Paragon CEO Admits It Can't Detect Spyware Misuse
Original: The Secrets of the US Spyware King
Why This Matters
Commercial spyware's self-policing model has a structural hole: vendors can't actually see abuse.
Paragon Solutions CEO Andrew Boyd told WIRED in an exclusive interview that the company has no technical means to detect customer misuse of its Graphite spyware. Paragon canceled Italy's contracts after WhatsApp alleged infections on 60+ individuals across 20+ countries—without conducting any internal investigation.
Paragon Solutions, acquired by US equity firm AE Industrial Partners in December 2024 and merged with REDLattice (which announced plans to go public this week), has long marketed itself as the ethical operator in the commercial spyware space—pledging never to sell to authoritarian regimes and to cut off abusive customers. Those promises now look thinner than advertised.
In January 2025, WhatsApp alleged that Paragon's Graphite spyware had infected the phones of more than 60 individuals across more than 20 countries, including journalists and activists. Citizen Lab identified targets in Italy. Rather than investigate, CEO Andrew Boyd says Paragon simply canceled its two Italian intelligence contracts because the relationship was 'just not worth it, from a risk perspective.' Italian authorities denied any misuse.
More striking: Boyd confirmed Paragon has no technical visibility into who customers target or what data they extract. Misuse can only surface if a customer self-reports or an outside party—like WhatsApp or Citizen Lab—flags it. There is also no kill switch. Paragon can cut support and software updates, but Boyd notes those updates are so frequent and essential that systems 'start falling apart quite quickly' within roughly 12 hours. Boyd called WhatsApp and Citizen Lab's exposure 'a great service' to the company. Paragon made no effort to follow up with either organization to investigate potential misuse in other countries named in the allegations.