activists internationally.
What is the deadline for ICE to respond to Congress? Peters has requested that DHS and ICE provide contracts, privacy assessments, and related records by August 7, 2026.
Can Congress force ICE to comply with the request? Not directly. As the Senate Homeland Security Committee’s ranking minority member, Peters can request documents and demand briefings, but cannot compel compliance without Republican cooperation or a change in the chamber’s control.
Closing Analysis
What remains unresolved is not whether ICE possesses Graphite — that much the agency has confirmed — but whether any of the legal, procedural, or judicial guardrails that traditionally bound domestic surveillance apply to a tool built for foreign intelligence-grade access. Watch the August 7 deadline, the pending FOIA litigation, and whether any independent technical researchers surface concrete evidence of domestic targeting; any of those three could shift this from a congressional oversight dispute into a constitutional one.
