We're Suing ICE. Here's Why

0:03Hello, and welcome to the 404 Media Podcast, where we bring you unparalleled access to hidden worlds, both online and IRL. 404 Media is a journalist-founded company and needs your support to subscribe. Go to 404media.co. As well as bonus content every single week, subscribers also get access to additional episodes where we respond to their best comments. Gain access to that content at 404media.co. I'm your host, Joseph, and with me are all of the 404 Media co-founders, the first being Sam Cole. Hello. Emmanuel Mayberg. Hello. And Jason Kebler. What's up, what's up? All right. Not really much housekeeping this week.

0:45So how about we just go straight into this story, which is also something of an announcement. The headline is we're suing ICE for its 2 million spyware contract. Jason, do you want to lead the discussion on this one? Who is we? It's us. It's 404 Media has sued ICE in DC federal court. I think this is something that we have always wanted to do, right? Like not necessarily sue ICE, but do FOIA lawsuits. So I guess, what is this lawsuit about and why are we doing it? Yeah, I've wanted to do this for a long time. You will see amazing FOIA-based reporters like Jason Leopold, for example, who's now at Bloomberg, and he'll get these amazing documents.

1:39And pretty often, it will turn out that you need to sue the government for access to those documents because they're not just going to hand them over. We've never really done this because it's expensive, obviously. And when we were working at Vice, I don't know if we actually tried it, but I imagine it would be difficult, probably, to get the resources to be allowed to do this sort of thing. And now that we're independent, we can do it. So, yes, this is a Freedom of Information Act lawsuit. basically i filed a foyer request with ice way back in october 2024 asking for documents related to this contract they have a company called paragon we'll talk about in a minute but basically they sell spyware for breaking into phones and ice i think they acknowledged the request once and never got back to me.

2:37And that is illegal. You're not supposed to do that. Of course, government agencies, especially US government agencies, often delay the release of any documents. You know, it's incredibly unusual for you to get the documents in the 30-day window or whatever it is. But usually they say, we're sorry, we have a massive backlog. Give us another 10, 20, 30 days or whatever, ICE just did not communicate at all. And these documents seem especially important now because ICE just reactivated this contract. It was put on hold during the Biden administration, and it's back now. So it seemed very timely and important to file this lawsuit so we could get the contract and we can see, you know, why I support this powerful tool, basically.

3:31Yeah, just like a little bit of FOIA nerdery before we get into the specifics here. As Joseph said, federal agencies have, I believe it is 30 days to respond to a FOIA request. Like you said, they almost never actually give you the documents in that time period. They will send like, oh, we're working on it, blah, blah, blah. But unfortunately, it seems like the only way to get documents in a timely manner sometimes is to file a lawsuit. And so as Joseph mentioned, it's like we have filed many, many, many FOIAs over the years, some of which do get ignored like this. And we probably would have ideally wanted to file more lawsuits over the years, but they are expensive.

4:23They're logistically complicated. We're not lawyers, so we needed to find a lawyer to do this for us. and I think often you have to do a cost-benefit analysis of like, do we really want these documents enough to like go to court over them? Because as Joseph mentioned, a lot of journalists and organizations that sue for this sort of stuff are successful doing it because it's a pretty open and shut case. It's like we're requesting this, like how taxpayer money is being spent and the specific document that Joseph asked for, this contract is very simple to provide. It's not something that is going to take the FOIA officer, which is the people in the Freedom of Information office that long to pull a contract.

5:15It should take a few seconds. We're not asking for tons and tons and tons of documents and deliberations and things like that. And so, I mean, our hope is that the system still works and that we'll be able to get these documents, hopefully, relatively quickly. But anyways, let's dive deeper into what Paragon is. So Paragon is a spyware company. Where are they based? Who do they sell to? What do they do? Yeah. So some listeners may be familiar with the government spyware industry. These are companies that sell remote phone and computer hacking tools to law enforcement and intelligence agencies.

5:58Some of those names you may have heard of include Hacking Team from Italy, FinFisher, I think from Germany. It's been a long time since I've covered FinFisher. then you have the infamous NSO group from Israel and Paragon is also from Israel and it has a US subsidiary and that's a context in which Paragon sits it's it develops a spyware and it sells it to government agencies listeners may also be very much aware that the government spyware industry is full of scandal and abuse. Hacking Team was used to target activists. Finn Fisher as well. I remember way back, basically when I started writing about this sort of thing in 2014, 2015, that sort of timeframe.

6:48It was being used to target activists in the Middle East and North Africa, the Finn Fisher spyware. And an NSO group has been used notoriously around the world to target activists and journalists as well, with even some indirect connections to Jamel Kosoji as well. Paragon positions itself differently. It says it is almost like the ethical equivalent to those companies. So while some of those companies will sell to a lot of different governments, including authoritarian states. Paragon says it doesn't. It really works with democracies. And one of those clients, and maybe we'll talk about in a minute, is Italy.

7:38Even with that being said, the last scandal going on in Italy with Paragon. And it's not just sort of the customers that separate it, it's also the product. And we'll go into more detail in a second, but it's still exceptionally powerful, but it focuses more on getting messages from encrypted chat apps like Signal or WhatsApp rather than taking control of the entire device. Right. So it essentially is spyware that compromises the phone for the purpose of reading encrypted messages that are on the device. Yeah. And the product specifically is called Graphite. and it will use presumably various exploits.

8:24One that was previously discovered by researchers and fixed was one in WhatsApp where the user of Paragon would send a PDF file to the target in WhatsApp and without the target even clicking a link, WhatsApp would render or load the PDF. That would trigger an exploit which would then be used and that would break into the phone. And that is, of course, what's especially notable about Paragon and other related spyware, is that this stuff can infect a phone, broadly speaking, without the target really doing anything. Of course, it has a massively powerful capability, which is more often than not outside of the realm and the budgets and the reach of even top-tier cybercriminals.

9:15we are talking nation-state and nation-state contractor sort of spyware. Whereas NSO Group, you know, they'll break into the phone and it will get the location data, the text messages, the phone calls, Graphite and Paragon position it as, we're doing a more limited ethical collection here. That being said, we don't know exactly what ICE is buying, which is why we're trying to get the contract in the first place because we don't actually know if it's for graphite or not it could be for a different piece of software all it says in the public procurement records is something like it's a proprietary developed solution and they'll give us training blah blah blah we don't know what ice has exactly but it costs two million dollars so presumably it's it's capable of doing something

10:22For years, I thought buying glasses was a nightmare. I'd sit at my optometrist's office and try on glasses I didn't like, which took forever to make and were riddled with hidden fees when I went to check out. Then I found Warby Parker, realized it didn't have to be this way, and I haven't looked back since. Warby Parker uses nothing but premium materials in each frame. Warby Parker designs every frame in-house, and their collection includes silhouettes, colors, and fits made to suit every face. I have a super wide face, but Warby Parker has me covered. Warby Parker offers everything you need for happier eyes.

10:58Eyeglasses, sunglasses, contact lenses, and eye exams. You can shop with them online, at home, and in stores. Warby Parker has over 300 retail locations across the U.S. and Canada where you can get styled by one of their friendly expert advisors. Warby Parker glasses start at$95 and include prescription lenses with anti-reflective, scratch-resistant coatings. Many Warby Parker locations offer comprehensive eye exams starting at$85. Add a pair and save 15 % when you purchase two or more prescription pairs of glasses or sunglasses. This offer is available both at home and in stores. free shipping and free 30-day returns.

11:38My favorite thing about Warby Parker is that I can get stylish modern glasses and sunglasses at a price point that feels super premium but doesn't hurt my wallet. I recently picked up a pair of black walnut Elio shades, frame width wide of course, which protect my eyes and elevate my outfits. Warby Parker has over 300 locations to help you find your next pair of glasses. You can also head over to warbyparker.com slash 404media right now. to try on any pair virtually. That's warbyparker.com slash 404media. warbyparker.com slash 404media. What's softer than cashmere and warmer than wool? It's not a riddle, it's an alpaca hoodie.

12:19And I had to check it out after hearing some of my favorite podcasters talking about Paca. Paca makes performance apparel from alpaca fiber, one of the world's most sustainable natural fibers. Their best-selling hoodie is softer than cashmere, warmer than wool, and breathable. It's lightweight but still cozy, doesn't stretch out, doesn't peel, and somehow keeps me warm when it's cold and cool when it's hot. Basically, it adapts to wherever life takes you. This hoodie is built for real life. Thermal regulating, odor resistant, durable, and made to last. Each one is handcrafted in Peru by artisans who stitch their name into the tag, a personal signature of quality and care.

13:00Over 100 ,000 people have already picked up the pack of hoodie. What makes it even better? Knowing it's made sustainably and ethically from traceable alpaca fiber, while supporting the communities and artisans in Peru who bring it to life. I've been into alpaca hoodies ever since I studied abroad in South America 15 years ago. But Paca is by far the best hoodie I've had. It's soft, stylish, and has become my everyday go-to hoodie as the weather cools off this fall. Right now, when you order your pack of hoodie, they'll throw in a free pair of their Alpaca Crew Socks. These are seriously next level.

13:35They keep your feet dry, never smell, and on top of that, they're just insanely cozy. If you've been thinking about leveling up your hoodie game, this is your sign to do it now. To grab your pack of hoodie and free pair of Alpaca Crew Socks, head to go.packaapparel.com slash 404media and use my code 404media. That's go.pakaapparel.com slash 404media and enter code 404media.

14:15So what do we know about who graphite has been used against before? What countries have used it? What is the history of it? because, as you said, there is a history of this spyware being used elsewhere, at least. Yeah. So, again, Paragon positions itself as, we're just going to work with democracies, we're going to be very, very above board, that sort of thing, which is why, presumably, they sold to Italy. And eventually, the Italian government was open about this. But only really after it was discovered, they had been used by presumably Italian authorities to target journalists, to target activists who were trying to save migrants, you know, obviously who are crossing oceans and seas and are at great risk of harming themselves.

15:10Paragon's technology was used against them. Eventually, Paragon even stopped selling the technology to Italy. Like, of course, we don't hear about it this much. If listeners want to read more about that, definitely go check out our colleague at TechCrunch, Lorenzo Franceschi Bicari, who has been covering spyware for years, and he did it with me for a very, very long time as well. But he's been following Paragon closely. And of course, being Italian as well, he has some pretty good insight into that sort of stuff. But it's not just Italy. Researchers at Citizen Lab, which is this academic security research body, they, as they often do, found fingerprints of this malware and this system online.

16:02And they identified deployments in Australia, Canada, Cyprus, Denmark, Israel and Singapore that's not to say that those countries are 100 % using Paragon or graphite pretty strong indication though and the research itself is very well caveated very well hedged but that's always an interesting sign when Citizen Lab starts to find oh there are deployments of NSO in this country or Paragon in this country or whatever and then I didn't actually know this until I started to write up our article about the lawsuit. But the New York Times, in one sentence, in one paragraph, in an older story about the spyware industry, they mentioned that the US DEA has used graphite.

16:54And there's no contract, at least not one under the Paragon Solutions US subsidiary name. I have four years out with DEA as well. They haven't been particularly cooperative. But maybe it's already being used in the US as well. Yeah, and I think the context of ICE having this$2 million contract, I know that the contract was paused for a while. I guess it was paused due to outrage, right? Yeah, it's a bit of both. So the contract is signed in September 2024. Wired finds it fairly soon after and covers it. and then it seems that this took the Biden administration by surprise. It seems that the White House did not know about it.

17:43Presumably ICE just went and bought it. And to be fair, why would the White House know about every single purchase by every single law enforcement agency, right? But the White House put a stock work order on this, basically saying, hey, you can't do this until we review it. Because weirdly, around the same sort of time, Biden had just signed an executive order that was designed to limit the use of spyware by government agencies. And that came after all of these abuses by companies such as NSO Group, you know, which presumably parts of the US and the White House did not want really to be anywhere near.

18:21You don't want to be near a company that is going around and being used to hack into the phones of activists and dissidents and that sort of thing. And there's also potentially a national security risk in that, I don't know, if a US law enforcement agency is using a tool developed by Israel, what's to say that that Israeli company may not be getting some sort of intelligence from it? Of course, that's more speculative, hypothetical, but there's a concern there as well. So Biden puts this pause on it, the Biden White House. It's for a year. Time passes. Obviously, Trump comes into power. Obviously, ICE starts his mass deportation campaign and effort.

19:06And now the contract's back. And then we file the lawsuit because, as you allude to, Jason, it feels even more urgent now to think, well, to find out, well, what is ICE using this incredibly powerful tool for? Probably the most powerful surveillance capability ICE has ever bought, really. Yeah, and I mean, we could get into it, but I feel like we've talked so much about the surveillance technology that ICE uses that we know that they have. And this is just something that is even more powerful if it is indeed graphite. And who knows who it could be turned against and in what contexts. But I think it's important that we do know the specifics of the contract and how they're doing it.

19:53So that's why we're suing. Do you want to talk a little bit more about that and just what people can do if they want to support this? Yeah. And I'll just say more specifically, the documents we're seeking are kind of what I nearly always request from agencies when I'm submitting a FOIA about a particular contract and it's like unsolicited bids, procurement contracts, documents blah blah blah the main one for me is something called a statement of work and this is a short document one page maybe two or three and it lays out and they have to create one of these because it explains sort of what the contract's for and it shows in explicit detail this is the use case for this technology this is why we have to buy it from this provider and this is what we're going to use it for?

20:52And of course, I think that's really, really important. It would still be important to know this even during the previous Biden administration. That's why I filed a freedom information request immediately because I want to know what ICE or really any US government agency is using very powerful spyware for. The only other real case we know a little bit about is when the DEA bought hacking team like more than 10 years ago at this point. And I think they were trying to do it for, I don't know, targets in Columbia, at least overseas and in South America, that sort of thing. So it'd be very useful to know what I plan to do with it.

21:34That said, if we get the statement of work back and it says, oh, we bought it to deal with child abuse or money laundering or something like that, the context and sort of the ground underneath ice's feet has shifted so much now that even if the spyware was sold to hsi homeland security investigations and deals with all of that serious organized crime or child abuse stuff they now are working closely with the information with the immigration part of ice that who's to say that tool may not be um used for them as well and after the contract was reactivated you had people like sanitarum wyden say that quote ice is already shredding due process and ruining lives and it's rushed to lock up kids cooks and firefighters who pose no threat to anyone i'm extremely concerned about how ice will use paragons spyware to further trample on the rights of americans and anyone who donald trump labels as an enemy, end quote.

22:35And then, yeah, just last thing. Obviously, we are only able to do this because of the generous support of our paying subscribers. So the best way to support this, to allow us to do this, is to become a paying, recurring subscriber. It's not just about the money, although, of course, that is one of the main things. It's about the, oh, when we have recurring revenue, we can attempt to forecast, okay, we're going to have this money and we can allocate it for this purpose, in this case, a lawsuit. Then maybe in the future, we can allocate it for, I don't know, trying to get these other documents or something like that.

23:17So that is the main way you can help us. And if you are interested in making a larger donation, a tax-deductible donation to help this work, you can email me at donate at 404media.co. But that's the pitch over. Don't want to go too long about trying to get people to subscribe. But yeah, that is the main way that we're going to be able to do this. You think that sums it up fairly, Jason? I think so. I think so. We'll obviously keep people updated as this goes through the legal process. It was filed on Monday. So we have not won yet. Fingers crossed. No, not yet. And as far as I know, the process is now, there's court formalities and then maybe ICE responds and then we go from there.

24:08I mean, I would like to join the hearings as much as I can. I'm sure many of them will be very boilerplate and procedural. But I'd definitely be interested to see some of the arguments. All right. We'll leave that there. When we come back, we're going to talk about a couple of stories that Jason Emanuel have been doing. We'll be right back after this.

24:44Over half of IT pros say securing SaaS apps is their biggest challenge. With the growing problem of SaaS sprawl and shadow IT, it's not hard to see why. Thankfully, Trellica by 1Password can discover and secure access to all your apps, managed or not. Trellica by 1Password inventories every app in use at your company. Then pre-populated app profiles assess SaaS risks, letting you manage access, optimize spend, and enforce security best practices across every app your employees use. I've been using 1Password for about a year now, and I can't believe I wasn't using it sooner. It's made logging into every website and account I have a breeze and I feel safe when I use it.

25:281Password's award-winning password manager is trusted by millions of users and over 150 ,000 businesses from IBM to Slack. And now they're securing more than just passwords with 1Password extended access management. Plus, 1Password is ISO 27001 certified. With regular third-party audits and the industry's largest bug bounty, 1Password exceeds the standards set by various authorities and is a leader in security. Take the first step to better security for your team by securing credentials and protecting every application, even unmanaged shadow IT. Learn more at 1Password.com slash 404. That's the number one password.com slash 404, all lowercase.

26:131password.com slash 404. Hiring the right people is one of the most crucial aspects of running a successful business. But the hiring process is rarely straightforward. From crafting compelling job posts and attracting qualified candidates, each step requires significant time, attention, and effort. It's a demanding process that can quickly divert focus from other critical areas of your business. Fortunately, the future of hiring looks brighter thanks to ZipRecruiter's latest tools and features, which help you find the right talent faster, saving you valuable time. And now you can try ZipRecruiter for free at ziprecruiter.com slash 404media.

26:52See a candidate you're really interested in? You can unlock their contact info instantly. Over 320 ,000 new resumes are added to ZipRecruiter monthly, which means expediting the hiring process and finding the right person for the job faster than ever. Use ZipRecruiter and save time hiring. Four out of five employers who post on ZipRecruiter get a quality candidate within the first day. And if you go to ZipRecruiter.com slash 404media right now, you can try it for free. Again, that's ZipRecruiter.com slash 404media. ZipRecruiter, the smartest way to hire.

27:40All right, we are back. So these two stories weirdly happened close together within weeks of each other, but I think that's kind of indicative of what's going on at the moment. The first one from Jason, AI work slop is killing productivity and making workers miserable. I mean, I've never heard that term before, Jason, work slop. I don't know if it was made up for this study or for this piece exactly. So what is AI work slop exactly? Yeah, new word just dropped, new word. So, I mean, it's obviously playing off of the idea of AI slop, but it's AI slop at work, basically. But we're talking about very standard white-collar work, things like, I don't know, accounting firms, marketing firms, like people who prepare presentations and reports and do emails and things like that at a big company in the office.

28:42So this was a study done by Stanford University researchers and people at a company called BetterUp, which is a workplace productivity consulting firm. It's a survey of a little over a thousand white collar workers across various industries in the United States. And it was published in Harvard Business Review, which Harvard Business Review is not a traditional academic journal, but it is like a highly influential publication that talks about business goings on. And I saw it this morning and thought it was very interesting because I don't know if in a vacuum I would have written specifically about this study and this study alone because I think any single study that's like a survey of different workers' experiences and things like that is like I don't know, you have to be not necessarily skeptical but you need to think like was this peer reviewed?

29:46What journal was this in? How was the research done? That sort of thing. Very easy to get selection bias in that for sure. Yeah, I think the findings in this make sense to me, but they align very closely with five other pieces of research and reports that have come out over the last couple months. And so basically, they define work slop as AI-generated content that, quote, masquerades as good work but lacks the substance to meaningfully advance a given task. Yeah. And so, I mean, they don't have specific examples of like, this is AI work slot, but it's funny that they asked 1 ,150 workers about this.

30:32And I don't have the exact number in front of me, but it was something like 40 % of workers said that they had encountered this phenomenon. And it's basically like, you ask your colleague or your direct report to do a presentation, to summarize a meeting, to do something like that. And they basically outsource it to AI. And the thing that they turn in looks good, but it's useless. And it turns out that this is like having a really big problem for productivity because AI is supposed to make companies more productive, employees more productive. At least that's the promise. That's why there's billions and billions of dollars going into it.

31:16And it turns out that these workers are, one, spending a lot of time correcting the garbage that their colleagues are turning into them. Then they're having to redo the work. And then very interestingly, they basically said, so here's a direct quote from the report. Workslop uniquely uses machines to offload cognitive work to another human being. When coworkers receive work slop, they are often required to take on the burden of decoding the content, inferring missed or false context. A cascade of effortful and complex decision-making processes may follow, including rework and uncomfortable exchanges with colleagues.