The US government banned Pegasus from NSO, but would buy rival spyware Paragon Graphite

The US government banned the use of NSO’s Pegasus spyware 18 months ago, but according to a new report today, at least one government agency is using very similar malware from a rival company: Paragon Graphite.

Graphite reportedly has the same capabilities as Pegasus, and the US Drug Enforcement Administration (DEA) is said to be using it…

Backstory: The US ban on the use of Pegasus

NSO Group makes spyware called Pegasus, which is sold to government and law enforcement agencies. The company buys so-called zero-day vulnerabilities (which are unknown to Apple) from hackers and its software is capable of performing zero-click exploits, where the target requires no user interaction.

In particular, simply receiving a particular iMessage – without opening it or interacting with it in any way – can lead to an iPhone being compromised, exposing personal data.

In 2021, the US government declared the spyware a threat to national security and banned its use in the country by public or private organizations.

The Department of Commerce’s Bureau of Industry and Security (BIS) has added the Israeli company to its Entity List, which prohibits the company’s products from being imported, exported or passed from one organization to another within the US.

The US government uses Paragon Graphite spyware instead

But one Financial times report claims the US government is instead using nearly identical spyware: Paragon’s Graphite.

According to four [industry figures]the U.S. Drug Enforcement and Administration Agency is among the top customers of Paragon’s signature product nicknamed Graphite.

The malware stealthily breaks through the protections of modern smartphones and bypasses the encryption of messaging apps such as Signal or WhatsApp, sometimes collecting the data from cloud backups, just like Pegasus does.

The DEA did not immediately comment, but it is alleged that the agency purchased Graphite for use by law enforcement partners in Mexico to fight drug cartels. A spokesman for the DEA said only that it is “using every lawful investigative tool available to prosecute the foreign-based cartels and individuals operating around the world responsible for the drug poisoning deaths of 107,735 Americans last year.”

However, the claim that the US bought it for use in Mexico is not exactly reassuring.

Congressman Adam Schiff, the chairman of the House Intelligence Committee, wrote to the DEA in December asking for more details about the purchase. Mexico is one of the worst abusers of NO’s Pegasus, which bought it nearly a decade ago.

Schiff wrote: “such use [of spyware] could have potential implications for U.S. national security, and go against efforts to discourage the widespread distribution of powerful surveillance capabilities to autocratic regimes and others who might abuse them.

Paragon applied for US permission for customer list

The FT report paints a very clear picture of Paragon learning from the NSO ban and very carefully targeting sales to the US government.

The Israeli company deliberately sought funding from two US-based venture capital firms, Battery Ventures and Red Dot, to gain US backing. It then hired a US political consultancy to advise on do’s and don’ts to win government contracts.

Paragon hired DC-based WestExec Advisors, the influential advisory group staffed by ex-Obama White House officials including Michele Flournoy, Avril Haines and Antony Blinken. Ex-US ambassador to Israel Dan Shapiro was also consulted, people with knowledge of the advisory effort said. Shapiro declined to comment.

Paragon also reportedly asked for US guidelines for its target customer list – countries whose use of graphite would not upset the White House. FT sources said 35 countries were approved, mostly in Europe and Asia.

9to5Mac’s Take

One of the biggest concerns about Pegasus was the role it played in human rights violations. It was sold to governments who used it to spy on political opponents, journalists, lawyers and human rights activists. To that extent, Paragon’s decision to informally consult with the U.S. government about which countries may buy it puts it a notch higher than NSO.

However, that doesn’t change the fact that Graphite, like Pegasus, is malware designed to breach Apple’s security and allow governments to remotely access and control their own citizens’ phones. Using graphite may not be rather just as bad as using Pegasus, but it’s still unethical and unacceptable. Hopefully Apple’s warnings will work for this spyware as well.

We’ve reached out to Apple for comment and will update with any response.