FBI Palantir glitch allowed unauthorized access to private data | Hacker News Reader

FBI Palantir glitch allowed unauthorized access to private data

nypost.com

206 pointsgrej57 comments

Palantir responded in a statement to TheStreet.com: "There was no glitch in the software. Our platform has robust access and security controls. The customer also has rigorous protocols established to protect search warrant returns, which, in this case, the end user did not follow."

Source: https://www.thestreet.com/investing/palantir-shares-data-acc...

If you can gain unauthorized access by simply choosing not to follow a protocol that says you don't have access, there aren't really any access controls in the software at all.

No - the FBI didn't use the access controls correctly, that's the point. If they were used correctly, the unauthorized access wouldn't have happened.

They didn't use the controls at all. To Palantir, inaction or omission indicate there should be zero controls.

It sounds more like the customer should set something to private but chose not to. Just like if you set your S3 bucket to public you wouldn't blame Amazon for not keeping your data private.

It's better now, but Amazon absolutely deserves blame for historically making it extremely easy to accidentally make S3 buckets or files within buckets public.

Cutlery manufacturers absolutely deserve blame for historically making it extremely easy to accidentally cut your fingers with their knives.

If you sell cutlery without a handle and expect your end users to simply wrap it in a towel before using it maybe you should share some of the blame when your users hurt themselves.

I agree that GP’s analogy didn’t fit, but neither does yours to what AWS did before.

I might be in the minority but I never found the old UI to be confusing. Public buckets were never the default and it was pretty clear when you were making the change. It's good they are making it more dummy proof but I'm not sure it is fair to say they deserve blame

As a sidenote I actually find all the new warnings and stuff annoying (but I'm not saying it isn't worth it all things considered). As a developer I'm quite used to having to pay attention to details already - one typo can be disastrous and there might be no warning (you might say but that is what a proper CI process is for and testing but what if that typo is in the CI process or tests?)

This looks more like a mess that would happen if S3 buckets by default were accessible to anyone with an Amazon account. Which would clearly be a colossal mistake made by the platform.

You're right, it's neither Beretta's nor the NRA's fault if someone shoots someone.

Palantir just made the privacy shotgun, and FBI gave the bullets, but it's the user who pulled the trigger.

This sounds a lot like "you're holding it wrong"...

Reference for the younguns:

https://youtu.be/b9eXYOA8TCk?t=117

For context: https://www.youtube.com/watch?v=t5n5KlXv0Vo

What do you mean the vault was robbed? We put an "Authorized Personnel Only" sign out front.

Built-in bypasses to protections of your freedoms and security theatre that allegedly protects them:

FUNCTIONING AS DESIGNED

Yeah, the headline of the article immediately brought to mind an IT system built by a data-hoovering oversight-averse FBI funded to self-develop a system to protect that data and enforce oversight would not... quite... close the loop.

sounds more like a feature than a bug, Palantir can blame the FBI, FBI can blame Palantir. FBI really just wants the ability to access data they want

People quoting Palantir's CYA response are missing the fact that Palantir's business model is to embed engineers at customer sites to deploy, configure, and operate their software. There is a good chance that the software was misconfigured because Palantir post-sales engineers misconfigured it.

Having worked on too many large implementations and having some exposure to working with large government entities I immediately created a comical and painful scenario in my head that went like this: There were many elaborate meetings with key stakeholders that were to outline the need for security and to put forth a plan to identify and implement the requirements that meets all of their needs. Then due to those meetings another 50 meetings with government employees where held to debate what the settings should be. These meetings of course could not be held with the same group of people at the same location so much effort was put in to coordinating travel and availability of all the resources. As happens when you get that many people pulled into a project that they mostly don't give a sh*t about nothing gets done. Eventually everyone involved became frazzled when no consensus could be reached, so the grumpiest/most connected of those employees bullied everyone else into what was "their way" and so it was then done.

I think you just described a school board meeting.

FBI throwing its vendor under the bus due their own incompetence.

SOP for government

The vendor is claiming the FBI didn't use the product correctly.

the person you posted said that the FBI blamed the vendor becaues of the FBI's incompetence. so why did you feel the need to say the same thing worded differently?

They are pointing fingers at each other and we have no idea how valid each claim is.

It looks like Palantir is blaming FBI's mismanagement of ACLs as the root cause of what happened here.

The relationship must be very strained already if they are publicly blaming each other. Customers always blame their vendors. On the Palantir side, their account/product managers should be asking whether or not their ACL config is sufficiently intuitive. If this mistake was easy for a customer to make, if it's a mistake that couldn't have been avoided without consultancy, then Palantir should treat it like a defect.

Ultimately, that's why the customer is paying the vendor.

It's because the FBI doesn't have any leverage to threaten palantir for passing the blame. "Government agency is incompetent" is a very potent narrative that blocks the usual expectation that cloud products should be difficult to use insecurely.

Complaining publicly has no downsides for palantir here.

Palantir can host its products on-prem, and for the FBI very well might have. But where it was hosted wouldn't have any relevance here.

Their leverage is contract. Palantir's position as vendor of choice is kinda limited right now. They don't seem to service regular corps in US.

The complaint can have a real ramifications ( loss of future contracts and so on ). That said, at certain point enough is enough I suppose.

> "Government agency is incompetent" is a very potent narrative that blocks the usual expectation that cloud products should be difficult to use insecurely.

Whether the government purchased a defective product that was insecure or misused a good product, the government should be held to account for the failure, same as with any company.

Could as well be. Properly managing access controls for a complicated data platform might actually be harder than securing the software to begin with. Setting up protocols for who is able to access what and why and who is in charge of changing the config is non-trivial.

The hacker had some interesting experiences

> Griffith is accused of violating international sanctions by traveling to North Korea and delivering a speech about cryptocurrency.

> He is charged with helping North Korea circumvent sanctions through the use of crypto.

I don't really understand exactly what the FBI breached here...?

They uploaded (AFAICT, lawfully obtained) evidence into their FBI-wide system, then it appeared in search results legitimately because there was a crossover with another investigation.

The whole point of criminal intelligence systems is to reveal these kinds of unexpected links isn't it?

Does the warrant get granted with some kind of limitations on how the material can be used or who can review it?

Obviously, they have done something wrong as they have apparently felt the need to send a mea culpa to the court, but I don't really see what it is.

>Does the warrant get granted with some kind of limitations on how the material can be used or who can review it?

Yes.

No, no, the article is true!

the glitch is that we allow companies like Palantir to exist.

> “When data is loaded onto the Platform, the default setting is to permit access to the data to other FBI personnel otherwise authorized to access the Platform"

If this is really how Palantir works, that's pretty bad. Software that's specifically designed and implemented for the FBI should not default to "share with all". And it should have guardrails to nudge users to be careful about permissions whenever they're adding data.

I don't understand, this seems like a config issue rather than a software "glitch". Maybe the software has bad defaults, but that's something the consumer should figure out up front, not years into using it.

I keep seeing folks hype Palantir, usually to promote the stock, and I keep wondering what is so special about what is essentially a software design services firm/body shop. Is there something I'm missing?

Because most other tech companies (except for a few of the very biggest ones) won't touch that business with a 10 foot pole. It used to be major reputational damage to be seen supporting things that kill people, etc...

The non tech companies can't compete. So the complete lack of competition means fat profits for not very good tech and services.

> It used to be major reputational damage to be seen supporting things that kill people, etc...

Whenever I see statements like this I have to wonder what people think Palantir’s software does. By your logic Microsoft Windows supports the killing of people since gov agencies use that too.

Project Maven to identify people from military drones using AI was taken over by Palantir when Google dropped out. Those military drones shoot missiles that kill people.

https://en.m.wikipedia.org/wiki/Artificial_intelligence_arms...

http://artificialintelligencemania.com/2020/01/08/palantir-t...

https://en.m.wikipedia.org/wiki/General_Atomics_MQ-1_Predato...

Care to apologize?

Keep in mind Palantir wouldn't exist without the efforts of Google, OpenAI, etc. Many of us in tech are unknowingly assisting the military industrial complex. I have seen such involvement actively downplayed in favor of more palatable government agencies who are mentioned all the time. The government created the Valley and continues to reap innovation from it.

Edit: I'll also add that there are thousands of little Palantirs you've never heard of, taking off the shelf tech, integrating it, and satisfying the needs of the 3 letter agencies. Palantir is big so they get the attention, but they're not that important in the scheme of things.

My impression is that many of those are situated near DC?

Yes this is true but many things that tech does are generic tools. It is just that certain companies and people choose to weaponize them.

No one asked why other fbi agents accessed his data ? Maybe those fbi agents were cia snitches ? :) Maybe it's a feature not a glitch

"glitch" /= user error

The government believes it can create a surveillance state and at the same time retain control over the data created by its civil rights violations. Also, if the company wouldn't exist without government funding either directly or indirectly then the third party doctrine should not apply.

Tbh, this may end up our only saving grace when it comes to setting up a panopticon: incompetence and basic human nature.

Need a few more major leaks of private information of politicians and regulators.

And of course we have the nightmare scenario in Afghanistan with a US database falling into the hands of the Taliban. Hoping that only "the right people" have access is the worst form of assurance against abuse.

https://en.wikipedia.org/wiki/Office_of_Personnel_Management...

Hard to overstate this one. So more leaks is not, by itself, enough to make changes happen.

government is a blunder machine and software is built with bad defaults?

Is this why some insiders recently dumped a bunch of PLTR?

The real "fix" for this issue will be to adjust the logging rentention policies to 24 hours.

Then nobody can prove who/what/why data was illegally accessed.

And if some judge forces you to turn over those 24 hours worth of logs, you fix the ACL's and respond to the judge tomorrow, when the logs show nothing unwanted.

A) Judges generally don't take kindly to be played for fools. Do this and you make a judge very very angry, which is not good for whatever you want the judge to do.

B) The FBI doesn't keep logs of who accessed what because a judge wants it. They keep logs on who accessed what because they want to know who leaked documents to reporters. Something like the Fincen Files leak: https://en.wikipedia.org/wiki/FinCEN_Files is investigated by figuring out everyone who opened the files in question.

The FBI has even more important information than this, in particular the identities of confidential informants and undercover agents. Those cases are actually more complex because they are highly protected- with good reason, if someone unauthorized accesses this data it can get people killed- but desperately need to deconflict: there have been cases where a FBI office in City A was using a undercover agent to try and trap drug smugglers in City B, while a confidential informant in City B was trying to trap gun runners in City A, and no actual criminals were involved.

Reply on news.ycombinator.com