Immigration and Customs Enforcement is using spyware tools that can intercept encrypted messages as part of the agency's efforts to disrupt fentanyl traffickers, according to a letter sent last week by the agency's acting director, Todd Lyons.

Lyons' letter, which was reviewed by NPR, said ICE's Homeland Security Investigations (HSI) is using various tools as part of its mission to disrupt and dismantle foreign terrorist organizations, "particularly those involved in the trafficking of fentanyl."

Lyons wrote that "in response to the unprecedented lethality of fentanyl and the exploitation of digital platforms by transnational criminal organizations," he approved HSI's "use of cutting-edge technological tools that address the specific challenges posed by the Foreign Terrorist Organizations' thriving exploitation of encrypted communication platforms."

His letter, dated April 1, was a belated response to an October inquiry from three Democratic members of the House Committee on Oversight and Government Reform expressing concern about the agency's potential use of the spyware Graphite, which was created by an Israeli company, Paragon Solutions.

The letter is the first time ICE has indicated it is using Graphite. The agency initially signed a $2 million contract with Paragon Solutions for an unspecified software product at the end of the Biden administration. But the contract was swiftly paused until it was revived by the Trump administration last fall.

Graphite uses what is known as "zero click" technology so that it can gain access to encrypted messages on a targeted device even if the user never clicks on a link.

The encrypted messaging app WhatsApp disclosed in early 2025 that it discovered some 90 journalists and members of civil society in various countries were targeted with Graphite. Researchers at The Citizen Lab at the University of Toronto's Munk School of Global Affairs & Public Policy later identified specific journalists and humanitarian aid providers in Italy whose devices were infected with Graphite through WhatsApp messages. Paragon ended its contract with Italian government agencies in 2025.

Lyons' confirmation that the agency is using spyware comes as ICE has ramped up its use of surveillance technologies to find people in the U.S. without authorization as part of the Trump administration's mass deportation campaign. Those tools have also been used extensively on American citizens who have protested ICE's activities. The revelation also comes shortly before Congress is set to debate whether to reauthorize a surveillance law, and whether to close a legal loophole that allows the federal government to buy data about millions of Americans in bulk from commercial data brokers.

Rep. Summer Lee, D-Pa., one of the authors of the October letter asking for answers about ICE's use of spyware, told NPR in a statement, "The response I received from ICE makes one thing clear. They are moving forward with invasive spyware technology inside the United States."

Lee expressed disappointment that Lyons did not provide substantive answers to her questions, including who could be targeted with the technology and the legal basis for using it within the United States.

"The people most at risk, including immigrants, Black and brown communities, journalists, organizers, and anyone speaking out against government abuse, deserve more than secrecy and deflection from an agency with a long record of overreach and abuse," Lee's statement said.

Lyons' letter said any use of the tool "will comply with constitutional requirements" and will be coordinated with the ICE Office of the Principal Legal Advisor.

The Paragon Solutions contract was initially put on hold in 2024 to review its compliance with an executive order then-President Joe Biden signed in 2023 that bars the use of commercial spyware that poses a national security risk to the United States or poses a risk to be misused by foreign governments.

Lyons wrote in his letter that in accordance with the 2023 executive order, he had "certified that HSI's operational use of the specific tool does not pose significant security or counterintelligence risks, or significant risks of improper use by a foreign government or foreign person."

Paragon Solutions was purchased in late 2024 by American private investment firm AE Industrial Partners, which merged with the cybersecurity company REDLattice. Neither AE Industrial Partners nor REDLattice returned NPR's request for comment.

Lyons' response alarmed civil liberties advocates, who worry about the potential for ICE to abuse the tool and use it against targets beyond drug traffickers and terrorists.

"The biggest concern now is that Lyons' response doesn't rule out ICE using an administrative subpoena to deploy this malware against people living in the United States as part of their ideological battle against constitutionally protected protest," said Cooper Quintin, senior staff technologist at the Electronic Frontier Foundation, which advocates for digital privacy.

"An extremely invasive surveillance capability such as this should require the strongest judicial oversight and confirmation that such intrusion is necessary and [a] proportionate response to the crime being investigated," Quintin said.

Maria Villegas Bravo, a lawyer with the nonprofit Electronic Privacy Information Center, said the U.S. does not have sufficient regulations in place "to stop the U.S. government from abusing Constitutional and human rights in the process of using this technology."

In response to an NPR inquiry to the Department of Homeland Security about its use of Graphite and the concerns raised, a DHS official who did not identify themself wrote, "DHS is a law enforcement agency. ICE is no different. Employing various forms of technology in support of investigations and law enforcement activities aids in the arrest of criminal gang members, child sex offenders, murderers, drug dealers, identity thieves and more, all while respecting civil liberties and privacy interests."

Villegas Bravo said that by paying for Graphite, the U.S. is helping to bolster the market for technologies that are being exploited by foreign governments to undermine the privacy of messaging applications and carry out invasive surveillance of phones.

"This is a grave national security risk because it weakens American critical infrastructure, including our telecommunications networks," Villegas Bravo said.