Chloe George

Tag: Surveillance

  • Land and Expand: How Palantir Swam Into the FCA’s Data Lake

    Land and Expand: How Palantir Swam Into the FCA’s Data Lake

    Four days. I published The Seeing Stones, a 5,000-word investigation into how a CIA-funded surveillance company ended up running the NHS, and four days later the Guardian broke a story that made me need to write another one.

    On 22 March 2026, we learned that Palantir has been awarded a contract by the Financial Conduct Authority to analyse the regulator’s internal intelligence data.[1] Case files. Fraud reports. Phone call recordings. Emails. Social media posts. Consumer complaints. The entire investigative toolkit of the body responsible for overseeing 42,000 financial firms, from high street banks to crypto exchanges. Handed to Peter Thiel’s company for a three-month trial at more than £30,000 a week.[2]

    When I added an update to the NHS piece, I thought a paragraph would do it. It didn’t. Because the FCA deal isn’t just another contract. It’s the piece that makes the whole picture visible. Palantir now sits inside the NHS (your health data), the Ministry of Defence (national security), police forces across England (criminal intelligence), and the Financial Conduct Authority (your financial life). That’s not a collection of separate deals. That’s an operating system. And the man running Palantir’s UK operation already told us that’s exactly what he wants.

    What’s actually in the data lake?

    The FCA describes its repository as a “data lake.” It’s a technical term for a large store of raw data, but it’s also accidentally the most honest piece of branding anyone involved in this story has produced. A data lake is murky. Things sink into it and become hard to retrieve. The boundaries are unclear. And once something swims in, it tends to stay.

    Cartoon of a murky lake with a wooden sign reading FCA Data Lake. Filing cabinets, phones, and email envelopes float in the water. A glowing orb sinks in the centre. A figure in a business suit stands calmly on the shore holding a fishing rod. Caption reads Just a trial.

    According to multiple news outlets reporting on the Guardian’s investigation, the data Palantir will access includes: case intelligence files marked as highly sensitive; information on what the FCA calls “problem firms”; reports from banks and lenders about proven and suspected frauds; consumer complaints to the financial ombudsman; recordings of phone calls; swathes of emails; and social media monitoring data.[8][4][5] This isn’t a spreadsheet. It’s the entire investigative brain of the UK’s financial regulator.

    Palantir will apply its Foundry platform, the same software it uses for the NHS and the MoD, to sift through all of this and look for patterns of financial crime: fraud, money laundering, insider trading.[5] The idea, on paper, is straightforward: AI is better at spotting patterns across massive datasets than humans are. The FCA oversees 42,000 firms. It needs better tools. Nobody serious disputes that.

    But here’s the thing. The FCA chose to test this system using real data, not synthetic datasets. That decision raised eyebrows even among people sympathetic to the project, because testing AI systems on dummy data is standard practice precisely to avoid handing your most sensitive information to a contractor before you know whether the arrangement works.[5] The FCA went straight to the real thing. As Christopher Houssemayne du Boulay, a barrister at Hickman and Rose, told the Guardian: the FCA can compel firms to hand over vast quantities of data during investigations. “We could be talking about hundreds of whole email accounts and full financial records. Many innocent people will be caught up in that and the data may contain bank account details, email addresses, telephone numbers and other personal information.”[6]

    The procurement that wasn’t quite

    The FCA says it ran “an open, competitive procurement process.”[7] That phrase is doing a lot of heavy lifting, because according to Yahoo News UK, reporting on the Guardian’s investigation, there was only one other competitor for the contract.[8] One. Unnamed. In a market with dozens of data analytics firms.

    If you’ve read the NHS piece, this will feel familiar. The pattern goes: small entry, prove value, become impossible to remove. Palantir’s NHS involvement started with a £1 contract during Covid, expanded to £60 million without competitive tender, then became a £330 million seven-year deal.[9] The MoD relationship started with a £75 million enterprise agreement in 2022, then grew to a £240 million contract in December 2025, awarded directly by the Defence Secretary with no competitive process.[10] As MPs noted in a February 2026 Hansard debate, the pattern is consistent: “Its £1 Covid contract with the NHS expanded to a £330 million contract under the last Government, and its Ministry of Defence contract tripled in size to £240 million, without due process or competition.”[11]

    The FCA deal is positioned as a three-month trial. Just a trial. Like the £1 NHS contract was just a gesture of pandemic goodwill. Like the MoD enterprise agreement was just a modest partnership. I don’t know about you, but when a company with a documented track record of turning three-month trials into decade-long dependencies tells me this one is just a trial, I find myself checking whether any watermelon cocktails were involved in the decision.

    The common operating system (they told us this was the plan)

    Simple outline map of the UK pinned to a wall with seven glowing dots connected by lines, labelled NHS, MoD, Police, FCA, Children's Services, Nuclear Subs, and Cabinet Office. A hand reaches in from the corner holding a felt-tip pen, about to add another dot. Caption reads Common operating system.

    In his evidence to the UK Covid-19 Inquiry, Palantir’s UK chief Louis Mosley urged the government to invest in a “common operating system” that would bring together data from “across local and central government, healthcare and other bodies of national strategic importance.”[12][13] He wasn’t being subtle. He was pitching.

    Let’s map what that operating system looks like today. The NHS Federated Data Platform: health records, waiting lists, patient data across tens of millions of people.[9] The Ministry of Defence: strategic, tactical and live operational decision-making, including services to the navy’s nuclear-powered submarines.[14] Police forces in the East of England, Leicestershire and Bedfordshire: criminal intelligence, including, according to Liberty Investigates, data on political opinions, health records, sexual orientation and trade union membership.[15] Coventry City Council: children’s services and social care data.[6] The Cabinet Office. DEFRA. The Homes for Ukraine scheme. And now the FCA: financial crime intelligence, fraud detection methods, and the personal financial data of anyone caught up in an investigation.

    The Nerve’s investigation in February 2026 found that Palantir’s deals with the UK state total at least £670 million across 34 contracts with ten government departments, police authorities and local councils.[14] And that was before the FCA deal was announced.

    Mosley told a parliamentary select committee that each sector operates independently. That what happens in the US doesn’t affect the UK business. That Palantir has worked for administrations “of every colour.”[16] When asked whether the company was buying its way into being an NHS provider, he said he “strongly rejected” the critique.[16] But the map speaks for itself. Health. Defence. Policing. Financial regulation. Children’s services. Nuclear submarines. If this isn’t a common operating system, it’s doing an extremely convincing impression of one.

    Professor Levi’s question (and the one the FCA asked internally)

    Professor Michael Levi is a specialist in financial crime at Cardiff University. He told the Guardian that there has been “serious under-exploitation” of regulatory data, and that AI could genuinely improve how we detect financial crime.[6] He’s not an anti-tech campaigner. He’s a pragmatist. Which makes his question all the more pointed: “What are the protocols agreed between the FCA and Palantir about the onward use of things that they have learned in that process?”[6]

    That’s the question. Not “is AI useful?” (it is) but “what happens to the knowledge?” When Palantir’s engineers learn how the FCA detects money laundering, that knowledge doesn’t vanish when the contract ends. You can delete the data. You can’t delete what people understood.

    An FCA source put it more bluntly. Speaking to the Guardian, as reported by Yahoo News UK, they asked: “Once Palantir understands how we detect money-laundering threats, how do we know that they are ethically reliable enough not to share that information?”[8]

    That’s an FCA employee. Not a campaigner. Not an opposition MP. Someone inside the organisation, asking whether the company they’ve just hired can be trusted with the methods they use to catch financial criminals. It’s the kind of question that, if it doesn’t keep you awake at night, should at least make you put the kettle on and have a think.

    Now add the context. Palantir was co-founded by Peter Thiel, a prominent donor to Donald Trump.[8] Its technology has been used by the Israeli military and by US Immigration and Customs Enforcement.[17] According to Byline Times, reporting on the Epstein files, Thiel’s venture capital firm Valar Ventures had Jeffrey Epstein as a limited partner; a claim Thiel’s spokesperson disputed in terms of characterisation but confirmed in substance.[18] Palantir’s lobbying firm in the UK was Global Counsel, co-founded by Peter Mandelson, who while serving as UK ambassador arranged a visit by the Prime Minister to Palantir’s Washington headquarters. No minutes of that meeting have been published.[19][20] At the time, Mandelson held a shareholding of around 28% in Global Counsel, which listed Palantir as a client.[21][22] Mandelson was subsequently fired as ambassador by Starmer in September 2025 following revelations about his relationship with Epstein.[23] In February 2026 he was arrested on suspicion of misconduct in public office, and as of March 2026 remains released under investigation.[24][25] He has denied wrongdoing. Global Counsel has since collapsed into administration.[26] Palantir still has all its UK government contracts.

    This is the company that now has access to the FCA’s financial crime detection methods. The contract says the data stays in the UK, that Palantir is merely a “data processor”, that encryption keys are retained by the FCA, that everything gets deleted afterwards.[7] Those are important safeguards. They are also exactly the same type of assurances given for every other Palantir contract.[2] And every other Palantir contract is still running.

    The revolving door (it spins faster than you think)

    Cartoon of a revolving door between buildings labelled Government and Palantir. Five figures walk through in single file, each carrying a different item: a military briefcase, a stethoscope, a police badge, a rolled-up protest placard reading People's Vote, and a civil service lanyard. A sign on the door reads Business appointment rules apply. Please spin gently.

    If you want to understand how Palantir wins contracts, don’t look at the procurement notices. Look at the people.

    OpenDemocracy reported that Palantir hired four former Ministry of Defence officials in 2025, before winning its record £240 million defence contract in December of that year.[10] One of them, Barnaby Kistruck, left his role as the MoD’s director of industrial strategy, prosperity and exports, and joined Palantir as senior counsellor just nine days later. OpenDemocracy reported that Kistruck played a key role in writing the UK’s Strategic Defence Review, which recommended an increased role for AI in defence.[10] The other three hires were two senior civil servants, Laurence Lee and Damian Parmenter, and former Conservative armed forces minister Leo Docherty.[10] OpenDemocracy noted there was no suggestion of wrongdoing on Kistruck’s part, and the MoD placed restrictions on his new role.[10]

    Byline Times documented how Matthew Swindells, former deputy chief executive of NHS England, joined Global Counsel in September 2019, just two months after leaving his NHS role. He then became chair of Palantir’s health advisory board while simultaneously serving as joint chair of NHS hospital trusts, including Chelsea and Westminster, which was the first trust to pilot Palantir technology. The trust said Swindells was excluded from Palantir-related decisions.[18]

    And then there’s Tom Watson. According to Democracy for Sale, the former Labour deputy leader (now Baron Watson of Wyre Forest) was recruited by Palantir; health campaign group Medact has listed him among former government officials “employed or consulted by” the company.[9][36] I’ll be honest, this one stung. I saw Watson in a London pub during one of the big anti-Brexit marches. He was one of the loudest voices for the People’s Vote. He did genuinely important work on the phone-hacking scandal. He felt like someone on the right side. And maybe he still is, in all sorts of ways. People are complicated. But the person you cheered at the march is now advising the surveillance company, and that’s not a contradiction Palantir minds at all. It’s the whole strategy. You don’t build a revolving door that only swings one way. Watson (Labour), Docherty (Conservative), Kistruck (senior civil servant). The point is that every door leads to Palantir.

    I’m not suggesting anything illegal about any of these appointments. Business appointment rules exist. Cooling-off periods are applied. But the cumulative effect is that Palantir builds its client relationships by hiring people who understand those clients from the inside. Four MoD hires in a single year, before the biggest MoD contract in the company’s history, is a pattern that raises legitimate questions about how competitive these procurements really are.

    I haven’t found evidence of a similar revolving door at the FCA. That doesn’t mean there isn’t one. It means we should be asking the question now, before the three-month trial becomes a three-year contract becomes a permanent dependency.

    The AI underneath keeps changing (and that should worry you)

    Here’s something that hasn’t had enough attention. Palantir’s Foundry platform uses large language models, AI systems built by other companies, to power its analysis. Until very recently, the most important of those models in Palantir’s US defence work was Claude, made by Anthropic.[27]

    On 27 February 2026, the Trump administration blacklisted Anthropic. The Pentagon designated it a “supply chain risk,” a label normally reserved for foreign adversaries like Huawei.[28] The reason? Anthropic’s CEO Dario Amodei refused to remove safeguards that prevented Claude from being used for mass domestic surveillance or fully autonomous weapons. Trump called Anthropic staff “leftwing nut jobs” and directed federal agencies to stop using their technology.[28]

    Palantir CEO Alex Karp confirmed that Claude is still running inside Palantir’s tools, even as the company plans to swap to other models. “Our products are integrated with Anthropic, and in the future, it will probably be integrated with other large language models,” he told CNBC.[29] According to Reuters, Palantir’s Maven Smart Systems, used for US military intelligence and targeting, were built using Claude’s coding tools. Rebuilding those workflows will take time and money.[30] The same Foundry platform is being deployed at the FCA.

    So here’s the question nobody has answered: which AI model is powering Palantir’s analysis of the FCA’s data? If it’s Claude, what happens when the model swap takes place? If it’s something else, which something else? And what does it mean for the reliability and consistency of financial crime detection when the intelligence layer underneath your entire system is being ripped out and replaced because of a political dispute between a US president and an AI company over whether machines should be allowed to kill people without human approval?

    I appreciate that’s a long sentence. It’s a long situation.

    The sovereignty contradiction

    The timing of the FCA contract is, to put it diplomatically, interesting. On 20 March 2026, just two days before the Guardian broke the FCA story, Lord Vallance told a parliamentary committee that the government was pursuing “a very different way of doing contracts: putting British companies there and procuring innovation here.”[31] Liberal Democrat MP Martin Wrigley responded that existing contract break points “must be exploited to move to UK solutions, sovereign solutions, otherwise we just continue doing the same stuff.”[31]

    The government has launched a Sovereign AI Unit with £500 million. The Prime Minister says the UK should be “an AI maker, not an AI taker.”[32] A House of Commons Library briefing published in March 2026 documented growing concern about over-reliance on US tech firms.[32] An Early Day Motion in Parliament warned that “government services, democratic functions and critical infrastructure increasingly depend on a small number of external digital suppliers.”[33] A Westminster Hall debate on technology sovereignty was scheduled for the same month.[32]

    And in the middle of all this, the FCA handed another sensitive system to Palantir.

    I keep thinking about Wales. When the rest of the UK went with Palantir for NHS data, Wales said no. It’s building its own system, the National Data Resource, with data staying under public control.[34] That model exists. It’s not theoretical. It’s being built right now, by people who decided that sovereignty isn’t just a word you put in a policy document.

    What you can actually do

    I know how this reads. Overwhelming. Tentacular. Depressing. But there are things that are genuinely happening, and things you can do. The FCA contract is three months. It hasn’t become permanent yet. If enough people raise concerns now, during the trial, it might not.

    Five things you can do right now

    1. Write to your MP about the FCA contract. That sounds like a thing people say when they’ve run out of useful suggestions, but in this case, parliamentary pressure is genuinely building and cross-party. The Hansard debates in February 2026 show MPs from Labour, the Conservatives, the Liberal Democrats and the Greens all asking the same questions.[11] Your voice adds to that.

    Find and write to your MP via WriteToThem

    2. Support the organisations doing the legal heavy lifting. Foxglove forced the publication of the NHS contract and is campaigning for full transparency on all Palantir deals. The Good Law Project has been pursuing FOI requests and legal challenges for years.

    Support Foxglove’s campaign
    Support the Good Law Project

    3. Back the push for digital sovereignty. The Open Rights Group is campaigning for a UK digital sovereignty strategy that would reduce dependency on a small number of foreign tech vendors across critical public services.[35]

    Open Rights Group

    4. If you work in the NHS, sign the Medact petition. Health workers are campaigning to cancel the NHS Federated Data Platform contract with Palantir when it comes up for review. The break clause exists. It just needs enough pressure to be used.[6]

    Medact: No Palantir in the NHS

    5. Share this article. Not because I want the clicks (although, you know, hello). But because this story only works if enough people can see the pattern. One contract is a procurement decision. Thirty-four contracts across health, defence, policing, financial regulation and children’s services is a strategy. The more people who can see it, the harder it is to keep doing it quietly.

    You can also just pay attention. Because the next contract is always just a trial. The next expansion is always just an extension. The next dataset is always just a pilot. And by the time anyone notices the pattern, the common operating system is already built.

    The seeing-stones keep multiplying

    Cartoon showing a timeline of growing trees. On the left, a tiny seed labelled NHS £1 contract 2020 grows into a medium tree labelled NHS £60m, then an enormous tree with deep roots labelled NHS £330m. In the middle, a seedling labelled MoD £75m grows into a large tree labelled MoD £240m. On the far right, a brand new tiny seed has just been planted, labelled FCA £30k/week, with a watering can beside it and a sign reading Just a trial.

    In my first piece, I wrote that “the seeing-stone serves whoever holds it.” Tolkien’s palantíri were neutral technology. They could be used for good or ill. The danger wasn’t in the stones themselves but in who held them, and what they wanted to see.

    Palantir now holds seeing-stones pointed at your health, your security, your neighbourhood, and your finances. The company says it’s just a data processor. Just providing tools. Just helping catch criminals. And maybe that’s true today. But the question was never about today. It was always about what happens when the contract is permanent, the dependency is total, the revolving door has spun one more time, and someone in Washington, or in a boardroom, or at a dinner with exotic cocktails, decides they’d like to see something different.

    The FCA’s own staff are asking whether this company can be trusted. The least we can do is listen.

    A note on transparency: I’m a tech entrepreneur who builds legal technology. I have no commercial interest in Palantir’s competitors. I do have a strong interest in who gets to see my data, and yours. This article is based on publicly available sources, parliamentary records, and investigative journalism. All sources are cited below. Where claims are contested or attributed to specific outlets, I have noted this. Palantir has consistently maintained that it takes a “rigorous approach” to human rights and that its technology is used within strict contractual safeguards. Mandelson has denied wrongdoing in relation to the police investigation. No suggestion of illegality is made against any individual named in this article unless explicitly stated otherwise.

    Sources and citations

    1. The Guardian, “Palantir extends reach into British state as it gets access to sensitive FCA data,” 22 March 2026. Reported via The Register, City AM, LBC, Yahoo News UK, and others.
    2. The Register, “Palantir trial plugs into UK financial watchdog’s data trove,” 23 March 2026.
    3. Finextra, “FCA criticised over using sensitive data in AI trial with Palantir,” 23 March 2026. Reports data contents, Houssemayne du Boulay privacy concerns, and contract terms.
    4. NewsBytesApp, “AI firm Palantir can now access UK’s financial data,” 23 March 2026.
    5. FStech, “Palantir wins FCA contract to analyse sensitive UK data,” 23 March 2026.
    6. Computing.co.uk, “UK financial watchdog taps Palantir for data analysis,” 23 March 2026. Quotes Prof Michael Levi (Cardiff University), Christopher Houssemayne du Boulay (Hickman and Rose), and notes Zack Polanski break clause call and Coventry Council contract.
    7. LBC, “Palantir to access sensitive UK financial data,” 23 March 2026. FCA spokesperson quoted: “We ran an open, competitive procurement process and have strict controls in place to ensure data is protected.”
    8. Yahoo News UK, “Palantir given access to highly-sensitive UK financial data,” 23 March 2026. Reports one unnamed competitor, FCA source ethics quote, and Peter Thiel as Trump donor. Reporting on the Guardian’s investigation.
    9. Democracy for Sale, “Palantir’s NHS data platform rejected by most hospitals,” May 2025. Documents “land and expand” strategy (quoting Foxglove), £1 to £330m NHS trajectory, and political recruitment.
    10. openDemocracy, “Palantir hired four ex-Ministry of Defence officials before winning record defence contract,” 24 January 2026. Documents Barnaby Kistruck (director of industrial strategy, prosperity and exports), Laurence Lee, Damian Parmenter, Leo Docherty. £240m contract awarded without tender December 2025. “openDemocracy is not suggesting any wrongdoing on Kistruck’s part.”
    11. Hansard, “Ministry of Defence: Palantir Contracts,” 10 February 2026. Cross-party debate. Quote: “Its £1 Covid contract with the NHS expanded to a £330 million contract.” Global Counsel links discussed. 34 contracts figure cited.
    12. Prospect Magazine, “How Palantir infiltrated the state.” Documents Mosley’s “common operating system” pitch.
    13. The Register, “Palantir suggests ‘common operating system’ for UK govt data,” 25 March 2025. Confirms Mosley’s Covid inquiry witness statement.
    14. The Nerve / Carole Cadwalladr, “Revealed: Palantir deals with UK state total at least £670m,” 7 February 2026. Documents £388m MoD, £244m+ NHS, nuclear submarine services, 34 contracts.
    15. Liberty Investigates / i newspaper, “UK police working with controversial tech giant Palantir on real-time surveillance network,” June 2025. Documents police data categories including political opinions, health records, sexual orientation, trade union membership.
    16. UK Parliament oral evidence, Science, Innovation and Technology Committee, Louis Mosley testimony. “Strongly rejected” buying-in critique; “administrations of every colour” quote.
    17. Novara Media, “What Is Palantir?,” 19 February 2026. Documents Israeli military use, ICE contracts ($200m+).
    18. Byline Times, 19 February 2026. Reports Valar Ventures / Epstein limited partner status (Thiel spokesperson disputed “co-ownership” characterisation but confirmed Epstein’s role). Documents Swindells revolving door. Notes trust said Swindells excluded from Palantir decisions.
    19. Good Law Project, “Mandelson’s embassy fixed Starmer’s visit to spytech firm,” April 2025.
    20. Hansard, “Lord Mandelson,” 4 February 2026. Documents Washington visit not in PM’s register, no minutes.
    21. Bloomberg, September 2025. Documents Mandelson’s 28% shareholding in Global Counsel.
    22. CIPR, 5 February 2026. Confirms Global Counsel registered with ORCL, lists Palantir as client.
    23. CNN, 23 February 2026. Confirms Mandelson fired as ambassador in September 2025 by Starmer following Epstein email revelations.
    24. Al Jazeera, 24 February 2026. Mandelson arrested on suspicion of misconduct in public office, released on bail. Also reported by CNN, PBS, NPR.
    25. ITV News, 6 March 2026. Mandelson released under investigation, no longer on bail, passport returned.
    26. Bloomberg, 19 February 2026. Global Counsel entered administration. Also Yahoo Finance / Sky News, 19 February 2026.
    27. CNBC, “Anthropic was the Pentagon’s choice for AI. Now it’s banned,” 9 March 2026.
    28. Axios, “Trump moves to blacklist Anthropic’s Claude from government work,” 27 February 2026.
    29. CNBC, “Palantir is still using Anthropic’s Claude as Pentagon blacklist plays out, CEO Karp says,” 12 March 2026.
    30. Reuters / Marine Corps Times, “Hegseth wants Pentagon to dump Claude, but military users say it’s not so easy,” 19 March 2026.
    31. The Register, “UK promises procurement shift after Palantir deals,” 20 March 2026.
    32. House of Commons Library, “Digital sovereignty,” Research Briefing CBP-10547, March 2026.
    33. UK Parliament Early Day Motion 65087, “UK digital sovereignty strategy.”
    34. Gwallter, “Who is Louis Mosley?” Documents Wales NHS decision to build National Data Resource without Palantir.
    35. The Register, “UK urged to cut out US Big Tech for sake of digi sovereignty,” 6 January 2026.
    36. Medact, “Health workers confront NHS leaders at closed-door Palantir meeting,” March 2026. Lists Lord Tom Watson among “former UK government officials now employed or consulted by Palantir.”
  • The Seeing Stones: How a CIA-Funded Surveillance Company Ended Up Running the NHS

    The Seeing Stones: How a CIA-Funded Surveillance Company Ended Up Running the NHS

    Coming up in today’s show and tell…

    • Palantir, a surveillance company co-founded by Peter Thiel with CIA seed money, now holds over £500 million in UK government contracts, including a £330 million deal to run an NHS data platform covering tens of millions of patients.
    • The contract grew from a £1 pandemic “freebie” to £60 million without any competitive tender. When the £330 million contract was finally published, 71% of it was blacked out because the data protection terms hadn’t been agreed yet.
    • Palantir’s lobbyist was Peter Mandelson’s firm Global Counsel. Mandelson held a ~21% shareholding while arranging meetings between Palantir’s CEO and the Prime Minister. He has since been sacked as ambassador and is under police investigation. Palantir still has all its contracts.
    • The NHS’s own chief data officers said their existing tools were better than what Palantir was offering. Scotland kept Palantir out entirely. The government is paying KPMG £8 million to persuade hospitals to use software they don’t want.
    • Tim Berners-Lee’s Solid project offers an alternative model where data stays under the control of the people it belongs to. The NHS chose the opposite approach. The contract comes up for review in February 2027.

    Update, 23 March 2026

    Four days after this article was published, the Guardian reported that Palantir has been awarded a contract by the Financial Conduct Authority to analyse its internal intelligence data, including case files, emails, call recordings, and reports of suspected financial crime across 42,000 firms. Palantir now holds contracts covering NHS patient data, Ministry of Defence operations, police systems, and financial regulation. The cross-departmental infrastructure this article warns about isn’t a future risk. It’s being built right now, one contract at a time. A full investigation into the FCA deal is coming.

    I fell down a rabbit hole this week. It started with a question about what Tim Berners-Lee thinks of Palantir, and it ended with me staring at a Hansard transcript at midnight going “no, but seriously, WHAT?” I need to tell you about it, because it’s one of those stories where the more you find out, the more unbelievable it gets, and I think more people should know.

    Fair warning: this starts with Tolkien, takes a detour through watermelon cocktails, and ends with your medical records. Stay with me. I promise it’s worth it.

    A quick word about seeing-stones

    In Tolkien’s Lord of the Rings, a palantír is a seeing-stone. Think crystal ball, but instead of a fortune teller at a village fete telling you you’ll meet a tall stranger, it lets you spy on people across vast distances. The Elves made them for good reasons. Then the bad guys got hold of them, and it all went sideways. Saruman used one and thought he was gaining power. He was actually being controlled. Denethor used one and it drove him to despair. The palantír is Tolkien’s cautionary tale about what happens when surveillance technology ends up in the wrong hands.

    In 2003, the billionaire investor Peter Thiel co-founded a data analytics company. He named it Palantir. He also named his offices after Middle-earth locations: Gondor, Rivendell, the Shire. His venture fund Founders Fund bankrolled a weapons company called Anduril (Aragorn’s sword), founded by former Palantir executives. He co-founded a separate venture fund called Mithril (the magic armour metal). You have to admire the commitment to the theme, if nothing else.

    Now, I want to believe he just really liked the books and thought “seeing-stone” sounded cool. But Thiel studied philosophy at Stanford. He’s not a man who picks names carelessly. And I think if you name your surveillance company after a fictional device whose entire literary purpose is to warn you about the dangers of surveillance, you probably understood the assignment. You just disagreed with the conclusion.

    That company now holds over £500 million in UK government contracts, including a £330 million deal to run a data platform for the NHS. Your NHS. Your data. And the story of how that happened is genuinely one of the most extraordinary things I’ve ever tried to write down.

    The £1 contract (or: how to buy the NHS with watermelon cocktails)

    Cartoon of two people at a dinner table with watermelon cocktails, a napkin reading NHS Patient Data 57 million records, and a £1 coin being slid across the table. Caption: Just a casual dinner.

    The version of this story most people know goes like this: pandemic hits, NHS needs help, generous tech company steps in for £1, everyone claps. It’s a lovely story. It’s also not quite what happened.

    The Bureau of Investigative Journalism found that Palantir had been courting the NHS for months before Covid was a thing. In July 2019, Palantir’s UK boss Louis Mosley hosted a dinner with the chair of NHS England. The email chain, which I have read more times than is probably healthy, mentions “exotic drinks” and “watermelon cocktails.” Over these watermelon cocktails, they discussed potential uses of NHS data. The chair emailed afterwards: “If you can see ways where you could help us structure and curate our data… do be in touch.”

    Just a nice dinner. Just some cocktails. Just the beginning of what would become half a billion pounds in government contracts. As you do.

    By January 2020, two months before the pandemic, Palantir’s London team were already building a product “exclusively focused” on the UK healthcare market. So when Covid arrived and they offered to help for £1, that wasn’t a random act of kindness. That was the free sample outside a shop. The first one’s always free.

    And oh, did it work. £1 became £1 million by July 2020. Then £23 million by December. That £23 million contract was awarded without competition. Through various extensions, Palantir won £60 million from the NHS without ever competing against another company. Sixty million quid and not a single tender. I once had to fill in a 12-page form to get a £500 council grant for a community project, so apparently there are different processes depending on how many zeros are involved.

    Cartoon of a man sliding a £1 coin across an NHS reception desk while behind him sit increasingly enormous money bags labelled £1M, £23M, £60M, and £330M. Caption: Just getting my foot in the door.

    In 2021, openDemocracy and the legal campaign group Foxglove sued the government over it. The government’s legal position was, and I am not making this up, that “citizens have no right to a say in major NHS contracts” with big tech firms. Your health data. No say. They actually argued that. In a court. With lawyers and everything. Faced with a judicial review, they caved and promised not to extend Palantir’s role without consulting the public.

    They broke that promise two years later. In March 2023, leaked documents showed NHS bosses had quietly ordered hospitals to upload patient data to a new Palantir-run database, without the public consultation they’d committed to. Their own internal documents acknowledged this was “likely to be perceived by some privacy campaigners as contentious.” I admire the understatement.

    Then came the big one. November 2023: a £330 million, seven-year contract to build something called the Federated Data Platform (which is the kind of name that sounds important enough that most people stop asking questions, which I suspect is the point). When the contract was made public, it was released on the last working day before Christmas, and 417 of its 586 pages were completely blanked out.

    I should explain what “blanked out” means here, because it’s actually worse than it sounds. “Redacted” means the pages existed but their contents were hidden with black boxes on the version published for the public to see. So journalists, MPs, campaign groups, your GP, you: none of us could read what was in 71% of the contract. Government policy says public bodies have to give reasons when they redact contracts. No reasons were given.

    The Good Law Project launched legal proceedings to find out what was underneath all that black ink. And what they discovered was, if anything, more alarming than what anyone had guessed. The pages weren’t redacted for national security reasons or commercial sensitivity in the usual sense. They were blanked out because those sections, including the data protection clauses, hadn’t actually been agreed yet. NHS England’s own lawyers admitted the provisions were still “subject to commercial negotiation.”

    Let me just make sure that’s landed. NHS England awarded Palantir a £330 million contract to handle the health data of tens of millions of people. They signed it. Then they continued negotiating the terms afterwards. Including the bit about how your medical records would be protected. And when they published the contract, they hid the unfinished bits by blacking them out and releasing it on the day everyone was wrapping presents. The Good Law Project said this was potentially unlawful, not least because once you’ve signed, you’ve given away your negotiating power. Palantir already had the deal. What incentive did they have to agree to stronger privacy terms at that point?

    I’ll just leave that there for a moment while we all process it together.

    Cartoon of a woman reading a thick document where every page is covered in black redaction bars. She has reached page 417. A mug on the desk reads Transparency. Caption: The public version.

    Then, within weeks of signing, Palantir secretly hired a Tory-linked PR agency to pay social media influencers to promote the platform. The briefing asked the influencers not to mention Palantir by name. The NHS investigated it as a potential contract breach. It’s like watching someone trip over their own shoelaces at a job interview. Except the job is running the health data of everyone in England.

    Wait, but what does the NHS actually need this for?

    Before I go any further, I want to be fair about something. The NHS has a real problem, and Palantir offered a real solution to it. If I don’t explain that, this whole piece sounds like conspiracy thinking, and it isn’t. The problem is genuine. It’s who we chose to fix it that’s the issue.

    Here’s the thing about the NHS: it’s enormous, and it’s fragmented. There are around 200 hospital trusts in England, plus integrated care boards, GP practices, mental health trusts, ambulance services, and community health providers. Each one has its own IT systems. Many of those systems are, to put it diplomatically, not new. Some of them can’t talk to each other at all. Your GP records are in one system. Your hospital records are in another. Your outpatient appointments might be in a third. Your prescription history could be somewhere else entirely.

    If you’ve ever turned up at A&E and the doctor has asked you questions that you know are already in your medical records somewhere, you’ve experienced this problem personally. If you’ve ever been referred to a specialist and had to explain your entire history from scratch because they couldn’t see your GP notes, that’s the same problem. It means duplicated tests, missed information, delayed discharges, and longer waiting lists. People genuinely suffer because NHS data systems don’t join up. Better data integration could genuinely save lives. Nobody disputes this.

    The Federated Data Platform was supposed to fix it. The idea was to link up all that fragmented data so the NHS could see, in real time, how many beds are available across a region, where waiting lists are longest, where ambulances are being held up, and where discharge bottlenecks are causing problems. At a trust level, it would help hospitals manage patient flow and theatre scheduling. Perfectly reasonable goals. Genuinely useful. The kind of thing you’d want your health service to be doing.

    So the question isn’t: did the NHS need better data infrastructure? It did. The question is: did the NHS need this company to build it? A company founded with CIA money, whose main clients are military and intelligence agencies, whose co-founder has documented ties to a convicted sex offender, and whose lobbyist is under criminal investigation? When the NHS’s own chief data officers wrote an open letter saying they already had tools that exceeded what the FDP was offering? When Leeds Teaching Hospitals said adopting it would mean losing functionality? When the contract was awarded through a process involving £60 million in uncontested deals, broken consultation promises, and privacy clauses that weren’t finished when the thing was signed?

    The NHS needed a better filing system. What it got was a surveillance platform with a lobbying operation, a Tolkien fixation, and a founder who thinks democracy is overrated. Which, as solutions go, is a bit like calling a plumber and getting a submarine. Technically it involves pipes, but it’s not quite what you had in mind.

    If the product isn’t better, what’s actually going on?

    This is the bit where I need to be really careful, because I’m going to lay out a set of documented facts and then ask an open question, and I want to be clear about which is which.

    Here are the facts. Scotland kept Palantir out of NHS Scotland entirely. Their data systems work. Their patients are being treated. The sky did not fall in. The NHS’s own chief data officers said their existing tools were better than what Palantir was offering. Leeds Teaching Hospitals said adopting the platform would mean losing functionality. Most trusts don’t want it. The government is paying KPMG £8 million to persuade hospitals to adopt it. If you’re paying a consultancy firm eight million pounds to convince your own customers to use your product, the product is not selling itself.

    So why is it still happening? Let me show you what the public record says about who benefits.

    Palantir paid Global Counsel, Mandelson’s lobbying firm, from 2018 onwards. The fee has never been publicly disclosed. Mandelson retained a roughly 21% shareholding in Global Counsel while simultaneously facilitating meetings between Palantir and the Prime Minister. That means he had a direct financial interest in Palantir winning UK government contracts. That’s not speculation. That’s Companies House filings and Hansard.

    The Good Law Project noted that the head of Palantir’s UK operation made a donation to a Conservative minister. The revolving door between the NHS and Palantir is documented too: openDemocracy found that at least three former NHS data experts left the health service and joined Palantir, including Indra Joshi, who was the NHS’s head of AI and helped launch the Covid-19 datastore, the first NHS project to use Palantir’s software, before leaving the health service and joining the company in 2022. Imagine being the person responsible for introducing a company’s product into your workplace, then going to work for that company. It’s technically legal. It doesn’t look great.

    Cartoon showing a revolving door between three buildings labelled NHS, Palantir, and Government, with people carrying boxes of belongings walking calmly between them in a circular pattern while a cleaner mops the floor unbothered.

    On the political side, the Good Law Project found that Health Secretary Wes Streeting has accepted up to £372,000 from companies and individuals with links to private healthcare since entering parliament in 2015, representing more than 60% of his total registered donations. Nobody is suggesting that money was specifically in exchange for the Palantir contract. But when a Health Secretary who has received hundreds of thousands of pounds from private health interests is privately briefed that a private health contractor’s reputation is damaging delivery, and his response is to press on with the contract anyway, it’s reasonable to ask what’s shaping his priorities.

    I want to be honest: nobody has produced a smoking gun showing someone received a brown envelope in exchange for this contract. That’s not how it works at this level, and expecting it to look like that is how it keeps working. What the public record shows is lobbying fees, shareholdings, political donations, a revolving door of staff, dinner party networks, and the kind of access that money buys but never explicitly pays for. It’s structural, not transactional. The money doesn’t flow in a straight line from A to B. It flows in a circle, where relationships become contracts become jobs become donations become access become relationships again.

    I don’t know exactly who benefits from this arrangement or by how much. But I know that when a product the customers don’t want is being sold to them with £8 million of public money, by a company whose lobbyist had a financial stake in the outcome, whose staff are recruited from the very organisation they’re supposed to be serving, and whose contract was signed before the privacy terms were even agreed… “sorting out the NHS’s data” probably isn’t the whole story.

    The man behind the seeing-stone

    To understand how we got here, you need to know a bit about Peter Thiel. He studied philosophy at Stanford, which I mention because his philosophy is genuinely built into Palantir’s DNA, and it’s… well. It’s a lot.

    He co-founded PayPal. He was the first outside investor in Facebook. He created Palantir with seed funding from In-Q-Tel, which is the CIA’s venture capital arm (the CIA has a venture capital arm! I didn’t know that either, and I sort of wish I still didn’t). His biographer Max Chafkin describes his thinking as “bordering on fascism”. He’s written openly that he no longer believes freedom and democracy are compatible. In his book Zero to One, he argues companies are better run than governments because they have a single decision-maker. A dictator, essentially, though he’s too polished to use that word.

    His political network is vast. JD Vance, the current US Vice President, is Thiel’s protégé: mentored by him, employed by him, and bankrolled with $10 million for his Senate run. More than a dozen people with ties to Thiel sit inside the Trump administration, including former Palantir staff in the Department of Health, the Treasury, and DOGE. Stephen Miller, the architect of America’s mass deportation policy, personally owns more than $100,000 of Palantir stock. Palantir makes the software that ICE (Immigration and Customs Enforcement, the US agency currently carrying out mass deportation raids under Trump) uses to find people. I’m not going to draw you a diagram. You can see it.

    And then there’s the Epstein connection. Byline Times documented that Thiel maintained a business relationship with convicted sex offender Jeffrey Epstein through a venture fund called Valar Ventures, from 2014 until Epstein’s final arrest in 2019. Former Israeli PM Ehud Barak described Thiel and Epstein as “co-owners” of the fund. Thiel’s spokesperson denied the “co-owner” bit but confirmed Epstein was a limited partner. The distinction may matter to some people. I will let you decide if you’re one of them.

    The man actually running it

    Thiel is the co-founder and chairman. But the person running Palantir day to day is Alex Karp, and he’s arguably even more interesting, because he’s the contradiction that makes the whole thing work.

    Karp and Thiel met at Stanford Law School. Karp then went off and got a PhD in social theory from Goethe University in Frankfurt. He grew up in a leftist family with activist parents. He describes himself as “progressive but not woke” and has donated to Biden and Kamala Harris. On paper, he’s the political opposite of Thiel. And yet they co-founded the same surveillance company, and they’ve been running it together for over 20 years. Funny how that works.

    In 2024, Karp was the highest-paid CEO of a publicly traded company in the United States, with compensation of almost $6.8 billion. That’s billion with a B. For context, the entire £330 million NHS contract, the one that’s supposed to transform healthcare data for the whole of England, is roughly 3% of what Karp personally earned in a single year. I don’t know what to do with that information. I’m just putting it there.

    He’s also been saying some very interesting things out loud recently. On CNBC last week, he said “what makes America special right now is our lethal capabilities, our ability to fight war.” He’s described himself as “exceedingly proud” of Palantir’s work supporting Israel. And in the same interview, he said that AI technology will reduce the economic power of “highly educated, often female voters, who vote mostly Democrat” while increasing the power of “working-class, often male” voters. Which is, I think, a remarkably candid thing for a self-described progressive to say about his own product. The New Republic described it as a direct pitch to the Republican Party from a CEO whose company is already embedded in the Pentagon.

    So that’s Palantir’s leadership. The co-founder believes democracy is incompatible with freedom. The CEO describes himself as progressive while running a surveillance company that aids deportation raids, supports military operations, and whose product he cheerfully admits will undermine the economic power of educated women. They present as opposites but they built the same machine and it serves the same ends. The difference is that Thiel is honest about his philosophy. Karp wraps the same outcomes in nicer language.

    The Mandelson web (where it gets really wild)

    OK. This is where the story goes from “that’s concerning” to “are you actually serious.” I need you to stay with me because every single thing I’m about to say is documented, sourced, and on the public record, even though it reads like the plot of a thriller that would be rejected for being too far-fetched.

    In 2018, Palantir hired Global Counsel, the lobbying firm co-founded by Peter Mandelson. The goal was to make Palantir look like a respectable partner for the UK government. At this point, both Thiel and Mandelson were connected to Jeffrey Epstein. Thiel through Valar Ventures. Mandelson through a personal relationship that continued after Epstein’s 2008 conviction for sex offences against children. The man hired to make the surveillance company look respectable, and the man who founded the surveillance company, were both connected to the same convicted sex offender.

    I’ve typed that sentence several times now and it still doesn’t feel real. But it is.

    Global Counsel got busy. In February 2023, they hosted a dinner where the NHS’s chief data officer was listed as the “guest of honour”. Nine months later, Palantir won the £330 million contract. I’m sure that’s a coincidence.

    When Mandelson became UK Ambassador to the US, civil servants warned him that his interest in Global Counsel “would have to cease”. He didn’t comply. He kept his roughly 21% shareholding. While still ambassador, still holding those shares, he arranged a meeting between Palantir’s CEO and Keir Starmer at Palantir’s US headquarters. The meeting didn’t appear on the PM’s register of visits.

    Shortly after, the MoD awarded Palantir a contract worth roughly £250 million. Directly. Without competition. MPs asked for the documents from the Starmer-Palantir meeting. The government refused, saying it was “too expensive to find them”. The minutes of a meeting between the Prime Minister and a surveillance company that just received a quarter-billion-pound defence contract. Too expensive to locate. I’ve lost socks that were easier to find.

    Mandelson has since been sacked as ambassador, forced to resign from Labour and the House of Lords, and is under Metropolitan Police investigation. Global Counsel has gone into administration. But Palantir still has every single one of its contracts.

    Byline Times asked the question that I think deserves a proper answer: if Mandelson’s links to Epstein disqualify him from holding power, why does the company controlled by Epstein’s business partner still have access to the UK’s most sensitive infrastructure? Nobody’s answered that yet. I’d genuinely love to hear someone try.

    Why your NHS data matters more than you think

    Here’s where we need to talk about what Palantir’s software actually does, because it’s not just a fancy spreadsheet.

    Palantir’s Foundry platform is designed to link datasets that weren’t previously connected, find patterns between them, and build profiles. That’s the product. That’s what it does for the CIA. That’s what it does for ICE (Immigration and Customs Enforcement, the US agency carrying out mass deportation raids under Trump), combining immigration records with financial data and phone records to track people. That’s what it does for the military, fusing satellite imagery with intercepted communications to generate targets. Palantir’s CEO said last week that “what makes America special right now is our lethal capabilities, our ability to fight war.” Charming.

    That same cross-referencing engine now sits on top of the NHS.

    The NHS holds structured health data on the population of England. Your GP visits, your prescriptions, your mental health records, your sexual health, your pregnancies, your addiction history. Linked to your postcode and date of birth. Ernst & Young estimated in 2019 that this data is worth £9.6 billion a year: about £5 billion to commercial organisations who could profit from the patterns, and £4.6 billion in benefits to patients through better outcomes.

    I want to pause on that framing for a second, because it bothers me. The NHS wasn’t built as a data asset. It was built to look after people. The data exists because doctors and nurses care for patients. The fact that someone put a commercial price tag on it, and bundled “value to pharmaceutical companies” together with “benefits to sick people” into one headline number, tells you something about how this conversation has already been quietly shifted underneath us.

    A report from health justice group Medact, backed by Amnesty International, Privacy International, and the Good Law Project, just laid out why the next shift should worry us. Medact warned that the platform could enable government departments like the Home Office and police to access patient data. Palantir’s own UK executive has argued publicly for a “common operating system” linking NHS, DWP, and other public data. And Reform UK has explicitly pledged to “automatically share data between the Home Office, NHS, HMRC, DVLA, banks and the police” to find and deport people. The infrastructure for that is being built right now. That’s not a conspiracy theory. It’s in their policy document.

    The chilling effect is already measurable. During the pandemic, around 57% of migrants avoided seeking healthcare because they feared being reported to the Home Office. Put a surveillance company’s cross-referencing engine in the middle of that system and people who need medical help will stop asking for it. That’s not hypothetical. That’s maths.

    Meanwhile, fewer than a quarter of England’s 215 hospital trusts were actually using the platform by the end of 2024. Leeds Teaching Hospitals told NHS England it would “lose functionality rather than gain it”. The response from government? They paid KPMG £8 million to “promote the adoption” of software that hospitals don’t want. Eight million pounds of public money on what is essentially a marketing campaign for a product the actual customers are politely declining. That’s a sentence I didn’t expect to write today, and yet here we are.

    Cartoon of a man in a suit enthusiastically presenting a laptop labelled Platform to tired NHS staff in scrubs, one of whom is holding their own laptop with a sticky note reading Already works. A banner behind reads Adoption Campaign £8m budget.

    Tim Berners-Lee and the road not taken

    Right. Here’s the bit that turns this from infuriating to properly heartbreaking. Because there was always another way, and it was right there.

    Tim Berners-Lee invented the World Wide Web in 1989 and gave it away for free. No patent. No licensing fee. Because he believed information should be open and accessible to everyone. I wrote my university dissertation about him in 2002 (specifically about whether Flash animation would be the future of the web, which in hindsight was not my strongest prediction), and I’ve been banging on about his vision ever since. But his recent work is what matters here.

    He’s been building a project called Solid, which does exactly what the NHS needed: it keeps data under the control of the people and institutions it belongs to, with access granted on a permission basis. No centralised platform. No vendor lock-in. No surveillance company required.

    Split panel cartoon. Left side labelled The Seeing Stone, Palantir: a man sits alone in an armchair clutching a glowing orb with tiny people visible inside it. Right side labelled The Web, Given away free 1989: a diverse group of people each hold their own small glowing orb, smiling.

    Speaking in Barcelona on 3 March, he demonstrated an AI assistant called Charlie that pulls from a user’s own data store, not a corporate database. He said: “Claude doesn’t understand anything about you, but Charlie does.” Because Charlie has permission to use your data, on your terms. That’s the model. That’s what was always possible.

    The NHS’s own people knew this. The NHS Chief Data and Analytical Officer Network wrote in an open letter that they “already have similar tools in use that presently exceed the capability” of what the Federated Data Platform was offering. They didn’t need Palantir. They needed investment in what they already had.

    Berners-Lee and Thiel are almost perfect philosophical opposites. One built the web and gave it away because he believed it belonged to everyone. The other built a surveillance company and named it after Tolkien’s cautionary tale about surveillance. One believes you should own your own data. The other believes exceptional individuals should control it. The NHS chose Thiel’s model. Nobody asked us which one we preferred.

    What can actually be done (the hopeful bit)

    I promised myself I wouldn’t write one of those pieces that makes you feel terrible and then stops. So here’s the constructive bit, and I mean it.

    The political picture isn’t great right now. Wes Streeting was privately briefed that Palantir’s reputation was hindering the platform’s delivery and pressed on. In private WhatsApp messages to Mandelson, he conceded Israel was “committing war crimes before our eyes”, while publicly dismissing concerns about Palantir’s NHS involvement. It’s fair to say the political class, across parties, has not covered itself in glory on this one.

    But there are real pressure points, and real people applying real pressure. The contract comes up for review in February 2027. The BMA has formally called for the contract to end. Medact’s report is backed by Amnesty International, Privacy International, and the Good Law Project. Scotland has kept Palantir out of NHS Scotland entirely, which proves it’s possible. Local campaigns are fighting trust by trust, ICB by ICB.

    And here’s the thing I keep coming back to, the thing that actually gives me hope, although I want to be honest about the limits of that hope because I think you deserve that. Every single fact in this article comes from a public source. Companies House filings. Contracts Finder. Hansard. The lobbying register. FOI responses. Investigative journalism built on publicly available records. The information is all there. It’s just scattered across dozens of databases that don’t talk to each other, which means connecting it all up currently requires months of work by specialist journalists and lawyers with resources most of us don’t have. Most of us are trying to get through Tuesday.

    So I’ve been thinking: what if there were a tool where you could type in any company’s name and see, in one place, what public contracts they hold, who their directors are, who lobbied for them, and what political donations are connected? Not opinion. Not editorialising. Just public data, linked up and searchable. The kind of thing that currently takes an investigative team months, available to anyone with a browser and a cup of tea.

    I’m calling the project Power to the Minions, because I’m a mum of four who lives in Frome and I think naming things should be fun, and also because that’s literally what it is: giving ordinary people access to information that currently only well-resourced professionals can piece together.

    Now. Before I get carried away with my own pitch, let me be the first to say: I’m not going to pretend a search tool fixes democracy. If it were that simple, someone would have done it by now, and we’d all be living in a utopia where government contracts were awarded on merit and dinner party invitations had no bearing on procurement decisions. Clearly, we are not living in that utopia. I checked.

    The investigative journalists who broke this story are brilliant. openDemocracy, the Bureau, Byline Times, Foxglove, the Good Law Project: they’ve done extraordinary work over six years. And Palantir still has its contracts. So why would a tool help where journalism hasn’t?

    Here’s my honest answer: journalism produces stories. Stories have news cycles. They peak, they get shared, people are outraged for a week, and then everyone moves on to the next thing. The Palantir-NHS story has been broken repeatedly since 2020. Each time there’s a flurry of attention. Each time it fades. The contracts remain. That’s not a failure of journalism. That’s the nature of how attention works. A story is a photograph of a problem. What doesn’t exist yet is a window.

    The difference between a photograph and a window is that the photograph gets looked at once and then goes in a drawer. The window means anyone can look, any time, for as long as the building stands. A tool that connects Companies House data with Contracts Finder with Hansard with the lobbying register isn’t a photograph. It’s a window. It doesn’t need a news cycle to work. It’s just there, permanently, for anyone who wants to look through it.

    Cartoon of a woman holding a cup of tea, looking through a window at an illuminated web of connections linking nodes labelled Contract, Director, Donation, Lobbyist, Minister, and Dinner. Caption: What if the light was just always on?

    Does it stop Palantir on its own? No. Of course not. A window doesn’t stop a burglar. But it does mean the neighbours can see what’s happening. And it means the next time someone awards a contract to a company whose lobbyist is under criminal investigation and whose founder has documented business ties to a convicted sex offender, the connections are visible within minutes instead of months. That changes who can ask questions, how quickly, and how often. It doesn’t replace the journalists and lawyers. It gives them (and everyone else) a head start. Instead of spending three months finding the web, they can spend three months acting on it.

    Also, and this is the bit that quietly matters most: it changes the calculation for the people doing the dodgy deals. Right now, if you’re awarding a contract to a friend of a friend after a nice dinner, you know it’ll take years for anyone to connect the dots. If the dots connect automatically the moment the contract hits Contracts Finder? You might reconsider whose dinner invitation you accept. Transparency doesn’t just expose problems. It prevents some of them from happening in the first place, because the humans involved are, at bottom, quite keen on not being caught.

    I know what I’m describing sounds like it might already exist. There are good tools out there. OpenCorporates makes Companies House data searchable. They Work For You makes Hansard searchable. But nobody’s built the connective layer between them. You can look up a company. You can search for contracts. You can check the lobbying register. You can search Hansard. What you can’t do, anywhere, is go from “this company got this contract” to “and here’s who lobbied for it, and here’s where the directors sit on other boards, and here’s who donated to which politicians” in one search. That’s the gap. And it’s the gap where the story lives.

    The elephant in the room: they already have our data

    I can hear the question, because I asked it myself: even if we get Palantir out at the 2027 review, haven’t they already had access to our data since 2020? What’s done is done, surely?

    Fair point. And I want to be honest about it rather than do the thing where you pretend there’s a magic undo button and everyone goes home happy. Yes, Palantir has been processing NHS data for over five years. The structural knowledge they’ve gained, the patterns they’ve identified, the architecture they’ve built: that institutional learning doesn’t evaporate when a contract expires. Nobody’s invented Ctrl+Z for corporate knowledge. That’s a real and uncomfortable truth.

    But ending the contract still matters. A lot. It stops the ongoing, daily access to live patient data. It prevents the Federated Data Platform from becoming the permanent infrastructure through which a future government could do cross-departmental surveillance. It breaks the vendor lock-in before it becomes irreversible. And it sends a signal, to Palantir and to every other company watching, that there are consequences for how you behave, who you associate with, and whose data you handle. Consequences are underrated. We should have more of them.

    Scotland proves it’s possible. They kept Palantir out of NHS Scotland entirely. The sky didn’t fall in. Their data systems still work. The patients are still being treated. The lesson is clear: you don’t need a CIA-funded surveillance company to manage healthcare data. You need investment in your own people and your own infrastructure. Which is, funnily enough, what the NHS’s own data chiefs were saying all along, to anyone who was listening, which apparently did not include the people signing the contracts.

    There’s something Tim Berners-Lee said that I think about a lot: the web was designed, which means it can be redesigned. The same is true of the systems that currently protect opacity. They were built. They can be rebuilt. And you don’t need to be an investigative journalist or a lawyer to help. You just need the data to be findable.

    The seeing-stone serves whoever holds it

    Cartoon of a glass orb on a desk with GP records, Prescriptions, Mental health, Postcode, and Date of birth written inside it. Two hands reach for it from opposite sides: one with an NHS cross on the cuff, the other with an eye symbol cufflink. Caption: One seeing-stone to rule them all.

    I keep coming back to Tolkien, because the metaphor really is almost annoyingly perfect.

    The palantír isn’t dangerous because the bad guys built it. The Elves built it, for perfectly good reasons. It’s dangerous because once it exists as a centralised tool of seeing, it serves whoever holds it. The Federated Data Platform is the same. The NHS built it to manage waiting lists. Reasonable goal. But once it exists as a single connected data layer across the entire health system, run by a company whose core business is cross-departmental surveillance, you’ve created something whose potential uses extend well beyond anything the NHS intended.

    A future government that wants to cross-reference your health data with your immigration status, your benefits claims, or police intelligence doesn’t need to build anything new. The pipes are already laid. They just need to turn the taps.

    Cartoon of an NHS building with coloured pipes labelled GP Records, Prescriptions, Mental Health, Sexual Health, and Immigration Status all feeding into a single tap controlled by a suited hand, dripping into a bucket labelled TBD. A diverse group of patients watches from outside. Caption: The plumbing is already done.

    Tim Berners-Lee closed his Barcelona talk with something that I think is worth finishing on: “Imagine apps which are collaborative, which are creative, which are compassionate. Imagine this world, and do whatever you can to get towards that world.”

    I reckon “whatever you can” is the important bit. Not everyone can sue the government or fund a legal challenge. But we can build tools that connect public data. We can support the people doing the hard work: openDemocracy, Foxglove, the Good Law Project, Medact. We can pay attention. We can refuse to let complexity be the thing that shields power from accountability.

    The man who invented the web gave it away because he believed it belonged to everyone. The man who founded Palantir named it after a fictional surveillance device because, I suspect, he understood exactly what he was building.

    I know which vision I’d rather build towards. And if you’ve read this far, I’m guessing you do too.