ICE Has a $2M Contract for Spyware That Can Hack Phones Without a Click

SomeonesAccount

great article, very detailed

josefritzishere

So NSA Wiretapping is illegal but ICE is ok? This administration is so wantonly criminal.

edoceo

Seems a low price for no-click zero-day infections

idiotsecant

>Citizen Lab helped WhatsApp identify and block an active Graphite zero-click exploit in late 2024. How to get murdered by a private equity firm in one easy step.

empath75

for people that don't understand how bad ICE is, here is a brief selection of _recent_ news about ICE, this isn't even like the product of an extensive search Ice buys shock gloves https://www.pbs.org/newshour/nation/a-perfect-tool-for-abuse... ICE doesn't pay hospital bills: https://www.sfchronicle.com/politics/article/ice-detainee-me... DOJ blocked federal prosecution of ICE agent in shooting: https://www.propublica.org/article/doj-blocks-charges-ice-ag... ICE doesn't vet candidates: https://www.nytimes.com/2026/09/03/us/ice-recruits-national-... ICE agent with history of violent behavior shoots man in Maine: https://www.pbs.org/newshour/nation/ap-report-ice-officer-in... ICE puts tracking devices on Haitians who were here legally: https://www.nbcnews.com/politics/immigration/haitians-ohio-l... Haitian student commits suicide after being forced to wear tracking device https://www.nbcnews.com/news/us-news/springfield-ohio-haitia... ICE Deports Milo Yiannopoulos, to settle some intra-MAGA feud: https://sfist.com/2026/08/28/milo-yiannopoulos-detained-by-i... Like, that isn't like cherry-picking, it's a five minute scroll through one of my social media feeds. They are a stain on the US and need to be abolished.

miohtama

Meanwhile in Serbia https://citizenlab.ca/research/pegasus-spyware-infection-of-... "In collaboration with the SHARE Foundation, the Citizen Lab analyzed forensic artefacts from the iPhone of a member of Serbia’s student protest movement after they received an Apple Threat Notification warning of targeting with mercenary spyware." Zero clicks are cheap if NSO can afford to go after students.

readthenotes1

Ehud Baraj, wasn't he a close confidante of Epstein?

exceptione

> Graphite belongs to the same category of commercial surveillance technology as Pegasus, the better-known spyware developed by NSO Group. Both are classified as mercenary spyware, meaning private companies develop and sell them to government intelligence and law enforcement agencies. This buries the lede a bit. These companies play their part in trans-national organized crime networks, spanning countries like the USA, Russia and Israel. In Russia, it is often hard to delineate between organized crime and the FSB, because these networks overlap and they are often well established within the structures of the state. The same increasingly applies to the USA. ICE is becoming a paramilitary force, "immigration control" is clearly not its only purpose. I cannot unsee this from the massive purges in the military, rooting out the most competent leadership. The parallels with Russia can't be ignored.

ChrisArchitect

Does this article have any information in it from 2026? or is it just a sloppy rehash of information from a year ago. May 2026: DHS says ICE has 'no relationship' with spyware maker Paragon Solutions https://www.npr.org/2026/05/22/nx-s1-5831577/dhs-ice-spyware...

teravor

> Researchers have confirmed Graphite attacks through WhatsApp and iMessage, although the complete method remains secret. unsurprising that it's closed source software which is vulnerable like this. LLMs can now decompile binaries very efficiently so it's not even security by obscurity anymore. you really have to screw up to not carefully trace the path of incoming messages to ensure they are processed safely.

tamimio

> The most dangerous infections require no mistake by the target. A zero-click attack works because phones automatically inspect incoming messages and files before displaying them. It’s zero click but it needs an entry point, do we know the entry point? Yes of course! It’s the phone number!! I hope now you know why they keep phone numbers as a mean of identification, all the big tech and advancement in protocols and what not, yet you are still required to have a phone number as an ID “to fight spam, spoiler: it doesn’t”, or even as a 2FA, Canada for example is making a unified login portal to its all government services and the 2FA is only a phone number, how convenient!! Phone number is the entry point for zero click, but also for tracking you even when your gps is disabled btw, phone modems has their own gnss and they send location to the towers all the time. To prevent that, keep the phone number in another phone, not your main (keep your main with no sim card), preferably some dummy phone that you will only use when you need to otherwise it’s on airplane mode.