Canada's military is using Palantir software. What are the risks?

Canada has multimillion-dollar contracts with Palantir, a controversial U.S. software company. Experts warn the deals could expose Canadian military data to U.S. authorities and leave Canada reliant on critical technology supplied by a foreign company.

Documents obtained by the Investigative Journalism Foundation revealed that the Department of National Defence (DND) has had a contract for Palantir's Gotham software since 2020 that was internally flagged as "not for public disclosure." Initially valued at $14 million, it could be worth up to $63 million.

DND told CBC News that Gotham brings together information from military databases and operates on closed, classified networks inside secure facilities in Canada. The department declined to say exactly what information Gotham processes, citing national-security concerns.

DND says its security assessment determined that no government data, prompts, outputs or metadata handled under the contracts could be stored, accessed or processed outside Canada.

But experts argue U.S. law could still provide American authorities with a means to acquire information within an American company's possession, custody or control. Others warn Canada could become dependent on military technology that would be difficult to replace.

Palantir Technologies was co-founded in 2003 by five people, including CEO Alex Karp and board chair Peter Thiel. It has since become a major technology contractor for governments and militaries.

Its software integrates information from multiple datasets so users can identify connections and patterns across large amounts of information.

Michael Steinberger, a journalist and author of The Philosopher in the Valley: Alex Karp, Palantir, and the Rise of the Surveillance State, said the company has drawn criticism over its involvement in military operations and immigration enforcement in the United States.

Some of its most important work, he said, involves Project Maven, the U.S. military's artificial-intelligence program used to analyze military data and support targeting operations.

"This is being used extensively now in U.S. military actions," Steinberger said.

When asked about Project Maven, a Palantir spokesperson told CBC News: "We do not conduct surveillance. The Maven platform provides the U.S. warfighter a live, synchronized view of the battlespace to help them make better-informed decisions and reduce errors … all of this is conducted with strong safeguards and accountability logs."

Palantir's work with U.S. Immigration and Customs Enforcement has also drawn criticism.

"Its technology seems to be a critical node in the immigration crackdown that's happening here in the United States right now," Steinberger said.

The company has also increasingly identified itself with U.S. national interests.

U.S. President Donald Trump praised Palantir earlier this year for having "great war-fighting capabilities and equipment."

In June, Palantir posted on X a list of 22 principles drawn from The Technological Republic, a book co-written by Karp. They include the assertion that Silicon Valley has an "obligation to participate in the defense of the nation" and describe some cultures as "dysfunctional and regressive."

Karp has also appeared in company advertising saying "the West is superior, and we have to fight for these values."

Vass Bednar, managing director of the Canadian Shield Institute, an independent public policy think tank, said the concern extends beyond Palantir's politics to Canada's reliance on an outside supplier for critical digital infrastructure.

"We're potentially growing a digital dependency, enriching what is fundamentally a U.S. company at the expense of our sovereignty," she said.

Other countries becoming less reliant

The debate over Palantir comes amid a broader push in Europe for "digital sovereignty" — greater domestic control over technology and data.

In July, France and Germany pledged to reduce reliance on foreign providers by examining domestic alternatives after ending Palantir's contracts with their intelligence services.

In the U.K., MPs have called on the government to end Palantir's 330-million-pound ($619 million Cdn) National Health Service contract, citing "serious mistrust" of the company after a Financial Times report that a small number of company employees had access to identifiable patient data in the Palantir-built platform. The National Data Guardian, an independent adviser on the use of health and social-care data in England, said the incident breached data-governance principles.

A Palantir spokesperson at the time told the Financial Times that "Palantir software can only be used to process data precisely in line with the instruction of the customer. Using the data for anything else would not only be illegal but technically impossible due to granular access controls overseen by the NHS."

One potential concern is whether U.S. authorities could compel access to Canadian information.

Barry Appleton, an international lawyer who practises both Canadian and American law, pointed to the U.S. CLOUD Act, which allows authorities, with appropriate legal process, to compel covered U.S. companies to produce data within their possession, custody or control, regardless of whether it is stored inside or outside the United States.

"I'm talking to you today while we're having massive trade wars," Appleton said. "Do I want Canada's trade strategy to be able to be surveilled and read by the United States today? No, I don't."

DND says its Palantir systems have been assessed for this kind of exposure. It says government data, prompts, outputs or metadata could not be stored, accessed or processed outside Canada and that Gotham information is protected on closed, classified networks in secure Canadian facilities.

"The United States CLOUD Act does not have any authority over servers located in Canada," DND said.

"The CLOUD Act is not about where the server is located," he said.

"Any data at any time that Palantir has, if it was subject to an order under the CLOUD Act would have to be produced," Appleton said because "it's decided by American courts under American law, not under Canadian law."

Jennifer Evans, a policy researcher and founder of PatternPulse AI, said DND's statement that data is stored on closed, classified networks in Canada doesn't make clear what level of security is being used.

She agreed with Appleton that the CLOUD Act "means that there is potential data visibility to some of the highest levels in the U.S. government."

Evans said DND should disclose more about its contract with Palantir, including whether it uses air-gapping, which isolates computers or networks from unsecured networks and the internet.

A Palantir spokesperson told CBC News in an email that it is "a software company" and rejected suggestions that the company takes ownership of or uses its customers' information.

"Our customers own and control their own data. Palantir never uses or retains customer data for its own purposes or shares data with other customers," the spokesperson told CBC News.

A second potential risk is Canada's dependence on a foreign supplier for military technology.

Bednar points to Space X's Starlink internet technology, owned by Elon Musk. Beginning Oct. 14, Ukrainian officials accused SpaceX of throttling Starlink's speeds, disrupting military activity. The accusations came after Trump announced a deal with Russian President Vladimir Putin to supply the world with millions of tonnes of Russian diesel.

While it's unclear who was responsible for the slowdown, Bednar says the episode shows how reliance on a company with ties to the U.S. government can leave militaries vulnerable.

"These are not neutral technologies. So let's stop treating them as if they're neutral," Bednar said.

Evans said few companies compete with the breadth of Palantir's software but pointed to Canadian alternatives, including Vancouver-based Caseway and Ottawa-based Anvil.

"They don't come anywhere close to the breadth and depth that Palantir offers," she said. She added that it will take time for them to develop comparable technology.

Bednar said Canada should nevertheless invest in developing that technology domestically.

"Building and owning this kind of necessary digital infrastructure for defence should be a primary goal for Canada," she said.