Anduril and Palantir battlefield communication system ‘very high risk,’ U.S. army memo says

In this photo provided by the U.S. Navy, Lt. j.g. Kyle Atakturk, left, and Lt. j.g. Nicholas Horton, pilot a U.S. Navy P-8A Poseidon during a mission to assist in search and rescue operations for Malaysia Airlines flight MH370 Wednesday March 19, 2014. (AP Photo/US Navy, Mass Communication Specialist 2nd Class Eric A. Pastor)

The much-needed modernization of the U.S. army’s battlefield communications network being undertaken by Anduril, Palantir and others is rife with “fundamental security” problems and vulnerabilities, and should be treated as a “very high risk,” according to a recent internal U.S. army memo.

The two Silicon Valley companies, led by allies of U.S. President Donald Trump, have gained access to the Pentagon’s lucrative flow of contracts on the promise of quickly providing less expensive and more sophisticated weapons than the Pentagon’s longstanding arms providers.

Military drone and software maker Anduril boasted it had a prototype of the NGC2 communications platform working during a battlefield test just eight weeks after winning the contract award. But the Sept. 5 memo provides fodder for critics who argue that Silicon Valley’s move-fast-break-things ethos may not be the best approach for vital military equipment.

The memo from the U.S. army’s chief technology officer about the NGC2 platform that connects soldiers, sensors, vehicles and commanders with real-time data paints a bleak security picture of the initial product.

“We cannot control who sees what, we cannot see what users are doing, and we cannot verify that the software itself is secure,” the memo says.

Those concerns have been addressed already as part of the “normal process” of development, Anduril said. “The recent report reflects an outdated snapshot, not the current state of the program,” the company said in a statement emailed to Reuters.

A Palantir spokesperson said “No vulnerabilities were found in the Palantir platform.”

However the U.S. army internal memo written by Gabriele Chiulli, the U.S. army chief technology officer authorizing official on the NGC2 prototype, said “given the current security posture of the platform and the hosted 3rd party applications the likelihood of an adversary gaining persistent undetectable access to the platform requires the system be treated as very high risk.”

Palantir stock was down more than seven per cent in afternoon trading on Friday. Anduril is not publicly traded, but company founder Palmer Luckey has said a public offering is planned.

A Sept. 30 article on Anduril’s website touted the NGC2 system’s performance during a live-fire exercise in Fort Carson, Colorado: “Soldiers fired 26 live missions with M777 howitzers on Fort Carson’s live-fire ranges, running AXS side-by-side with legacy crews. The contrast was visible: one team struggling with delays, the other firing digitally in seconds.”

Despite the Sept. 5 memo’s critique, Leonel Garciga, U.S. army chief information officer and Chiulli’s supervisor, said in a statement to Reuters this week that the Sept. 5 report was part of a process that helped in “triaging cybersecurity vulnerabilities” and mitigating them.

But the U.S. army CTO’s assessment, seen by Reuters and first reported by Breaking Defense, comes just months after Anduril was awarded a US$100 million contract to create a prototype of NGC2 with partners including Palantir, Microsoft and several smaller contractors.

The memo said the system allows any authorized user to access all applications and data regardless of their clearance level or operational need. As a result, “Any user can potentially access and misuse sensitive” classified information, the memo states, with no logging to track their actions.

Other deficiencies highlighted in the memo include the hosting of third-party applications that have not undergone U.S. army security assessments. One application revealed 25 high-severity code vulnerabilities. Three additional applications under review each contain over 200 vulnerabilities requiring assessment, according to the document.

Palantir and Anduril are leading a new wave of defence firms aiming to transform the U.S. military with cutting-edge technologies, including drones, artificial intelligence, and autonomous systems.

Palantir, a data analytics firm known for its work with intelligence agencies, and Anduril, which develops drones and battlefield software, have seen their valuations surge under Trump’s presidency, as Washington increasingly turns to Silicon Valley-style innovation to counter rising threats.

Anduril recently signed a US$159 million deal for an initial prototyping period to develop a night vision and mixed reality system as part of the Soldier Borne Mission Command (formerly IVAS Next) program. Palantir signed an US$480 million contract for Maven, an artificial intelligence tool that sifts through images and sensor data to provide battlefield analysis.