Paragon. Ehud Barak’s third surveillance venture, run by a former Unit 8200 commander, now inside US immigration enforcement.
Where Pegasus takes the phone and Toka rewrites the camera, Paragon reaches into the encrypted messenger. Its spyware, Graphite, reads WhatsApp, Signal, and Messenger. It marketed itself as the responsible one. Then Italy used it against journalists, and ICE switched it back on.
Paragon Solutions was founded in Tel Aviv in 2019 by Ehud Schneorson, the former commander of Israel's signals-intelligence Unit 8200, together with CEO Idan Nurick, Igor Bogudlov, Liad Avraham, and former Israeli Prime Minister Ehud Barak, who sits on its board. Battery Ventures put in $5–10 million in 2021. In December 2024, US private-equity firm AE Industrial Partners acquired the company, in a deal reported at up to $900 million. In January 2025, WhatsApp disclosed a Paragon campaign against roughly ninety users, including journalists and civil-society figures. Citizen Lab forensically confirmed Graphite infections; an Italian parliamentary committee confirmed the Italian government used Graphite against named activists. This is the same founder-to-Washington pipeline this hub tracks at Toka and Carbyne, written a third time.
Primary sources include Citizen Lab's Graphite forensic report, Forbes on the founding and Battery Ventures, Reuters on the WhatsApp campaign, and Haaretz on the Italian parliamentary confirmation.
What this page is about
Paragon Solutions is an Israeli spyware company founded in 2019. Its product, Graphite, is built to get inside encrypted messaging apps — WhatsApp, Signal, Facebook Messenger — rather than take over a whole phone. Two of its founders define what it is: Ehud Schneorson, the former commander of Unit 8200, and Ehud Barak, the former Israeli Prime Minister who also co-founded Toka and founded and chaired Carbyne. Paragon is Barak's third surveillance venture.
The company tried to position itself as the ethical spyware vendor, the one with safeguards NSO Group lacked. That positioning collided with the record in 2025, when WhatsApp and Citizen Lab exposed a Graphite campaign against roughly ninety journalists and civil-society figures, and an Italian parliamentary committee confirmed the Italian government had used Graphite against named immigrant-rights activists. In the United States, Paragon's Graphite was contracted to ICE, paused under a Biden-era executive order, and then switched back on under the second Trump administration.
The corporate spine of this page — founding, funders, the AE Industrial acquisition, the WhatsApp campaign, the Italian confirmation — rests on named-byline reporting in Forbes, the Financial Times, Reuters, the Guardian, Haaretz, Calcalist, and TechCrunch, plus the Citizen Lab technical report and the Italian committee's own findings. Where a claim rests on Paragon's account of its own conduct (that it declined a Saudi deployment; that it cut ties with Italy on ethics grounds), it is graded PROBABLY TRUE and the self-serving character is stated in-line. The unresolved question of who ordered the targeting of journalist Francesco Cancellato is graded SOME SMOKE.
We are not saying Battery Ventures or AE Industrial Partners directed or knew of any specific abusive deployment of Graphite. What is documented is the investment and the acquisition, not the investors' operational knowledge.
We are not saying every country Citizen Lab lists as a suspected Paragon deployment is a confirmed abusive customer. Citizen Lab attributes server infrastructure and identifies “suspected” deployments; a suspected deployment is not proof of a specific illegal target in that country.
We are not saying Paragon itself chose the targets. Spyware vendors sell a capability to government customers who select the targets. The Italian committee confirmed the Italian government, not Paragon, ran Graphite against the named activists. Who directed the targeting of Cancellato specifically is the open question this page refuses to resolve past the evidence.
The “responsible” spyware vendor is the same pipeline as the others, one product category over.
Paragon was built to be the answer to NSO Group. Its pitch, to investors and to Western governments, was that it had ethical guardrails: it would sell only to a shortlist of allied democracies, and it would drop customers who abused the tool. That pitch is why Battery Ventures, and later a US private-equity firm, were comfortable owning it, and why a 2023 Biden executive order aimed at NSO was read by experts as carving out room for exactly this kind of vendor.
The guardrails did not hold in the one case that got tested in public. Italy, an allied democracy on the approved-customer list, used Graphite against a migrant-rescue organizer, a Libya-policy critic, a priest close to Pope Francis, and — per Citizen Lab — the professional circle of an investigative journalist. That is not a rogue dictatorship buying spyware on the grey market. That is the guardrail itself failing at a named, approved customer, and the vendor's response being to end the contract after the abuse was already public.
The three-part shape this hub keeps documenting is all here. The talent is Israeli state signals-intelligence: the CEO-tier founder is Unit 8200's former commander. The money is American: Battery Ventures, then AE Industrial Partners. The buyer is the US government: Graphite ran under an ICE contract, was paused, and was switched back on. Paragon is the current, messaging-app-tier expression of the same machine that produced Carbyne's 911 platform and Toka's camera tools.
2019 to 2026: from an ex-Unit 8200 founding to ICE confirming it uses Graphite.
- 2019Paragon Solutions founded in Tel Aviv by former Unit 8200 commander Ehud Schneorson, CEO Idan Nurick, Igor Bogudlov, Liad Avraham, and former PM Ehud Barak (board member). Citizen Lab; Forbes.
- July 2021Forbes reports Battery Ventures invested between $5 and $10 million in Paragon, one of the first named US institutional backers. Forbes.
- March 27, 2023President Biden signs Executive Order 14093, restricting US government operational use of commercial spyware that poses national-security risks or has enabled human-rights abuses. Experts read it as targeting NSO while leaving room for vendors like Paragon selling to close US allies. Financial Times.
- May 31, 2023The Financial Times reports that, after Pegasus was found on the phones of Jamal Khashoggi's associates, Paragon declined Israeli government requests to replace Pegasus with Graphite in the Saudi armoury. Financial Times.
- September 2024 – 2025A roughly $2 million ICE contract with Paragon is paused and placed under compliance review against EO 14093; after the January 2025 inauguration, the second Trump administration reverses the pause and ICE resumes acquiring Graphite. Washington Post.
- December 16, 2024
- January 31, 2025WhatsApp says it disrupted a Paragon campaign that targeted roughly ninety users across two dozen countries, including journalists and civil-society members, and notified those affected. Reuters; The Guardian.
- February 6, 2025Multiple outlets report Paragon terminated its contract with the Italian government, saying Italy had breached the terms of service and ethical framework of its Paragon contract. BBC; TechCrunch.
- March 19, 2025Citizen Lab publishes “Virtue or Vice?”, mapping Graphite server infrastructure and suspected deployments in Australia, Canada, Cyprus, Denmark, Israel, and Singapore, surfacing a possible Ontario Provincial Police customer, and forensically confirming Graphite infections on Italian targets' phones. Citizen Lab.
- June 5, 2025An Italian parliamentary committee (COPASIR) confirms the Italian government used Graphite against immigrant-rights activists including Luca Casarini, Giuseppe “Beppe” Caccia, and David Yambio, while denying it hacked journalist Francesco Cancellato. Haaretz.
- June 12, 2025Citizen Lab reveals Ciro Pellegrino, head of Fanpage.it's Naples bureau and a colleague of Cancellato, was also targeted with Graphite, though who directed that targeting is unclear. The Guardian.
- April 2026Acting ICE director Todd Lyons confirms in a letter to the House Oversight Committee that the agency is using Graphite. Washington Post (background on the ICE contract).
Who founded it, who funded it, who bought it, and who used it.
The former commander of Israel's signals-intelligence Unit 8200. His presence at the top of Paragon's founding team is the clearest single reason this company belongs on the surveillance hub: it is the state-signals-intelligence-to-private-spyware pipeline in one person.
Former Prime Minister of Israel (1999-2001), former Defense Minister, former IDF Chief of Staff. Paragon is his third surveillance-adjacent venture, after founding and chairing Carbyne and co-founding Toka. His association is documented; the Epstein-linked financing we treat separately belongs to Carbyne, not Paragon.
Chief executive of Paragon since its 2019 founding. Named as a co-founder in Forbes, Citizen Lab, and the company's own disclosures.
The remaining named members of the 2019 founding team, per Forbes' original reporting and subsequent profiles.
US venture firm that, per Forbes, invested between $5 and $10 million in Paragon in 2021, making it one of the first named US institutional backers of the company.
US private-equity firm that acquired Paragon (through its RED Lattice cybersecurity unit) in a deal reported at up to $900 million, moving majority ownership of the spyware maker into US hands.
Held a roughly $2 million Paragon contract that was paused under EO 14093, then reactivated under the second Trump administration. Acting director Todd Lyons confirmed to Congress in April 2026 that ICE uses Graphite.
An Italian parliamentary committee confirmed in June 2025 that the Italian government used Graphite against named immigrant-rights activists. Paragon says it terminated the contract; the two accounts of how the relationship ended differ.
Eleven claims spanning 2019 to 2026, each graded, each cited to a primary or named source.
Paragon Solutions was founded in Tel Aviv in 2019 by former Unit 8200 commander Ehud Schneorson, CEO Idan Nurick, Igor Bogudlov, Liad Avraham, and Ehud Barak, who sits on its board.
FACTThe founding and founder identities are stated consistently in Forbes' 2021 reporting, the Citizen Lab report, and every subsequent profile. Schneorson's status as former commander of Unit 8200 is what places this venture inside the surveillance-tech pipeline; Barak's board role makes it his third such venture after Carbyne and Toka.
Battery Ventures invested between $5 and $10 million in Paragon in 2021.
FACTForbes reported the Battery Ventures investment at the time, framing Paragon as an American-funded Israeli surveillance startup. The figure is a reported range, not a precise disclosed amount, and is attributed to Forbes' sourcing.
Graphite is built to access encrypted messaging apps — WhatsApp, Signal, and Facebook Messenger — rather than take complete control of a phone.
FACTCitizen Lab describes Graphite as providing access to instant-messaging applications on a device rather than full device takeover, and forensically confirmed WhatsApp-loaded spyware on Italian targets' phones. This is the product's defining technical distinction from Pegasus-style full-device implants.
After Pegasus was found on Jamal Khashoggi's associates, Paragon declined Israeli government requests to replace Pegasus with Graphite in the Saudi armoury.
PROBABLY TRUEReported by the Financial Times as part of Paragon's effort to stay on the right side of Washington. The claim rests on FT's sourcing and describes Paragon's own restraint, which is a self-serving fact for the company; it has not been independently corroborated by a second outlet or a primary document. It is credible and uncontested, but it is the vendor's own good-behavior story, so it is graded PROBABLY TRUE, not FACT.
A March 2023 US executive order (EO 14093) restricted government use of abusive commercial spyware; the Biden administration then banned government purchase of Paragon software, and the second Trump administration reversed the pause for ICE.
FACTEO 14093 is a published executive order. The subsequent pause of the roughly $2 million ICE-Paragon contract for EO-14093 compliance review, and its later reactivation under the second Trump administration, are documented by the Washington Post and confirmed by acting ICE director Todd Lyons' April 2026 letter to the House Oversight Committee stating the agency uses Graphite.
In December 2024, US private-equity firm AE Industrial Partners acquired Paragon, in a deal reported at up to $900 million.
FACTThe acquisition by AE Industrial Partners, through its RED Lattice unit, was reported across Israeli and US business press. The '$900 million' is the reported ceiling of a structured deal ('up to'), not a confirmed single headline price, and is attributed as such.
In January 2025, WhatsApp disclosed and disrupted a Paragon campaign that targeted roughly ninety users across about two dozen countries, including journalists and civil-society members.
FACTMeta's WhatsApp made the disclosure directly, notifying those it believed were targeted; it was reported by Reuters, TechCrunch, and NBC News, and corroborated by Citizen Lab, which said its infrastructure analysis was pivotal to WhatsApp's investigation of an active zero-click exploit.
Citizen Lab attributed Graphite server infrastructure and identified suspected Paragon deployments in Australia, Canada, Cyprus, Denmark, Israel, and Singapore, plus a possible Ontario Provincial Police customer.
FACTThese are Citizen Lab's published findings from its infrastructure mapping. Note the wording: 'suspected' deployments and a 'possible' Canadian customer. The report documents the infrastructure attribution; it does not claim a proven abusive target in each named country. The finding is a fact about what Citizen Lab identified, not a finding of abuse in every jurisdiction.
An Italian parliamentary committee (COPASIR) confirmed in June 2025 that the Italian government used Graphite against immigrant-rights activists including Luca Casarini, Giuseppe Caccia, and David Yambio.
FACTThe confirmation came from the Italian parliamentary intelligence-oversight committee itself, reported by Haaretz and the Guardian. It is the strongest evidence on the page that Graphite was used by an approved allied-democracy customer against domestic civil-society targets, not by a rogue grey-market buyer.
Who ordered the Graphite targeting of Fanpage.it editor Francesco Cancellato — and of his colleague Ciro Pellegrino — is unresolved.
SOME SMOKECOPASIR confirmed the Italian government hacked the named activists but expressly denied hacking Cancellato. Yet Cancellato received a WhatsApp Paragon notification, and Citizen Lab later found his Naples-bureau colleague Ciro Pellegrino was targeted with Graphite, stating it was unclear who was behind it. The gap between the official denial and the forensic evidence is real and unexplained. Absent an admission or a document naming the operator, attribution of the journalist targeting stays SOME SMOKE.
Paragon terminated its contract with the Italian government in February 2025, saying Italy had breached the terms of service and ethical framework of its contract.
PROBABLY TRUEThe termination was reported by the BBC, TechCrunch, and others in February 2025. The fact of the break is well-sourced; the stated reason — that Italy breached an 'ethical framework' — is Paragon's own characterization, offered as the company sought to preserve its 'responsible vendor' positioning after the abuse became public. The reason is graded to reflect that it is the vendor's account, not an independently established finding.
Paragon sells to the US government, and ICE uses Graphite.
FACTA roughly $2 million ICE contract, the EO-14093 compliance pause, the reactivation under the second Trump administration, and acting ICE director Todd Lyons' April 2026 confirmation to the House Oversight Committee that ICE uses Graphite are documented. The New York Times separately reported the Biden administration allowed the DEA to use Graphite.
What forensics and a parliamentary committee established, and what the vendor’s own story still carries.
Paragon is unusually well-documented for a spyware firm because the abuse case was tested against a democracy with a functioning oversight committee. The WhatsApp disclosure, the Citizen Lab forensics, and the COPASIR confirmation are three independent layers — a platform, an academic lab, and a parliamentary body — converging on the same core fact: Graphite was used against Italian civil society. That is a stronger evidentiary base than most spyware stories ever reach, and it is why the central claims here grade FACT.
Where the record thins out is on two of the vendor's self-descriptions. The claim that Paragon declined to arm Saudi Arabia with Graphite, and the claim that it dropped Italy on ethical-framework grounds, are both stories in which Paragon is the responsible actor. Both are plausibly true and neither has been contradicted, but both originate with the company at moments when reputational stakes were high. We grade them PROBABLY TRUE and flag the self-serving character rather than laundering the vendor's PR into fact.
The genuine open question is attribution of the journalist targeting. COPASIR denied that Italy hacked Cancellato, yet the forensic and notification evidence around him and his Fanpage.it colleague is real. Someone deployed Graphite against that newsroom's circle. Whether it was an Italian service acting outside the committee's account, another Graphite customer, or something the committee did not disclose, the public record does not yet say. That is why it stays SOME SMOKE, and why we do not assert an operator we cannot name.
The third Barak venture closes the same loop: Israeli signals intelligence, US money, US enforcement.
Read alone, Paragon is one more spyware scandal. Read against this site's other files, it is the third instance of a single pattern. Carbyne put an Israeli 911-dispatch platform, seeded with Epstein-linked money and chaired by Ehud Barak, inside US emergency infrastructure and then into Axon. Toka put an Israeli camera-alteration tool, co-founded by Barak and led by a former IDF Cyber Staff chief, in front of US federal agencies. Paragon puts an Israeli messaging-app spyware tool, co-founded by Barak and by Unit 8200's former commander, inside ICE. Same founder, same intelligence lineage, same American buyer, three different capability categories.
The Unit 8200 tie is the load-bearing one for this hub. Ehud Schneorson did not adapt a military technology as a mid-level alumnus; he commanded the unit. When the person who ran a nation's signals-intelligence corps co-founds a spyware company that a US private-equity firm then buys and a US enforcement agency then runs against people's encrypted chats, the distance between a foreign state's intelligence apparatus and US domestic enforcement has collapsed to almost nothing. That collapse — documented, not alleged — is the reason this page sits on both the Israeli Influence and the Surveillance State(s) hubs.
Questions worth taking seriously
Is Paragon really different from NSO Group?
Did Paragon itself target the journalists?
Is the US government actually using this spyware?
What is Ehud Barak's connection to all this?
If you are named on this page
If you are named on this page, or are a party materially affected by the claims made here, and you wish to respond, correct the record, or add context, use the Contact page. Responses are published verbatim alongside the original claim, with the sender identified and the date of receipt. The channel stays open for the life of the page.
This site aggregates and grades a record that other outlets and primary sources have already put on the record. Every FACT-graded claim above is sourced to court filings, government reports, sworn whistleblower disclosures, published investigative journalism, or named-source statements. The citations are the accountability mechanism; this section is how you get on the record too.
The Paragon primary sources this page cites.
Every claim on this page grades to one of FACT · PROBABLY TRUE · SOME SMOKE · PURE SPECULATION · FALSE / MISLEADING. The grade badge hedges. The prose does not. Nothing false is asserted here as accepted claim.
Core primary and named-byline sources include Citizen Lab's Graphite forensic report, Forbes on the founding and Battery Ventures, the Financial Times on EO 14093 and the Saudi decision, Reuters on the WhatsApp campaign, Haaretz on the COPASIR confirmation, the Guardian on the Pellegrino targeting, Calcalist and ynetnews on the AE Industrial acquisition, and the Washington Post on the ICE contract.
Full method: Methodology. Home hub: Israeli Influence. Cross-cut hub: Surveillance State(s).
Last updated July 28, 2026. If a link 404s or a date is wrong, tell us and we will fix it publicly.