The Secrets of the US Spyware King

Commercial spyware firms cannot be trusted to self-regulate their tools.

WhatsApp has accused Israeli-owned spyware firm Paragon, recently acquired by US private equity firm AE Industrial Partners and merged with its US offensive cyber firm REDLattice, of infecting the phones of over 60 individuals across more than 20 countries. Targets included journalists and activists, with specific individuals named in Italy by the University of Toronto's Citizen Lab. Paragon and its new US owners initially declined to comment but later canceled contracts with Italian intelligence agencies. REDLattice's new CEO, Andrew Boyd, stated Paragon "fired" Italy because the relationship was "not worth it" from a risk perspective after the allegations, not due to an internal investigation. Boyd admitted Paragon lacks the technical capability to monitor customer use of its "Graphite" spyware, meaning it cannot detect misuse unless customers self-report or third parties uncover it. The company also lacks a "kill switch" to disable customers found to be misusing the software, only able to halt support and essential updates which render the spyware ineffective within 12 hours. Boyd described this lack of oversight as a deliberate choice to protect customer privacy and a selling point, rather than an accountability issue.

Paragon's CEO has candidly admitted the company cannot technically monitor how its spyware customers use the software or detect misuse, a significant departure from the company's prior positioning. This lack of oversight, including the absence of a kill switch, positions Paragon as having less accountability than competitors like NSO Group, despite the acquisition by a US firm. The company's strategy hinges on customer vetting and the argument that oversight would harm business, a stance critics argue is "reckless" and "a massive red flag" for regulatory bodies.

The revelations highlight a broader concern within the offensive cyber industry regarding self-regulation and transparency. Paragon's acquisition by AE Industrial Partners and merger with REDLattice appears to be a strategic move to overcome foreign ownership restrictions and tap into the US market, with implied government awareness. This case raises questions about the effectiveness of US oversight on newly acquired or domestic cyber operations originating from foreign entities and suggests the industry's business model inherently conflicts with robust accountability measures.