{ "version": "1.0.0", "generatedAt": "2026-10-19T05:56:04.970Z", "findingType": "finding", "findingId": 4128, "contentHash": "47985912c38ead5a22c1e930ca945d3d62713b84cb73d716dba24587ccd8fb0c", "title": "Israeli Spyware Maker Paragon (Founded by Ehud Barak) Acquired by Florida PE for $500M-$900M; ICE Reactivated $2M Contract Post-Acquisition; US Military Leaders Joined Board", "summary": "Paragon Solutions was founded in Israel in 2019 by former Prime Minister Ehud Barak and former Unit 8200 commander Ehud Schneorson. Paragon's flagship product, Graphite, is spyware capable of penetrating encrypted messaging applications including WhatsApp, Telegram, and Signal — a capability competitive with NSO Group's Pegasus. In December 2024, Florida-based private-equity firm AE Industrial Partners acquired Paragon for $500 million upfront with an additional $400 million tied to performance milestones (total potential consideration up to $900 million). AE merged Paragon with REDLattice, an existing US portfolio company. Board members of REDL Ultimate Holdings (the merged entity) include Andrew Boyd, former senior executive at the CIA and US Air Force, and James McConville, former Chief of Staff of the US Army — placing leadership of US intelligence and US ground forces inside the corporate governance of an Israeli-origin spyware company now operating under US ownership. Immigration and Customs Enforcement (ICE) had previously canceled a $2 million contract with Paragon; following the US acquisition, ICE reactivated the contract. Goblin House platform pattern analysis identified the structural sequence — Israeli founding by former PM and Unit 8200 leadership → Graphite product matures → US PE acquisition with US military-intelligence board → US federal contract restored — as a documented pattern: the shell-style restructuring of foreign spyware capabilities through US private equity to restore US federal-customer access.", "methodology": "This finding was identified through systematic investigation of 7 entities. Evidence was classified as \"critical\" severity based on source verification tier (investigative_journalism, industry_research, corporate_records, financial_journalism). The finding was reviewed under editorial status \"published\".", "sources": [ { "url": "https://citizenlab.ca/research/a-first-look-at-paragons-proliferating-spyware-operations/", "label": "Citizen Lab: Virtue or Vice? A First Look at Paragon's Proliferating Spyware Operations", "type": "primary" }, { "url": "https://www.infosecurity-magazine.com/news/ice-reinstated-spyware-paragon/", "label": "Infosecurity Magazine: ICE Reinstates Contract with Spyware Vendor Paragon", "type": "primary" }, { "url": "https://finance.yahoo.com/news/red-lattice-acquires-israeli-spyware-094044441.html", "label": "Yahoo Finance: RED Lattice acquires Israeli spyware company Paragon for $500m", "type": "primary" }, { "url": "https://techcrunch.com/2024/12/16/israeli-spyware-maker-paragon-bought-by-u-s-private-equity-giant/", "label": "TechCrunch: Israeli spyware maker Paragon bought by US private equity giant", "type": "primary" }, { "url": "https://jackpoulson.substack.com/p/exclusive-ice-has-reactivated-its", "label": "Jack Poulson: Exclusive — ICE has reactivated its $2 million contract with Israeli spyware firm Paragon", "type": "primary" }, { "url": "https://www.calcalistech.com/ctechnews/article/s1ucev64kg", "label": "Calcalistech: Spyware startup Paragon acquired for up to $900M by investment firm AE", "type": "primary" }, { "url": "https://goblinhouse.net/entity/nso-group", "label": "NSO Group — entity dossier", "type": "primary" }, { "url": "https://goblinhouse.net/entity/paragon-solutions", "label": "Paragon Solutions — entity dossier", "type": "primary" }, { "url": "https://goblinhouse.net/entity/techcrunch", "label": "TechCrunch — entity dossier", "type": "primary" }, { "url": "https://goblinhouse.net/entity/whatsapp", "label": "WhatsApp — entity dossier", "type": "primary" } ], "queries": [ { "description": "Finding record lookup", "table": "findings", "parameters": { "id": 4128 } }, { "description": "Involved entity resolution", "table": "entities", "parameters": { "names": [ "Paragon Solutions", "REDLattice", "AE Industrial Partners", "Ehud Barak", "Immigration and Customs Enforcement (ICE)", "Andrew Boyd", "James McConville" ] } } ], "dataSnapshot": { "id": 4128, "title": "Israeli Spyware Maker Paragon (Founded by Ehud Barak) Acquired by Florida PE for $500M-$900M; ICE Reactivated $2M Contract Post-Acquisition; US Military Leaders Joined Board", "findingType": "structural", "description": "Paragon Solutions was founded in Israel in 2019 by former Prime Minister Ehud Barak and former Unit 8200 commander Ehud Schneorson. Paragon's flagship product, Graphite, is spyware capable of penetrating encrypted messaging applications including WhatsApp, Telegram, and Signal — a capability competitive with NSO Group's Pegasus. In December 2024, Florida-based private-equity firm AE Industrial Partners acquired Paragon for $500 million upfront with an additional $400 million tied to performance milestones (total potential consideration up to $900 million). AE merged Paragon with REDLattice, an existing US portfolio company. Board members of REDL Ultimate Holdings (the merged entity) include Andrew Boyd, former senior executive at the CIA and US Air Force, and James McConville, former Chief of Staff of the US Army — placing leadership of US intelligence and US ground forces inside the corporate governance of an Israeli-origin spyware company now operating under US ownership. Immigration and Customs Enforcement (ICE) had previously canceled a $2 million contract with Paragon; following the US acquisition, ICE reactivated the contract. Goblin House platform pattern analysis identified the structural sequence — Israeli founding by former PM and Unit 8200 leadership → Graphite product matures → US PE acquisition with US military-intelligence board → US federal contract restored — as a documented pattern: the shell-style restructuring of foreign spyware capabilities through US private equity to restore US federal-customer access.", "severity": "critical", "evidenceSummary": "Paragon founding 2019, Ehud Barak and Ehud Schneorson founders, Unit 8200 lineage: Citizen Lab investigation (\"Virtue or Vice? A First Look at Paragon's Proliferating Spyware Operations\"). Graphite product capabilities: Citizen Lab, TechCrunch, Calcalistech reporting. AE Industrial Partners acquisition December 2024, $500M+$400M structure: TechCrunch, Calcalistech, Yahoo Finance. REDLattice merger and REDL Ultimate Holdings board (Boyd, McConville): SEC corporate records via Yahoo Finance reporting. ICE contract reactivation: Infosecurity Magazine, Jack Poulson investigative reporting.", "publicInterest": "The 2021 US Entity List designation of NSO Group and the broader policy concern about foreign spyware were grounded in documented harm to journalists, dissidents, and U.S. officials. The Paragon acquisition structure demonstrates one mechanism by which an Israeli-origin spyware capability can transition to US federal-customer access: acquisition by US private equity, integration with existing US portfolio company, installation of former US intelligence and military leadership on the board, restoration of previously-canceled US federal contracts. The structural sequence — and the speed of contract reactivation — warrants oversight examination of whether the US foreign-spyware policy regime contemplates this pathway and what restrictions, if any, apply to US-acquired entities with Israeli intelligence-service founding leadership.", "sourceTypes": [ "investigative_journalism", "industry_research", "corporate_records", "financial_journalism" ], "sourceUrls": [ { "url": "https://citizenlab.ca/research/a-first-look-at-paragons-proliferating-spyware-operations/", "label": "Citizen Lab: Virtue or Vice? A First Look at Paragon's Proliferating Spyware Operations" }, { "url": "https://www.infosecurity-magazine.com/news/ice-reinstated-spyware-paragon/", "label": "Infosecurity Magazine: ICE Reinstates Contract with Spyware Vendor Paragon" }, { "url": "https://finance.yahoo.com/news/red-lattice-acquires-israeli-spyware-094044441.html", "label": "Yahoo Finance: RED Lattice acquires Israeli spyware company Paragon for $500m" }, { "url": "https://techcrunch.com/2024/12/16/israeli-spyware-maker-paragon-bought-by-u-s-private-equity-giant/", "label": "TechCrunch: Israeli spyware maker Paragon bought by US private equity giant" }, { "url": "https://jackpoulson.substack.com/p/exclusive-ice-has-reactivated-its", "label": "Jack Poulson: Exclusive — ICE has reactivated its $2 million contract with Israeli spyware firm Paragon" }, { "url": "https://www.calcalistech.com/ctechnews/article/s1ucev64kg", "label": "Calcalistech: Spyware startup Paragon acquired for up to $900M by investment firm AE" }, { "url": "https://goblinhouse.net/entity/nso-group", "label": "NSO Group — entity dossier" }, { "url": "https://goblinhouse.net/entity/paragon-solutions", "label": "Paragon Solutions — entity dossier" }, { "url": "https://goblinhouse.net/entity/techcrunch", "label": "TechCrunch — entity dossier" }, { "url": "https://goblinhouse.net/entity/whatsapp", "label": "WhatsApp — entity dossier" } ], "reviewStatus": "published", "goblin": { "name": "Scryxi", "slug": "scryxi" }, "createdAt": null }, "entities": [ { "id": 6835, "name": "Andrew Boyd", "slug": "andrew-boyd", "type": "person" }, { "id": 6836, "name": "James McConville", "slug": "james-mcconville", "type": "person" }, { "id": 98, "name": "Paragon Solutions", "slug": "paragon-solutions", "type": "company" }, { "id": 116, "name": "Ehud Barak", "slug": "ehud-barak", "type": "person" } ], "verificationSteps": [ "Retrieve finding #4128 from the findings table and confirm title, description, and severity match this bundle.", "Visit source: https://citizenlab.ca/research/a-first-look-at-paragons-proliferating-spyware-operations/ — confirm the claim described in the evidence summary.", "Visit source: https://www.infosecurity-magazine.com/news/ice-reinstated-spyware-paragon/ — confirm the claim described in the evidence summary.", "Visit source: https://finance.yahoo.com/news/red-lattice-acquires-israeli-spyware-094044441.html — confirm the claim described in the evidence summary.", "Visit source: https://techcrunch.com/2024/12/16/israeli-spyware-maker-paragon-bought-by-u-s-private-equity-giant/ — confirm the claim described in the evidence summary.", "Visit source: https://jackpoulson.substack.com/p/exclusive-ice-has-reactivated-its — confirm the claim described in the evidence summary.", "Visit source: https://www.calcalistech.com/ctechnews/article/s1ucev64kg — confirm the claim described in the evidence summary.", "Visit source: https://goblinhouse.net/entity/nso-group — confirm the claim described in the evidence summary.", "Visit source: https://goblinhouse.net/entity/paragon-solutions — confirm the claim described in the evidence summary.", "Visit source: https://goblinhouse.net/entity/techcrunch — confirm the claim described in the evidence summary.", "Visit source: https://goblinhouse.net/entity/whatsapp — confirm the claim described in the evidence summary.", "Cross-reference involved entities (Paragon Solutions, REDLattice, AE Industrial Partners, Ehud Barak, Immigration and Customs Enforcement (ICE), Andrew Boyd, James McConville) in the entities table.", "Verify the SHA-256 content hash by re-generating the JSON bundle and hashing it." ] }