Palantir flaw allowed unauthorised access to private FBI data

A Palantir software programme flaw has meant that the private data of an alleged treaty violator has been accessible to unauthorised FBI agents for months.

 

Data belonging to US citizen Virgil Griffith, former Ethereum developer, was reportedly exploited by at least four Bureau employees, all of whom work outside of New York and were not assigned to the case, between May 2020 and August 2021. The data included information from Griffith's Facebook and Twitter accounts, which was obtained via a federal search warrant in March 2020.

 

The FBI agent assigned to Griffith's case became aware of the unauthorised access earlier this month when another agent alerted him via email, stating that an analyst had accessed the search warrant material on Palantir.

 

Griffith was arrested in Los Angeles International Airport in late 2019 and charged with violating the International Emergency Economic Powers Act after travelling to Korea to give a presentation and technical advice on using crypto-currency and blockchain technology to evade sanctions. He pleaded not guilty in January 2020 and has been held in jail pending his trial in September 2021.

 

Palantir employees were instructed to delete the data on 17th August by Manhattan prosecutors, who said they do not intend to use the information in their case against Griffith.

 

Prosecutors described the glitch in a letter, stating that it was as a result of the program's default setting:

 

“When data is loaded onto the Platform, the default setting is to permit access to the data to other FBI personnel otherwise authorized to access the Platform.”

 

“There was no glitch in the software. Our platform has robust access and security controls. The customer also has rigorous protocols established to protect search warrant returns, which, in this case, the end user did not follow,” a spokesperson for Palantir said in a statement.

 

Founder of privacy and civil rights group The Surveillance Technology Oversight Project, Albert Fox Cahn, suggested that there could be a wider issue with the FBI's use of Palantir.

 

“Since this same issue will happen whenever documents are uploaded with the default settings, and since there doesn’t seem to be any sort of automated notice when they have been improperly accessed, this suggests that it’s happening a lot more than just this one case,” he said.