7 ms·

ICE obtains access to Israeli-made spyware that hack phones and encrypted apps

195 points by pera 1y ago

jsheard 1y ago
> [Paragon] has said that [...] it only does business with democracies. It has also said it has a no tolerance policy and will cut off government clients who use the spyware to target members of civil society, like journalists. > Paragon also refuses to disclose who its clients are and has said it does not have insight into how its clients use the technology against targets. Well colour me convinced!
- ktallett 1y ago
  The latter suggests it has no ability to know the former.
  - jsheard 1y ago
    Yeah, that's what I was getting at.
- reflexe 1y ago
  <removed by me>
jMyles 1y ago
Important story for sure, but this reporting is subpar IMO. > When it is successfully deployed against a target, the hacking software – called Graphite – can hack into any phone. By essentially taking control of the mobile phone, the user – in this case, Ice – can not only track an individual’s whereabouts, read their messages, look at their photographs, but it can also open and read information held on encrypted applications, like WhatsApp or Signal. Spyware like Graphite can also be used as a listening device, through the manipulation of the phone’s recorder. "When it is successfully deployed against a target" is obviously doing incredible lifting here - how is it deployed, and how does The Guardian know whatever details it knows (and isn't sharing)? Is there a background whistleblower between the lines here, or is this just paraphrasing the Wired reporting from last year? > John Scott-Railton, a senior research at the Citizen Lab at the University of Toronto, who is one of the world’s leading experts on cases in which spyware like Graphite has been abused by governments, said in a statement that such tools “were designed for dictatorships, not democracies built on liberty and protection of individual rights”. Kind of an odd take shoved into the middle of the article. Presumably this "Senior Research" [sic] had much more to say and this was the quote that The Guardian used. Regardless of for whom these exploits were "designed", obviously we know that power corrupts, and that this corrupting power can push liberal states into more totalitarian states (the article even cites Italy as an example of this). > The US government has in the past resisted using spyware technology made outside the US because of concerns that any company that sells technology to multiple government agencies around the world represents a potential security risk. Again, unsourced and unexplained. What does "resisted" mean - is this describing the Biden executive order? Or prior executive procurement policies? Or laws? Clarity is very important here and is not forthcoming. > “As long as the same mercenary spyware tech is going to multiple governments, there is a baked-in counterintelligence risk. Since all of them now know what secret surveillance tech the US is using, and would have special insights on how to detect it and track what the US is doing with it,” Scott-Railton said. “Short of Paragon cancelling all foreign contracts, I’m not sure how this goes away.” ...again, I want to give this guy the benefit of the doubt. This reads like it was a long interview and The Guardian probably cherry-picked parts of it. But how this goes away is: we learn how the exploit works and develop countermeasures. The indication (well, insinuation really) is that the exploit takes control of the OS of the phone, not that it amounts to any new cryptographic vulnerability. So, how does that happen? The discussion on the front page of HN yesterday on the thread, "We should have the ability to run any code we want on hardware we own" was refreshing and felt like the first real consensus we've had around here on this topic in several months. Specifically, it seems like we all now agree that our mobile devices have reached a combination of complexity and (state-assisted) corporate control that they are no longer safe for everyday use. And it's important to point out (and I'll bet that Scott-Railton did, in parts of the interview that weren't used for the article), it's not only (perhaps not even primarily) a matter of personal safety from our devices, but an inevitable degradation of societal power structures into surveillance states that necessarily arises from this concentration of power. I do not believe that there is an avenue for addressing this via institutional influence - the cited examples of Saudi Arabia, Italy, and the United States, despite having dramatically different configurations of state authority (and, probably in most people's minds, levels of legitimacy as states in the first place), all present identical attack surfaces in the face of "Graphite" and similar exploits. The ongoing imperative is the construction and maintenance of an internet which does not recognize state authority and on which censorship and surveillance cannot be conducted via state fiat.
- seadan83 1y ago
  Gotta say, you sound hypercritical. > "When it is successfully deployed against a target" is obviously doing incredible lifting here - how is it deployed, and how does The Guardian know whatever details it knows (and isn't sharing)? This is not a research paper where the guardian needs to go into those details. Those details are known based on previous incidents/issues and general knowledge.[1] > Kind of an odd take shoved into the middle of the article. Presumably this "Senior Research" [sic] had much more to say and this was the quote that The Guardian used. Regardless of for whom these exploits were "designed", obviously we know that power corrupts, and that this corrupting power can push liberal states into more totalitarian states (the article even cites Italy as an example of this). Guardian articles are pretty short. They're not going to quote someone when all they are trying to get is that these are risky tools that invite abuse. So they interviewed an expert who could give a quote to that effect. Why is that shovelled in? This is very much "WHY" someone should care. It's a core tenant of journalism, don't just present what - but also some analysis for what it means. > Again, unsourced and unexplained. What does "resisted" mean - is this describing the Biden executive order? Or prior executive procurement policies? Or laws? Clarity is very important here and is not forthcoming. Yeah, are they going to link to 30 different articles and so forth? Here you go, a quick reference: [2] > ...again, I want to give this guy the benefit of the doubt. This reads like it was a long interview and The Guardian probably cherry-picked parts of it. Why does any of the quote sound cherry-picked? The context seems clear: other governments use this tool, if USG does too, then other governments know the capabilities. It's an intrinsic problem. Seems to be completely conveyed via the quotes, and that was presumably the reason to interview this additional person. > The indication (well, insinuation really) is that the exploit takes control of the OS of the phone, not that it amounts to any new cryptographic vulnerability. So, how does that happen? How this happens is WAY out of scope of the article. This is a general news article that is around 300 or so words. It's not a security bulletin or a tech focused article. Why do you expect these details? Can you give any other examples from say the LaTimes, BBC.co.uk, or any other similar news services? > And it's important to point out (and I'll bet that Scott-Railton did, in parts of the interview that weren't used for the article), it's not only (perhaps not even primarily) a matter of personal safety from our devices, but an inevitable degradation of societal power structures into surveillance states that necessarily arises from this concentration of power. This does seem implied. The quote "were designed for dictatorships, not democracies built on liberty and protection of individual rights" is really saying this, no? Like, it's saying exactly, this technology is a concern because it can be abused and is a tool for authoritarian countries and not democracies. > The ongoing imperative is the construction and maintenance of an internet which does not recognize state authority and on which censorship and surveillance cannot be conducted via state fiat. I agree with your premise here. In this case, the article that the USG is adopting these tools should be well alarming to you. [1] https://citizenlab.ca/2025/06/first-forensic-confirmation-of-paragons-ios-mercenary-spyware-finds-journalists-targeted/ https://citizenlab.ca/2025/06/first-forensic-confirmation-of... [2] https://www.federalregister.gov/documents/2023/03/30/2023-06730/prohibition-on-use-by-the-united-states-government-of-commercial-spyware-that-poses-risks-to https://www.federalregister.gov/documents/2023/03/30/2023-06...
krunck 1y ago
[flagged]
- ktallett 1y ago
  It's odd this has been downvoted. There isn't anything factually incorrect. All statements have been proven.
  - SirFatty 1y ago
    Because it has nothing to do with the story, perhaps?
    - ktallett 1y ago
      I would say it is relevant as it shows that the company are potentially being dishonest about their intentions and marketing.
    - anthem2025 1y ago
      It speaks to the credibility of the people involved when they claim to protect journalists.
    - Fnoord 1y ago
      Every Israeli is drafted when reaching adolescence age. Intelligent tech people end up in Unit 8200 (part of IDF). These young people end up with a plethora of experience, using it for their career or even security related startups, yet loyalty often lies with state of Israel. The legal presence / country of a company very likely performing a genocide is very much relevant and ontopic. Look up the dark history of companies like IBM and IG Farben and the term "Wir haben es nicht gewußt".
  - CLPadvocate 1y ago
    [flagged]
    - ktallett 1y ago
t123278713247 1y ago
Ehud Barak was on Paragon's board of directors. Barak also invested with Epstein in Carbyne: https://www.jns.org/jns/benjamin-netanyahu/23/6/2/292333/ https://www.jns.org/jns/benjamin-netanyahu/23/6/2/292333/ Other data collection/surveillance software from the Epstein circle include PROMIS (Robert Maxwell allegedly sold a backdoored version), Chiliad (FBI search software, Christine Maxwell, seems legit) and CargoMetrics (Ghislaine Maxwell's husband, maritime container tracking).
dttze 1y ago
[flagged]
ktallett 1y ago
I feel the key change we as civilians need is to move to a non-local stored detail. Where our devices are access points to decentralised mesh networked apps. These companies and governments have been proven time and time again to not obey appropriate measures for invalid reasoning.
- mandeepj 1y ago
  I don’t think what you are proposing is going to work!! > Where our devices are access points Then that would be your exposure
- popalchemist 1y ago
  All other things being equal, local storage is always going to be preferable to cloud storage, because the surface of attack is intrinsically limited by the need for having the physical device in hand.
OutOfHere 1y ago
There are three main categories of entry into a device via zero-days: WhatsApp/Signal, SMS/MMS, and Firefox/Chrome/Safari. If these can be isolated, entering a device could become harder.
- mandeepj 1y ago
  I wonder if those apps can be operated from a secure vault or conclave Edit: Something like this, but for phones https://learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/ https://learn.microsoft.com/en-us/windows/security/applicati...
  - OutOfHere 1y ago
    I already have two secure conclaves in my phone, and they're already used up for other apps, e.g. finance apps, etc. One of them uses Work Profile and the other uses Knox. I don't think that more such regions are allowed on non-rooted Android. As for iOS, to my knowledge it doesn't allow for any such app segregation. In general, we need stronger per-app isolation such that a zero-day affecting one app doesn't grant any access to anything else.
    - mandeepj 1y ago
      Seems like you have an android! I wrote my parent comment in context of an iPhone. Sorry for not clarifying earlier
  - exceptione 1y ago
    https://grapheneos.org/features https://grapheneos.org/features (Microsoft and security are distinct concepts, btw.)
- deleted 1y ago
  [deleted]
- upofadown 1y ago
  SMS is inherently plain text. I think a user would have to click on a link for an attack to work.
bawolff 1y ago
In some ways i think the most interesting aspect is that US federal government has to outsource its spyware. Is it just that the NSA is unwilling (legally prevented?) to share their toys? Its hard to imagine they don't have capabilities like this.
- x0x0 1y ago
  I suspect the nsa doesn't want to burn their 0 days on this.
  - itqwertz 1y ago
    I suspect Israel does whatever they want under the auspices of national security, gives “private” cybersecurity corporations latitude to circumvent international laws, then packages it all up to sell to the highest bidder.
    - bawolff 1y ago
      It seems pretty unlikely that selling a zero-day to a state actor is a violation of international law, unless the vendor knows that state actor intends to use it to commit an internationally wrongful act. Like at the very worst - selling "cyberweapons" would follow the same rules as selling actual weapons. I don't super follow US politics, but i don't think we are at the point where ICE is comitting crimes against humanity - which i think is what would be required for this transaction to violate international law.
- vFunct 1y ago
  NSA isn't allowed to spy on US citizens. NSA is a US military organization under Department of Defense, and Posse Comitatus act makes it unlawful for the US military to act as a police force in the US. One of the few good things revealed by Edward Snowdens leaks was the fact that the NSA has filters for intercepted communications to filter out comms from US citizens. This was in top-secret programs that had no reason to be publicly known, and yet the NSA still had these filters installed anyways, because everyone in the NSA understands that they're not a law-enforcement agency, because of Posse Comitatus.
0cf8612b2e1e 1y ago
The nature of the exploits is surely secret, but I wonder if Lockdown Mode is at all effective at blocking these attacks.
- deleted 1y ago
  [deleted]
kittikitti 1y ago
The amount of companies actively using Israeli spyware like BrightData and Imperva is outstanding. All their data goes through their networks. I don't trust any government led site because they are all incredibly incompetent and corrupt. The United States is on their last legs.
fortran77 1y ago
It's nice when people, countries, and organizations can collaborate to make the world safer.
tptacek 1y ago
As usual, I want to point out how silly these analyses are, because there is a whole ecosystem of companies (incl. several directly connected to major US defense contractors, and many more across the NATO countries) that provide exploit development and maintenance and implant technology. The only reason you hear about companies like Paragon is because they're comfortable being named; the ones you haven't heard about are more capable and more plugged in. Every time a story on HN comes up about how bug bounties are underpaid and how much exploits are worth, I recite the bit about how serious grey-market vendors can run up the score on a serious vulnerability by (1) selling the same vulnerability to every IC/LEO agency in allied countries and (2) selling maintenance contracts to convert those agencies into recurring revenue. These are the companies I'm talking about when I say that. I'm never thinking of Paragon. Of course ICE has exploit and implant tech.

195 points by pera 1y ago

> [Paragon] has said that [...] it only does business with democracies. It has also said it has a no tolerance policy and will cut off government clients who use the spyware to target members of civil society, like journalists. > Paragon also refuses to disclose who its clients are and has said it does not have insight into how its clients use the technology against targets. Well colour me convinced!

ktallett 1y ago
The latter suggests it has no ability to know the former.
- jsheard 1y ago
  Yeah, that's what I was getting at.
reflexe 1y ago
<removed by me>

jMyles 1y ago

Important story for sure, but this reporting is subpar IMO. > When it is successfully deployed against a target, the hacking software – called Graphite – can hack into any phone. By essentially taking control of the mobile phone, the user – in this case, Ice – can not only track an individual’s whereabouts, read their messages, look at their photographs, but it can also open and read information held on encrypted applications, like WhatsApp or Signal. Spyware like Graphite can also be used as a listening device, through the manipulation of the phone’s recorder. "When it is successfully deployed against a target" is obviously doing incredible lifting here - how is it deployed, and how does The Guardian know whatever details it knows (and isn't sharing)? Is there a background whistleblower between the lines here, or is this just paraphrasing the Wired reporting from last year? > John Scott-Railton, a senior research at the Citizen Lab at the University of Toronto, who is one of the world’s leading experts on cases in which spyware like Graphite has been abused by governments, said in a statement that such tools “were designed for dictatorships, not democracies built on liberty and protection of individual rights”. Kind of an odd take shoved into the middle of the article. Presumably this "Senior Research" [sic] had much more to say and this was the quote that The Guardian used. Regardless of for whom these exploits were "designed", obviously we know that power corrupts, and that this corrupting power can push liberal states into more totalitarian states (the article even cites Italy as an example of this). > The US government has in the past resisted using spyware technology made outside the US because of concerns that any company that sells technology to multiple government agencies around the world represents a potential security risk. Again, unsourced and unexplained. What does "resisted" mean - is this describing the Biden executive order? Or prior executive procurement policies? Or laws? Clarity is very important here and is not forthcoming. > “As long as the same mercenary spyware tech is going to multiple governments, there is a baked-in counterintelligence risk. Since all of them now know what secret surveillance tech the US is using, and would have special insights on how to detect it and track what the US is doing with it,” Scott-Railton said. “Short of Paragon cancelling all foreign contracts, I’m not sure how this goes away.” ...again, I want to give this guy the benefit of the doubt. This reads like it was a long interview and The Guardian probably cherry-picked parts of it. But how this goes away is: we learn how the exploit works and develop countermeasures. The indication (well, insinuation really) is that the exploit takes control of the OS of the phone, not that it amounts to any new cryptographic vulnerability. So, how does that happen? The discussion on the front page of HN yesterday on the thread, "We should have the ability to run any code we want on hardware we own" was refreshing and felt like the first real consensus we've had around here on this topic in several months. Specifically, it seems like we all now agree that our mobile devices have reached a combination of complexity and (state-assisted) corporate control that they are no longer safe for everyday use. And it's important to point out (and I'll bet that Scott-Railton did, in parts of the interview that weren't used for the article), it's not only (perhaps not even primarily) a matter of personal safety from our devices, but an inevitable degradation of societal power structures into surveillance states that necessarily arises from this concentration of power. I do not believe that there is an avenue for addressing this via institutional influence - the cited examples of Saudi Arabia, Italy, and the United States, despite having dramatically different configurations of state authority (and, probably in most people's minds, levels of legitimacy as states in the first place), all present identical attack surfaces in the face of "Graphite" and similar exploits. The ongoing imperative is the construction and maintenance of an internet which does not recognize state authority and on which censorship and surveillance cannot be conducted via state fiat.

seadan83 1y ago
Gotta say, you sound hypercritical. > "When it is successfully deployed against a target" is obviously doing incredible lifting here - how is it deployed, and how does The Guardian know whatever details it knows (and isn't sharing)? This is not a research paper where the guardian needs to go into those details. Those details are known based on previous incidents/issues and general knowledge.[1] > Kind of an odd take shoved into the middle of the article. Presumably this "Senior Research" [sic] had much more to say and this was the quote that The Guardian used. Regardless of for whom these exploits were "designed", obviously we know that power corrupts, and that this corrupting power can push liberal states into more totalitarian states (the article even cites Italy as an example of this). Guardian articles are pretty short. They're not going to quote someone when all they are trying to get is that these are risky tools that invite abuse. So they interviewed an expert who could give a quote to that effect. Why is that shovelled in? This is very much "WHY" someone should care. It's a core tenant of journalism, don't just present what - but also some analysis for what it means. > Again, unsourced and unexplained. What does "resisted" mean - is this describing the Biden executive order? Or prior executive procurement policies? Or laws? Clarity is very important here and is not forthcoming. Yeah, are they going to link to 30 different articles and so forth? Here you go, a quick reference: [2] > ...again, I want to give this guy the benefit of the doubt. This reads like it was a long interview and The Guardian probably cherry-picked parts of it. Why does any of the quote sound cherry-picked? The context seems clear: other governments use this tool, if USG does too, then other governments know the capabilities. It's an intrinsic problem. Seems to be completely conveyed via the quotes, and that was presumably the reason to interview this additional person. > The indication (well, insinuation really) is that the exploit takes control of the OS of the phone, not that it amounts to any new cryptographic vulnerability. So, how does that happen? How this happens is WAY out of scope of the article. This is a general news article that is around 300 or so words. It's not a security bulletin or a tech focused article. Why do you expect these details? Can you give any other examples from say the LaTimes, BBC.co.uk, or any other similar news services? > And it's important to point out (and I'll bet that Scott-Railton did, in parts of the interview that weren't used for the article), it's not only (perhaps not even primarily) a matter of personal safety from our devices, but an inevitable degradation of societal power structures into surveillance states that necessarily arises from this concentration of power. This does seem implied. The quote "were designed for dictatorships, not democracies built on liberty and protection of individual rights" is really saying this, no? Like, it's saying exactly, this technology is a concern because it can be abused and is a tool for authoritarian countries and not democracies. > The ongoing imperative is the construction and maintenance of an internet which does not recognize state authority and on which censorship and surveillance cannot be conducted via state fiat. I agree with your premise here. In this case, the article that the USG is adopting these tools should be well alarming to you. [1] https://citizenlab.ca/2025/06/first-forensic-confirmation-of-paragons-ios-mercenary-spyware-finds-journalists-targeted/ https://citizenlab.ca/2025/06/first-forensic-confirmation-of... [2] https://www.federalregister.gov/documents/2023/03/30/2023-06730/prohibition-on-use-by-the-united-states-government-of-commercial-spyware-that-poses-risks-to https://www.federalregister.gov/documents/2023/03/30/2023-06...

krunck 1y ago

[flagged]

ktallett 1y ago
It's odd this has been downvoted. There isn't anything factually incorrect. All statements have been proven.
- SirFatty 1y ago
  Because it has nothing to do with the story, perhaps?
  - ktallett 1y ago
    I would say it is relevant as it shows that the company are potentially being dishonest about their intentions and marketing.
  - anthem2025 1y ago
    It speaks to the credibility of the people involved when they claim to protect journalists.
  - Fnoord 1y ago
    Every Israeli is drafted when reaching adolescence age. Intelligent tech people end up in Unit 8200 (part of IDF). These young people end up with a plethora of experience, using it for their career or even security related startups, yet loyalty often lies with state of Israel. The legal presence / country of a company very likely performing a genocide is very much relevant and ontopic. Look up the dark history of companies like IBM and IG Farben and the term "Wir haben es nicht gewußt".
- CLPadvocate 1y ago
  [flagged]
  - ktallett 1y ago

t123278713247 1y ago

Ehud Barak was on Paragon's board of directors. Barak also invested with Epstein in Carbyne: https://www.jns.org/jns/benjamin-netanyahu/23/6/2/292333/ https://www.jns.org/jns/benjamin-netanyahu/23/6/2/292333/ Other data collection/surveillance software from the Epstein circle include PROMIS (Robert Maxwell allegedly sold a backdoored version), Chiliad (FBI search software, Christine Maxwell, seems legit) and CargoMetrics (Ghislaine Maxwell's husband, maritime container tracking).

dttze 1y ago

[flagged]

ktallett 1y ago

I feel the key change we as civilians need is to move to a non-local stored detail. Where our devices are access points to decentralised mesh networked apps. These companies and governments have been proven time and time again to not obey appropriate measures for invalid reasoning.

mandeepj 1y ago
I don’t think what you are proposing is going to work!! > Where our devices are access points Then that would be your exposure
popalchemist 1y ago
All other things being equal, local storage is always going to be preferable to cloud storage, because the surface of attack is intrinsically limited by the need for having the physical device in hand.

OutOfHere 1y ago

There are three main categories of entry into a device via zero-days: WhatsApp/Signal, SMS/MMS, and Firefox/Chrome/Safari. If these can be isolated, entering a device could become harder.

mandeepj 1y ago
I wonder if those apps can be operated from a secure vault or conclave Edit: Something like this, but for phones https://learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/ https://learn.microsoft.com/en-us/windows/security/applicati...
- OutOfHere 1y ago
  I already have two secure conclaves in my phone, and they're already used up for other apps, e.g. finance apps, etc. One of them uses Work Profile and the other uses Knox. I don't think that more such regions are allowed on non-rooted Android. As for iOS, to my knowledge it doesn't allow for any such app segregation. In general, we need stronger per-app isolation such that a zero-day affecting one app doesn't grant any access to anything else.
  - mandeepj 1y ago
    Seems like you have an android! I wrote my parent comment in context of an iPhone. Sorry for not clarifying earlier
- exceptione 1y ago
  https://grapheneos.org/features https://grapheneos.org/features (Microsoft and security are distinct concepts, btw.)
deleted 1y ago
[deleted]
upofadown 1y ago
SMS is inherently plain text. I think a user would have to click on a link for an attack to work.

bawolff 1y ago

In some ways i think the most interesting aspect is that US federal government has to outsource its spyware. Is it just that the NSA is unwilling (legally prevented?) to share their toys? Its hard to imagine they don't have capabilities like this.

x0x0 1y ago
I suspect the nsa doesn't want to burn their 0 days on this.
- itqwertz 1y ago
  I suspect Israel does whatever they want under the auspices of national security, gives “private” cybersecurity corporations latitude to circumvent international laws, then packages it all up to sell to the highest bidder.
  - bawolff 1y ago
    It seems pretty unlikely that selling a zero-day to a state actor is a violation of international law, unless the vendor knows that state actor intends to use it to commit an internationally wrongful act. Like at the very worst - selling "cyberweapons" would follow the same rules as selling actual weapons. I don't super follow US politics, but i don't think we are at the point where ICE is comitting crimes against humanity - which i think is what would be required for this transaction to violate international law.
vFunct 1y ago
NSA isn't allowed to spy on US citizens. NSA is a US military organization under Department of Defense, and Posse Comitatus act makes it unlawful for the US military to act as a police force in the US. One of the few good things revealed by Edward Snowdens leaks was the fact that the NSA has filters for intercepted communications to filter out comms from US citizens. This was in top-secret programs that had no reason to be publicly known, and yet the NSA still had these filters installed anyways, because everyone in the NSA understands that they're not a law-enforcement agency, because of Posse Comitatus.

0cf8612b2e1e 1y ago

The nature of the exploits is surely secret, but I wonder if Lockdown Mode is at all effective at blocking these attacks.

deleted 1y ago
[deleted]

kittikitti 1y ago

The amount of companies actively using Israeli spyware like BrightData and Imperva is outstanding. All their data goes through their networks. I don't trust any government led site because they are all incredibly incompetent and corrupt. The United States is on their last legs.

fortran77 1y ago

It's nice when people, countries, and organizations can collaborate to make the world safer.

tptacek 1y ago

As usual, I want to point out how silly these analyses are, because there is a whole ecosystem of companies (incl. several directly connected to major US defense contractors, and many more across the NATO countries) that provide exploit development and maintenance and implant technology. The only reason you hear about companies like Paragon is because they're comfortable being named; the ones you haven't heard about are more capable and more plugged in. Every time a story on HN comes up about how bug bounties are underpaid and how much exploits are worth, I recite the bit about how serious grey-market vendors can run up the score on a serious vulnerability by (1) selling the same vulnerability to every IC/LEO agency in allied countries and (2) selling maintenance contracts to convert those agencies into recurring revenue. These are the companies I'm talking about when I say that. I'm never thinking of Paragon. Of course ICE has exploit and implant tech.