Paragon Solutions, a spyware manufacturer, has positioned itself as a responsible player in the industry, claiming it does not sell its products to authoritarian regimes or those with poor human rights records. Following its acquisition by AE Industrial Partners in December 2024 and the merger with REDLattice, WhatsApp alleged that Paragon's Graphite spyware was used to infect the phones of over 60 individuals across more than 20 countries, including journalists and activists. The University of Toronto's Citizen Lab identified two journalists and two activists in Italy among the targets.
Italian authorities denied any misuse of the spyware. Initially, Paragon and its new US owners did not comment on the allegations but later canceled two contracts with Italy's intelligence agencies. Andrew Boyd, CEO of Paragon and REDLattice, stated in an interview that the decision to sever ties with Italy was based on risk assessment rather than an investigation into the allegations. He acknowledged that Paragon lacks the technical means to monitor customer misuse of its software, relying instead on customers' admissions or third-party discoveries.
Boyd mentioned that Paragon does not have a 'kill switch' to disable customers in cases of misuse, only the ability to halt support and updates, which are crucial for the software's functionality. He described the lack of oversight as a selling point, arguing that customers would not buy their products if the company could access sensitive targeting information.
Critics, including John Scott-Railton from Citizen Lab, expressed concern over Paragon's lack of accountability compared to competitors like NSO Group, which has implemented measures to ensure oversight. US Senator Ron Wyden also criticized the lack of transparency in surveillance tools, suggesting that it leads to inevitable abuse.
Paragon was founded in 2019 by Israeli military veterans and has faced challenges in the US market due to government scrutiny of foreign spyware companies. Following the acquisition, Boyd noted an increase in interest from potential customers. The US government did not formally object to the acquisition, and Boyd stated that there were no conditions imposed on the company.
In the wake of the merger, other spyware companies, including NSO Group and Candiru, have also sought US contracts. Boyd, with his background in military intelligence and connections within the US government, aims to leverage these relationships to secure contracts for Paragon and REDLattice's products.