Dossier mode
Paragon Solutions: Ehud Barak's third surveillance venture, run by a former Unit 8200 commander, now inside US immigration enforcement
The same investigation, restaged one beat at a time. Drive it with the arrow keys, space, or autoplay. Nothing is cut from the piece — long runs are split across frames. Read the full investigation or open the Israeli Influence on the United States hub.
Paragon
Ehud Barak's third surveillance venture, run by a former Unit 8200 commander, now inside US immigration enforcement.
The "responsible" spyware vendor is the same pipeline as the others, one product category over.
Where Pegasus takes the phone, Graphite reads the encrypted messenger. The corporate spine is FACT. The vendor's good-behavior stories are graded down. Who targeted the journalist stays SOME SMOKE.
The record, in order.
Italy's own parliamentary oversight committee confirmed the government used Graphite against named immigrant-rights activists.
COPASIR, the Italian intelligence-oversight committee, confirmed in June 2025 that the government ran Graphite against Luca Casarini, Giuseppe Caccia, and David Yambio. This is an approved allied-democracy customer, not a rogue grey-market buyer, which is the strongest evidence on the page that the ethical-vendor pitch did not hold.
ICE uses Graphite inside US immigration enforcement.
A roughly $2 million ICE contract was paused under EO 14093, then reactivated under the second Trump administration. Acting ICE director Todd Lyons confirmed to the House Oversight Committee in April 2026 that the agency uses Graphite. The New York Times separately reported the DEA was permitted to use it.
The documented spine.
- Founded 2019 by former Unit 8200 commander Ehud Schneorson, with CEO Idan Nurick and former PM Ehud Barak on the board. Paragon is Barak's third surveillance venture after Carbyne and Toka.
- Graphite is built to get inside encrypted messaging apps, WhatsApp, Signal, and Messenger, rather than take over a whole phone. Citizen Lab forensically confirmed the infections.
- The money is American: Battery Ventures put in $5 to $10 million in 2021, then AE Industrial Partners acquired Paragon in December 2024 in a deal reported at up to $900 million.
- In January 2025 WhatsApp disclosed and disrupted a campaign against roughly ninety journalists and civil-society users across about two dozen countries.
- Citizen Lab attributed Graphite infrastructure and identified suspected deployments in Australia, Canada, Cyprus, Denmark, Israel, and Singapore, plus a possible Ontario Provincial Police customer.
Paragon declined Israeli requests to swap Graphite into the Saudi armoury after Pegasus hit Khashoggi's associates.
Reported by the Financial Times, and credible, but it is the vendor's own restraint story, uncorroborated by a second outlet or a primary document. It is the good-behavior narrative Paragon offered while positioning itself as the responsible vendor, so it is graded PROBABLY TRUE, not laundered into FACT.
Paragon terminated its Italian contract, saying Italy had breached the terms of service and ethical framework.
The termination itself is well-sourced across the BBC, TechCrunch, and others. The stated reason, an ethical-framework breach, is Paragon's own characterization, offered after the abuse became public to preserve its responsible-vendor positioning. The reason is graded to reflect that it is the vendor's account, not an independent finding.
Who ordered the Graphite targeting of Fanpage.it journalist Francesco Cancellato and his colleague Ciro Pellegrino is unresolved.
COPASIR confirmed Italy hacked the named activists but expressly denied hacking Cancellato. Yet Cancellato got a WhatsApp Paragon notification, and Citizen Lab later found his Naples-bureau colleague Pellegrino was hit with Graphite, stating it was unclear who was behind it. The gap between the official denial and the forensic evidence is real and unexplained. Absent an admission or a document naming the operator, the attribution stays SOME SMOKE.
What the record establishes, and what it does not.
- COPASIR confirmed Italy ran Graphite against named activists.
- WhatsApp and Citizen Lab documented the ~90-user campaign.
- ICE uses Graphite, confirmed by its acting director to Congress.
- That Battery or AE Industrial directed or knew of any specific deployment. The record shows the investment, not operational knowledge.
- That every country Citizen Lab lists as a suspected deployment is a confirmed abusive customer. Suspected is not proof.
- That Paragon picked the targets. The government customer selects them, and who directed the journalist targeting is the open question.
Who ordered the Graphite targeting of journalist Francesco Cancellato and his Fanpage.it colleague is unresolved.
An admission, a document, or an oversight finding that names the service or customer that deployed Graphite against the Fanpage.it newsroom, given COPASIR denied it.
Help us fill it →Why it matters now.
Same founder, same intelligence lineage, same American buyer, one product category over. Carbyne put a 911 platform inside US infrastructure, Toka a camera tool in front of federal agencies, and Paragon a messaging-app spyware inside ICE, run by Unit 8200's former commander. The distance between a foreign state's signals-intelligence corps and US domestic enforcement has collapsed to almost nothing.
Help us fill these lines.
- OpenWho inside the Italian government ordered the Graphite targeting of journalist Francesco Cancellato and the Pellegrino contacts, given COPASIR confirmed activist targeting but denied the journalist hack. Held at SOME SMOKE.
- OpenThe full list of governments deploying Graphite, and the legal authority on which ICE is using it inside US immigration enforcement.