A new investigation by the University of Toronto’s Citizen Lab reveals that six democratic governments—Australia, Canada, Cyprus, Denmark, Israel, and Singapore—are likely customers of Israeli surveillance startup Paragon Solutions, contradicting the company’s longstanding claims to operate as a “responsible” alternative to controversial spyware vendors like NSO Group. The findings come amid growing scrutiny of Paragon’s practices, including a recent scandal in Italy where WhatsApp warned 90 users of suspected spyware attacks linked to the firm.
Paragon’s Contradictions and Corporate Spin
Paragon has long sought to distance itself from rivals such as NSO Group, whose Pegasus spyware has been implicated in targeting journalists, activists, and politicians worldwide. In 2021, a senior Paragon executive anonymously told Forbes that the company would never sell to authoritarian or non-democratic regimes, framing its clientele as ethical and aligned with Western democratic values.
However, the Citizen Lab report, published Wednesday, identifies the six governments as “suspected Paragon deployments” based on technical analysis of the company’s infrastructure. The lab, renowned for exposing spyware abuses, traced digital fingerprints of Paragon’s tools to servers linked to these nations, raising questions about the firm’s transparency and adherence to its own stated principles.
Scandal in Italy and Paragon’s Defensive Posture
The revelations follow a January 2024 incident in which WhatsApp alerted approximately 90 users—including individuals in Italy—that they had likely been targeted by Paragon’s spyware. The notifications sparked public outrage in Italy, where targets reportedly included civil society figures.
In response, Paragon’s executive chairman, John Fleming, told TechCrunch that the company licenses its technology only to “a select group of global democracies—principally, the United States and its allies.” Fleming’s statement appeared aimed at damage control, reiterating Paragon’s narrative of exclusivity and responsibility. Yet Citizen Lab’s findings suggest a broader, less discerning client base, including governments like Cyprus and Singapore, which watchdog groups have criticized for opaque surveillance practices.
Critics argue that Paragon’s acquisition reflects a troubling trend: private equity firms capitalizing on the unregulated surveillance trade while governments evade accountability. “Democracies are increasingly becoming complicit in the same tools they condemn when used by adversaries,” said a digital rights advocate familiar with Citizen Lab’s work.
