ICE’s Zero-Click Threat to Privacy and the First Amendment

DHS Secretary Markwayne Mullin. PHOTO CREDIT: Gage Skidmore

Immigration and Customs Enforcement (ICE) is now using powerful “zero-click” commercial spyware that can break encrypted communications – a step that should alarm anyone concerned about privacy, civil liberties, and constitutional limits on government surveillance. 

At the center of the NPR story is “Graphite,” a tool developed by Paragon Solutions. Unlike traditional hacking methods, Graphite relies on “zero-click” exploits – meaning it can infiltrate a phone without the user doing anything at all. No suspicious links. No malicious attachments. Just silent compromise. 

If that sounds familiar, it should. As PPSA has previously warned in our analysis of Pegasus spyware, zero-click tools represent the cutting edge of surveillance: invisible, unaccountable, and extraordinarily intrusive. Like a pathogen spreading without contact, they turn personal devices into government multimedia surveillance devices.

From Counterterrorism to Domestic Use

ICE says the technology is aimed at dismantling fentanyl trafficking networks and other serious threats. But NPR’s reporting raises serious concerns about how broadly such tools might be used – and against whom. 

ICE has expanded its surveillance footprint domestically, including monitoring protests and other constitutionally protected activities. The risk is clear: tools justified for national security can quickly veer into routine domestic enforcement – or even the surveillance of constitutionally protected protests. Once established, Graphite will almost certainly migrate to other agencies, from the FBI to the IRS, supercharged by AI technology.

If spyware of this power can be deployed with minimal judicial oversight, it becomes the digital equivalent of a general warrant – precisely what the Fourth Amendment was designed to forbid.

A Tool with a Troubling Track Record

The risks are not hypothetical. NPR reports that Graphite has already been used by foreign governments to target journalists and members of civil society. Researchers identified cases in which phones belonging to journalists and humanitarian workers were compromised through messaging platforms like WhatsApp. 

This mirrors the global experience with Pegasus and similar tools, which have repeatedly been used not just against criminals, but against dissidents, reporters, and political opponents.

The Constitutional Stakes

The deployment of zero-click spyware inside the United States raises profound constitutional questions. Unlike traditional surveillance, which might be constrained by warrants or physical limitations, these tools allow the government to access the most intimate details of a person’s life – messages, photos, location, even real-time communications – without detection.

Layer that capability onto the federal government’s growing practice of purchasing Americans’ data from brokers, and the result begins to resemble a comprehensive, warrantless surveillance architecture.

Even ICE’s assurances that its use will “comply with constitutional requirements” ring hollow without transparency or meaningful oversight. 

The Section 702 Debate

Congress now faces a choice. It can allow this technology to take root in domestic law enforcement with minimal guardrails, or it can insist on strict warrant requirements, transparency, and accountability before such tools become entrenched. The House vote on the reauthorization of the FISA Section 702 surveillance authority, set to take place within days, is the best chance Congress will have to set the precedent for guardrails on out-of-control federal surveillance.
​
If zero-click surveillance becomes routine, the line between targeting criminals and monitoring citizens may disappear altogether.

DONATE & HELP US DEFEND YOUR FOURTH AMENDMENT RIGHTS