Hacker News Reader

Comment by chillingeffect | Hacker News Reader

What kind of search filtering options are available for fishing expeditions?

You can search on or around nearly anything. That's one of their selling points to customers. The search function is multi-faceted, in that 1) it can index the data of any files you upload to Palantir (making everything text searchable), 2) Analysts can indicate specific attributes of an entity just by highlighting text in a file and marking it as a DOB or SSN or whatever. 3) The # of attributes is nearly limitless.

One of the primary screens in Palantir is a simple search page designed to work (and look) like Google, to search upon your entire database however you'd like. You can enhance the search function via the various attributes built into your installation or using advanced search tools. So I guess a "fishing expedition" in the traditional sense is very easy, as it's limited by the data you have, not the system itself.

Are there options to restrict search space (i.e. limit data sources that could potentially contaminate an investigation)?

And if so, is that a common practice, or is it more typical to search through all avaliable data for anything potentially useful and weed out later?

I don't specifically remember an option to weed out searching, but I'm reasonably certain there were advanced options that included "does not equal" or "does not contain" type boolean searching. From my experience though, it wasn't common practice to weed out from the start, but rather to start with a general search and slowly narrow it down to the targeted data. A lot of data sources weren't automatically imported, they were more like extended queries. So if I wanted employment records, for example, I had to initiate that as a custom search to query that external system, and pull back the data for the specific individual I was investigating, it was not available in the database by default. But once it was imported and tagged, it was available in any future searches for the remainder of the data retention period.

Reply on news.ycombinator.com