Palantir at DND: who checks the updates?

On November 7, CBC reported that National Defence has had a contract for Palantir’s Gotham software since 2020, one that was flagged internally as “not for public disclosure”, according to documents obtained by the Investigative Journalism Foundation.¹ It started at $14 million and could reach $63 million. The department wouldn’t say exactly what information Gotham handles. It did tell CBC that Gotham runs on closed, classified networks inside secure facilities in Canada, and that its security assessment found that no government data, prompts, outputs or metadata handled under the contracts could be stored, accessed or processed outside Canada. It added that “The United States CLOUD Act does not have any authority over servers located in Canada.”

A lawyer CBC interviewed disagreed about the CLOUD Act, and most of the reaction we’ve seen has gone into that argument, which is about what can get out. We kept thinking about what goes in.

The loading dock

Software under contract since 2020 has presumably been updated along the way. We don’t know Gotham’s release schedule inside DND, and the department has good reasons to keep it to itself, but we’d be surprised if a platform that size went years without patches and new versions. On a closed network a release crosses at a controlled point, through a guard or on removable media, and somebody on the inside decides to let it in. Call it the loading dock.

CBC’s article doesn’t say who operates or updates Gotham for DND, and we’re not going to guess. On closed networks generally, more than patches come across. Licence files do, if the software needs one renewed to keep running, and so do the connectors and configuration a vendor supplies. At some sites the vendor’s support staff do too.

An update can do damage without sending anything out, by changing what the software does with its data or stopping it on a set date. So whoever controls a vendor’s releases, including anyone who’s broken into its build system, can change what runs on the network, wherever the servers sit. That goes for any vendor, Canadian ones and us included.

Jennifer Evans, a policy researcher CBC spoke to, said DND should disclose more about the contract, including whether it uses air-gapping.¹ A yes wouldn’t settle much, since releases still have to get into an air-gapped network.

What DND could say

None of what we’d ask needs the department to reveal what Gotham processes, or where.

When a release arrives, what’s it checked against, and is the check written down? The answer we’d hope for is the vendor’s signature, checked by DND before anything is installed, against a key or signing identity DND pinned beforehand, with provenance saying which build this is. A hash read off the vendor’s portal comes from the same place as the release, so it’s no help if the vendor’s side is where things went wrong. We’d also hope DND can pull a list of every release that’s crossed, with dates and approvals, from its own files.

And what happens if the deliveries stop? That covers the licence, whether it expires and what the software does the day after, and how long the system stays safe to run with no new patches. CBC’s piece gives dependence on a foreign supplier as the second risk, and one measure of that is how many months the system keeps working with the dock shut. The last note went through what tends to break when a system is cut off.

Passing the signature check shows only that a release was signed with the vendor’s key. Whether the vendor built something you’d want is a separate matter, and with closed-source software the buyer only gets to read the source, or rebuild from it, if the contract says so.

The secure hubs

Ottawa is paying for more secure rooms, and these ones are meant to have a lot of visitors. BOREALIS, National Defence’s new research and innovation bureau, is setting up a network of Defence Innovation Secure Hubs. The first was announced a year ago next week at COVE in Dartmouth, with $29.4 million and a description of what the network is for: “secure, purpose-built spaces, where Canadian researchers and scientists and their trusted partners can co-develop, test, and validate emerging technologies requiring classified handling.”² An uncrewed systems hub was announced in Mirabel in July, with $29.6 million over two years going to a consortium of 30 organizations, and a quantum hub in Calgary in August with $20.3 million.³⁴

A hub with thirty member organizations has a busier dock than one department running one platform. Any member that brings its own code brings whatever that code was built on, and for most software that means open-source and commercial components from all over. The Mirabel release says the funding covers “the security upgrades, infrastructure, and collaborative activities required to enable sensitive defence research and innovation”.³ None of the three releases says how software will get into a hub, which is fair enough for a news release. If the rule ends up being a virus scan and a signature on a form, the same questions will come back for every hub.

It’s cheaper to write the intake rule before members start bringing software in than after, and for a hub it could be short. Whatever a member brings arrives signed by whoever built it, with provenance naming the source and the build, and the hub checks that itself before it goes in and keeps its own log. A ten-person company can meet that with free tooling. It’s also the evidence a prime or an allied buyer is going to ask that company for later.

An existing closed network can be tested the same way, from the file on the last release that came in. Either it shows what the release was checked against and where the key came from, or it shows that the vendor delivered something and somebody installed it.

Northfleet is a Canadian-incorporated vendor building the sovereign supply chain that wraps a customer-operated classified cluster: a deploy-time bundle protocol, attestation chain, and tamper-evident audit trail. The customer’s cleared engineering teams operate the cluster under their own keys. Northfleet holds no customer data and no customer signing keys. Every release Northfleet ships carries provenance binding it to the source it was built from, which the customer can check without Northfleet’s participation. The architecture assumes the vendor can be compromised or compelled, so compelling Northfleet doesn’t produce a silent backdoor, though catching one depends on someone actually checking releases against their source.

If you’re writing the intake rules for a hub or an enclave and part of it runs on Kubernetes, get in touch.