8 ms·
FBI Palantir glitch allowed unauthorized access to private data
- Dopameaner 5y agoThe hacker had some interesting experiences > Griffith is accused of violating international sanctions by traveling to North Korea and delivering a speech about cryptocurrency. > He is charged with helping North Korea circumvent sanctions through the use of crypto.
- leroy_masochist 5y agoIt looks like Palantir is blaming FBI's mismanagement of ACLs as the root cause of what happened here.
- 1MachineElf 5y agoThe relationship must be very strained already if they are publicly blaming each other. Customers always blame their vendors. On the Palantir side, their account/product managers should be asking whether or not their ACL config is sufficiently intuitive. If this mistake was easy for a customer to make, if it's a mistake that couldn't have been avoided without consultancy, then Palantir should treat it like a defect.
- mcguire 5y agoUltimately, that's why the customer is paying the vendor.
- verall 5y agoIt's because the FBI doesn't have any leverage to threaten palantir for passing the blame. "Government agency is incompetent" is a very potent narrative that blocks the usual expectation that cloud products should be difficult to use insecurely. Complaining publicly has no downsides for palantir here.
- yasp 5y agoPalantir can host its products on-prem, and for the FBI very well might have. But where it was hosted wouldn't have any relevance here.
- A4ET8a8uTh0 5y agoTheir leverage is contract. Palantir's position as vendor of choice is kinda limited right now. They don't seem to service regular corps in US. The complaint can have a real ramifications ( loss of future contracts and so on ). That said, at certain point enough is enough I suppose.
- ErikVandeWater 5y ago> "Government agency is incompetent" is a very potent narrative that blocks the usual expectation that cloud products should be difficult to use insecurely. Whether the government purchased a defective product that was insecure or misused a good product, the government should be held to account for the failure, same as with any company.
- theknocker 5y agoThe FBI is incompetent. The FBI is so incompetent that it sufficiently explains the phenomena, and the burden of proof is on the FBI to prove their explanation instead.
- sfvisser 5y agoCould as well be. Properly managing access controls for a complicated data platform might actually be harder than securing the software to begin with. Setting up protocols for who is able to access what and why and who is in charge of changing the config is non-trivial.
- yasp 5y agoFBI throwing its vendor under the bus due their own incompetence.
- jasonhoch 5y agoPalantir responded in a statement to TheStreet.com: "There was no glitch in the software. Our platform has robust access and security controls. The customer also has rigorous protocols established to protect search warrant returns, which, in this case, the end user did not follow." Source: https://www.thestreet.com/investing/palantir-shares-data-access https://www.thestreet.com/investing/palantir-shares-data-acc...
- LeifCarrotson 5y agoIf you can gain unauthorized access by simply choosing not to follow a protocol that says you don't have access, there aren't really any access controls in the software at all.
- TaupeRanger 5y agoNo - the FBI didn't use the access controls correctly, that's the point. If they were used correctly, the unauthorized access wouldn't have happened.
- addingnumbers 5y agoThey didn't use the controls at all. To Palantir, inaction or omission indicate there should be zero controls.
- dewey 5y agoIt sounds more like the customer should set something to private but chose not to. Just like if you set your S3 bucket to public you wouldn't blame Amazon for not keeping your data private.
- eli 5y agoIt's better now, but Amazon absolutely deserves blame for historically making it extremely easy to accidentally make S3 buckets or files within buckets public.
- mellavora 5y agoNo, no, the article is true! the glitch is that we allow companies like Palantir to exist.
- TaupeRanger 5y ago"glitch" /= user error
- Threeve303 5y agoThe government believes it can create a surveillance state and at the same time retain control over the data created by its civil rights violations. Also, if the company wouldn't exist without government funding either directly or indirectly then the third party doctrine should not apply.
- A4ET8a8uTh0 5y agoTbh, this may end up our only saving grace when it comes to setting up a panopticon: incompetence and basic human nature.
- clarkmoody 5y agoNeed a few more major leaks of private information of politicians and regulators. And of course we have the nightmare scenario in Afghanistan with a US database falling into the hands of the Taliban. Hoping that only "the right people" have access is the worst form of assurance against abuse.
- abecedarius 5y agohttps://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.wikipedia.org/wiki/Office_of_Personnel_Management... Hard to overstate this one. So more leaks is not, by itself, enough to make changes happen.
- londons_explore 5y agoThe real "fix" for this issue will be to adjust the logging rentention policies to 24 hours. Then nobody can prove who/what/why data was illegally accessed. And if some judge forces you to turn over those 24 hours worth of logs, you fix the ACL's and respond to the judge tomorrow, when the logs show nothing unwanted.
- mandevil 5y agoA) Judges generally don't take kindly to be played for fools. Do this and you make a judge very very angry, which is not good for whatever you want the judge to do. B) The FBI doesn't keep logs of who accessed what because a judge wants it. They keep logs on who accessed what because they want to know who leaked documents to reporters. Something like the Fincen Files leak: https://en.wikipedia.org/wiki/FinCEN_Files https://en.wikipedia.org/wiki/FinCEN_Files is investigated by figuring out everyone who opened the files in question. The FBI has even more important information than this, in particular the identities of confidential informants and undercover agents. Those cases are actually more complex because they are highly protected- with good reason, if someone unauthorized accesses this data it can get people killed- but desperately need to deconflict: there have been cases where a FBI office in City A was using a undercover agent to try and trap drug smugglers in City B, while a confidential informant in City B was trying to trap gun runners in City A, and no actual criminals were involved.
- queuebert 5y agoIs this why some insiders recently dumped a bunch of PLTR?
- boredumb 5y agogovernment is a blunder machine and software is built with bad defaults?
- slim 5y agoNo one asked why other fbi agents accessed his data ? Maybe those fbi agents were cia snitches ? :) Maybe it's a feature not a glitch
- deleted 5y ago[deleted]
- rurp 5y agoI don't understand, this seems like a config issue rather than a software "glitch". Maybe the software has bad defaults, but that's something the consumer should figure out up front, not years into using it.
- legerdemain 5y agoPeople quoting Palantir's CYA response are missing the fact that Palantir's business model is to embed engineers at customer sites to deploy, configure, and operate their software. There is a good chance that the software was misconfigured because Palantir post-sales engineers misconfigured it.
- DamnYuppie 5y agoHaving worked on too many large implementations and having some exposure to working with large government entities I immediately created a comical and painful scenario in my head that went like this: There were many elaborate meetings with key stakeholders that were to outline the need for security and to put forth a plan to identify and implement the requirements that meets all of their needs. Then due to those meetings another 50 meetings with government employees where held to debate what the settings should be. These meetings of course could not be held with the same group of people at the same location so much effort was put in to coordinating travel and availability of all the resources. As happens when you get that many people pulled into a project that they mostly don't give a sh*t about nothing gets done. Eventually everyone involved became frazzled when no consensus could be reached, so the grumpiest/most connected of those employees bullied everyone else into what was "their way" and so it was then done.
- sjg007 5y agoI think you just described a school board meeting.
- ChrisKnott 5y agoI don't really understand exactly what the FBI breached here...? They uploaded (AFAICT, lawfully obtained) evidence into their FBI-wide system, then it appeared in search results legitimately because there was a crossover with another investigation. The whole point of criminal intelligence systems is to reveal these kinds of unexpected links isn't it? Does the warrant get granted with some kind of limitations on how the material can be used or who can review it? Obviously, they have done something wrong as they have apparently felt the need to send a mea culpa to the court, but I don't really see what it is.
- sjg007 5y ago>Does the warrant get granted with some kind of limitations on how the material can be used or who can review it? Yes.
- 01100011 5y agoI keep seeing folks hype Palantir, usually to promote the stock, and I keep wondering what is so special about what is essentially a software design services firm/body shop. Is there something I'm missing?
- babesh 5y agoBecause most other tech companies (except for a few of the very biggest ones) won't touch that business with a 10 foot pole. It used to be major reputational damage to be seen supporting things that kill people, etc... The non tech companies can't compete. So the complete lack of competition means fat profits for not very good tech and services.
- jonnybgood 5y ago> It used to be major reputational damage to be seen supporting things that kill people, etc... Whenever I see statements like this I have to wonder what people think Palantir’s software does. By your logic Microsoft Windows supports the killing of people since gov agencies use that too.
- babesh 5y agoProject Maven to identify people from military drones using AI was taken over by Palantir when Google dropped out. Those military drones shoot missiles that kill people. https://en.m.wikipedia.org/wiki/Artificial_intelligence_arms_race#United_States https://en.m.wikipedia.org/wiki/Artificial_intelligence_arms... http://artificialintelligencemania.com/2020/01/08/palantir-takes-over-project-maven/ http://artificialintelligencemania.com/2020/01/08/palantir-t... https://en.m.wikipedia.org/wiki/General_Atomics_MQ-1_Predator https://en.m.wikipedia.org/wiki/General_Atomics_MQ-1_Predato... Care to apologize?
- 01100011 5y agoKeep in mind Palantir wouldn't exist without the efforts of Google, OpenAI, etc. Many of us in tech are unknowingly assisting the military industrial complex. I have seen such involvement actively downplayed in favor of more palatable government agencies who are mentioned all the time. The government created the Valley and continues to reap innovation from it. Edit: I'll also add that there are thousands of little Palantirs you've never heard of, taking off the shelf tech, integrating it, and satisfying the needs of the 3 letter agencies. Palantir is big so they get the attention, but they're not that important in the scheme of things.
- thesausageking 5y ago> “When data is loaded onto the Platform, the default setting is to permit access to the data to other FBI personnel otherwise authorized to access the Platform" If this is really how Palantir works, that's pretty bad. Software that's specifically designed and implemented for the FBI should not default to "share with all". And it should have guardrails to nudge users to be careful about permissions whenever they're adding data.