--- title: "Two million for a “proprietary solution”, and nothing else" description: "A $2m ICE purchase order says only “proprietary solution”. The registry doesn’t say what it does — the same gap sits in half of supplier registers." url: https://csidia.com/en/notes/descrizione-che-non-nomina-registro-fornitori/ lang: en date: 2026-08-10 label: "Observatory" publisher: CSIDIA S.r.l. (https://csidia.com/) italiano: https://csidia.com/note-operative/descrizione-che-non-nomina-registro-fornitori/ --- # Two million for a “proprietary solution”, and nothing else If someone asked you today for the list of suppliers who can access your employees’ or your citizens’ data, how long would it take? And which field would you search — the one for the spend category, or the one that actually says what the product does and what it reaches? If the second question leaves you without an answer, you are not an isolated case: it is the ordinary condition of a supplier register written for accounting, not for security. A public award signed in the United States, closed out sixteen months later, shows where that condition leads once someone actually asks the question. ## A two-million-dollar purchase order, a description that says nothing The US federal award registry (USAspending, FPDS data) lists PIID **70CTD024P00000012**: type **B**, purchase order — not a framework contract. Agency: **Department of Homeland Security**, sub-agency **U.S. Immigration and Customs Enforcement** (ICE). Signed on **27 September 2024**, period of performance 30 September 2024 – 29 September 2025: the potential end date matches the contractual one, no extension. **$2,000,000** obligated, base plus all options included: nothing left to exercise. Recipient: **Paragon Solutions (US) Inc.**, UEI NW6QFTZACWM7. The field reserved for the parent company, in the same record, returns the name of the company itself: it adds no information you didn’t already have. The award’s official description, verbatim, in the capitals used in the registry: “THIS AWARD IS FOR A FULLY CONFIGURED PROPRIETARY SOLUTION INCLUDING LICENSE, HARDWARE, WARRANTY, MAINTENANCE AND TRAINING”. No product name. No function. The commodity classification doesn’t fill the gap: **NAICS 541512**, “COMPUTER SYSTEMS DESIGN SERVICES”, and **PSC 7B22**, “IT AND TELECOM - COMPUTE: SERVERS (HARDWARE AND PERPETUAL LICENSE SOFTWARE)” — the same codes used to label the purchase of any ordinary server cluster. The competition, if it can be called that (solicitation 70CTD024R00000009): extent competed **C** (not competed), other than full and open **ONE** (only one source admitted), procedure **SSS** (sole source), **a single offer received**, product classed as commercial (**A**). A single supplier, invited and awarded: no competition. ## A three-line chronology, and no explanation The registry doesn’t stop at the award card. The transaction history of the same award — a level almost nobody checks — shows three modifications after signing. On 8 October 2024, modification **P00001** carries this verbatim description: “...IS BEING MODIFIED TO ISSUE A STOP WORK ORDER”. On **30 August 2025**, **P00002** revokes it: “...THIS MODIFICATION IS TO LIFT THE STOP WORK ORDER”, a month before the end of the base period of performance. On **20 January 2026**, nearly four months after that deadline, **P00003** closes out the contract: “THIS MODIFICATION CLOSES OUT THIS CONTRACT...”. Three actions, three dates, zero explanations: no field says why work stopped, or why it resumed. The registry records that something happened. It does not record what, or why. ## Who the supplier is Paragon Solutions has long been on our watch of surveillance and defence companies. The most solid reference is Citizen Lab report No. 183, University of Toronto, “Virtue or Vice? A First Look at Paragon’s Proliferating Spyware Operations”, 19 March 2025, authored by Bill Marczak, John Scott-Railton, Kate Robertson and others. The report describes **Graphite**, Paragon’s flagship product, as spyware said to provide “access to the instant messaging applications on a device” — not full control of the phone — loading itself into legitimate apps and processes already on the device rather than installing as its own app, which makes forensic detection harder. The Citizen Lab identified suspected infrastructure tied to Graphite in **Australia, Canada, Cyprus, Denmark, Israel and Singapore**; Italy appears in the report as a publicly admitted customer. On 31 January 2025, **WhatsApp** notified **over 90 individuals** it believed had been targeted by a Paragon zero-click exploit it had found and mitigated; among the Italian recipients named in the report: **Francesco Cancellato**, editor-in-chief of Fanpage.it, and activists **Luca Casarini** and **Giuseppe Caccia**, of Mediterranea Saving Humans. Paragon presents itself as different from other vendors in the sector: according to a 2021 Forbes interview cited in the report, a Paragon executive had claimed the company sells only to governments that “abide by international norms and respect fundamental rights and freedoms”. Approached by the Citizen Lab, the company — through executive chairman John Fleming — replied that “the brief summary of the report you sent includes several inaccuracies, but without additional details we cannot be more specific or provide comment for the record”: an objection without specifying which claim was inaccurate; asked for details, the same reply. We report Paragon’s position in full: a right of reply, not an admission or a confirmation. ## The point is not what ICE bought From here the registry says no more, and this piece won’t say it on the registry’s behalf. We do not know whether it concerns Graphite, another Paragon product, or a supply entirely unconnected to what the Citizen Lab documented: the description names no product, the codes name no capability, the modifications name no reason. The point is not what ICE bought. It is that the registry, on its own, cannot tell you — and neither can the second layer, the one almost nobody checks. [See the service](https://csidia.com/en/solutions/document-compliance) · [Talk to an engineer](https://csidia.com/en/contact) ## The same formula, in your own register The story is not only about a US agency: “proprietary solution, licence, warranty, maintenance and training” is the formula behind one row in two of a large company’s or a public administration’s supplier register. As long as nobody asks, it’s enough: it pays the invoices, it clears an accounting audit, it doesn’t block a renewal. The day a rule changes — or a supplier ends up in an investigation, as with [the EU sanctions designations that name directors, not the companies they run](https://csidia.com/en/notes/designazioni-7-agosto-direttori-non-societa) — or a board asks what is exposed, the question becomes: which suppliers access which data, under what contract, with what access? If there is no answer, it isn’t because someone hid it: it is because it was never written into a field a machine can query. The same gap, on the other side of the relationship, shows up in [the AI defence contract clauses that stay secret even from a US senator](https://csidia.com/en/notes/contratti-ai-difesa-usa-clausole-non-leggibili): a statement of work with no substance produces the same hole as a purchase order with none. The lesson is the one already seen when [a press headline and a Pentagon order’s official description told two different stories](https://csidia.com/en/notes/war-data-platform-cdao-integrazione): the commodity category is not a description. NAICS and PSC codes say which shelf the spend sits on, not what the product does, who uses it, what data it reaches. ## Sources - [USAspending — award record CONT_AWD_70CTD024P00000012_7012_-NONE-_-NONE-](https://www.usaspending.gov/award/CONT_AWD_70CTD024P00000012_7012_-NONE-_-NONE-/) - [USAspending API — award endpoint (FPDS data) queried for the record](https://api.usaspending.gov/api/v2/awards/CONT_AWD_70CTD024P00000012_7012_-NONE-_-NONE-/) - [USAspending API — transactions endpoint, queried for the modification history](https://api.usaspending.gov/api/v2/transactions/) - [Citizen Lab — Virtue or Vice? A First Look at Paragon’s Proliferating Spyware Operations (19 March 2025)](https://citizenlab.ca/research/a-first-look-at-paragons-proliferating-spyware-operations/) Note by CSIDIA S.r.l. (Vignola, MO, Italy): https://csidia.com/en/notes/descrizione-che-non-nomina-registro-fornitori/ · Who we are and what we do: https://csidia.com/en/at-a-glance/ · engagement@csidia.com