Who Has the Stones?
One company knows who you are. Another knows where you’ve been. The same customer is shopping for both.
The king sat alone in the top room of his gilded tower, the stone before him on a cloth of red velvet. The glass was dark, big as a man’s head and heavy as a grudge, and it glowed at his touch.
Far away, in a hall hung with blue banners, ten thousand delegates had gathered for their convention. The stone murmured their conversations back to him, like the whispers of the sea in a seashell, and he leaned closer, and the stone leaned with him. He twisted and turned the stone till it revealed their darkest secrets, the things he desired most to know. He saw their quarrels and their fears — he saw it all and smiled. He knew that with this portal into his enemy’s world, they would never surprise him again. He chuckled and stroked the stone with his fingertip.
The Tolkien fans among you know this stone as a Palantir, meaning far-seeing, one of seven that let their keepers observe distant places, speak to people there, and touch them. They formed a network, and that was their only flaw. The Dark Lord captured one and used it to reach the others. Saruman looked in and was ensnared. Denethor, Steward of Gondor, looked in and saw only what the enemy chose to show him, and despair did the rest. The stones did not lie, not really. They showed true things, selected by someone else.
In 2003, Peter Thiel and his co-founders named a company after them.1 Tolkien, who distrusted machines all his life, must be shuddering in his grave. The company’s objective was to eliminate siloed data. In the 70s and 80s, computers became powerful enough to store ever-larger tracts of data across an ever-growing number of databases. Most of these were on standalone machines and thus had no knowledge of the data in other systems. Thiel’s insight was that if we somehow merged the data in these systems into one system, it would obviously know a great deal more about, well, about anything they had been collecting data on. Which turned out to be just about everything.
It used to be difficult, in some cases, impossible to just merge all the data. Laws governed access, and privileges ensured only the right people could read and change it. About twenty years ago, and for all the time I was a programmer, getting data out of two databases meant writing code called ‘a join’ — it joined two or more datasets — and that often required redesigning the database itself to make it work. Palantir has made that chore disappear. Now more or less anyone can gain access to more or less any data — just buy a subscription to Palantir and all your data dreams come true, because if they can’t get it for you now, write them a cheque and they will.
A join needs something to join on. Palantir’s customers already hold the who: tax returns, Medicaid rolls, benefit files, visa applications. What they have never held, at scale, is the where. An address is a snapshot, updated when someone remembers to tell somebody. A person’s movements are a story, and no database of names can tell it. That is the other half of the machine, and any good police state wants both, so let’s start with an ordinary road.
The road
A car comes down Main Street in a town you have never heard of, at the speed limit, and a grey box on a pole snaps a photo of it. Plate, make, colour, dent, bumper sticker. It takes a fraction of a second. Nobody is accused of anything. Yet.
The town bought the camera to catch carjackers and find missing people, which is how Flock sells it, mostly to small towns.2 It is a decent pitch, and it works. Crowdsourced mapping now counts more than 137,000 plate readers across America, over 80% of them Flock’s.3 The company has contracts with more than 5,000 agencies.4
What happens to the plate
Any system designed to catch carjackers and help police enforce safety would, of course, keep a record of all such photos in its own jurisdiction. And hopefully, restrict access to only those with a legitimate need to know. But in Flock’s case, the photos do not remain local. Its network lets a police department search well beyond its own city limits, and every search simply asks the officer to type a reason into a box.4
In Danville, Illinois, researchers obtained the search logs through a public records request. They showed more than 4,000 nationwide and statewide lookups by local and state police, made at federal request, as an informal favour, or with an immigration focus. The reasons typed into the box included “ICE” and “ICE WARRANT.” Every lookup that listed “immigration” came after the 2025 inauguration.2 In Denver, more than 1,400 immigration-related national searches ran between June 2024 and April 2025, about 690 of them after the inauguration, mostly by out-of-state departments. Denver switched off national search in April.5 That is Tolkien’s flaw in a Ford Explorer. Capture one stone and you can reach the rest.5 In Washington, a University of Washington researcher found “hundreds if not thousands” of Border Patrol searches of local data in a single summer. California’s attorney general says 19 of 20 departments changed their settings once they learned out-of-state police could see their data. He is suing the twentieth.6
Flock says ICE has no direct access. It admits to pilots with Customs and Border Protection and Homeland Security Investigations, which it says have ended, and its CEO concedes the company “clearly communicated poorly.”4 He may be right that ICE has no contract. It doesn’t need one. A friendly department with a login will do the searching.
The layer above
In fairness, Palantir’s first steps appeared to be for good purposes. Its first platform, Gotham, was built for defence and intelligence analysts to find patterns in huge datasets. Its second, Foundry, is described in the company’s own prospectus as a central operating system for an organization’s data, letting users integrate and analyze information in one place.1 It is the join, packaged and sold. Gotham came out of work with CIA analysts on the terrorism-finance desk. In-Q-Tel, the CIA’s venture arm, put in $1.25 million, and Thiel added $2.84 millions of his own.7 ICE has used Palantir software since 2014.7
Under the second Trump administration, the scale changed. Palantir holds a $30 million contract through 2027 for an ICE platform called ImmigrationOS.8 Reporting names Social Security, IRS and Health and Human Services data as inputs, via a whistleblower letter to Congress, and HHS, Labour, and Housing data in 404 Media’s separate reporting.9 Palantir’s own internal justification is that the work can promote “efficiency, transparency, and accountability” and “enable fair treatment” of immigrants.9
A second tool, called ELITE, is alleged to build dossiers on people ICE believes are deportable and to give each a “confidence score” for their current address, drawing on Medicaid data. ICE and the Centers for Medicare and Medicaid Services signed a data-sharing agreement covering nearly 80 million Medicaid patients. I should be plain that this is reporting by 404 Media and others, relayed by Fortune, which did not verify it. Palantir and DHS did not respond.8
The IRS is the documented case, and it needs no allegation. IRS Criminal Investigation has used Palantir’s Gotham and Foundry applications since 2018 for “analysis of massive-scale data to find the needle in the haystack,” according to the contract. The IRS has paid Palantir more than $130 million. The system draws on individual tax returns, bank statements, crypto wallet data and communications records, and a 2024 IRS privacy assessment says agents use it to find connections across datasets.10 As I said, this used to be almost impossible to do and now it’s a simple request.
I want to be careful about what I am claiming. I found no formal business relationship between Palantir and Flock. Thiel has never sat on Flock’s board. His venture firm, Founders Fund, did invest in Flock’s $275 million round in 2025.11 The link is not a contract. It is a key. A licence plate is the join column that ties a person to a place and a time. Flock manufactures the where and when, and Palantir-style fusion supplies the who. ICE buys the second directly8 and borrows the first through local police.2 I found nothing showing a Palantir system ingesting Flock plates, and I am not claiming it does. I am claiming that each is half of a surveillance system, and the same agency is reaching for both halves.
The man who named it
Thiel has told us what he thinks of democracy. In 2009 he wrote, in an essay for the Cato Institute: “I no longer believe that freedom and democracy are compatible.” He named “the vast increase in welfare beneficiaries and the extension of the franchise to women” as groups that are “notoriously tough for libertarians,” and concluded that “the great task for libertarians is to find an escape from politics in all its forms.”12
To be fair to him, that essay is about escape. He looked to cyberspace, to space and to seasteading. It is not a call for surveillance, and I cannot honestly say it explains his company. What it does show is that the man who named Palantir has long doubted that the voters get the last word.
Palantir itself is now louder. Over a weekend in April it posted a 22-point summary of CEO Alex Karp’s book The Technological Republic on X, where it drew about 32 million views. It argues that Silicon Valley owes the country a “moral debt,” that AI will shape the next era of deterrence, and that some cultures are “middling, and worse, regressive and harmful.”13 Fortune noted the tension with the company’s ICE work.
Why would a democracy buy it?
I can see the CCP and North Korea wanting this. A democracy is the harder question, and the sources give a reasonable answer.
The tools were built for war, against enemies abroad, and then turned on home populations. They were sold small, for carjackings and missing children, one town at a time, so no one ever voted on a network. And function creep did the rest. Plates bought for stolen cars were being searched for “ICE” within months.
In 1755, the Pennsylvania Assembly wrote to its governor, in a reply Benjamin Franklin helped draft: “Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety.”14 In context, it was a fight over taxing the Penn family’s lands to pay for frontier defence. It has been read as a general principle ever since, and it fits a dragnet well.
Get Eric Goldman’s stories in your inbox
Join Medium for free to get updates from this writer.
The difference from Beijing is real. Almost everything I have cited came out of democratic machinery: public records requests, audit logs, city councils, a state attorney general, and reporters who could sue. Democracies leak. The weakness is the lag.
Supporters will say, fairly, that the tools solve crimes and find missing people, and Karp frames Palantir’s government work around serious crime and national security.8 The question is not whether the tool works. It is who else gets to use the data.
What Congress and the states can do
Congress has done nothing yet. The Congressional Research Service says there is no specific federal framework for plate readers.3 Bills are circling. Rep. Thomas Massie’s Flock Off Act would bar federal funds for buying or running the cameras, with exceptions for the border and for toll collection.15 Sens. Bernie Sanders and Jeff Merkley and Rep. Alexandria Ocasio-Cortez introduced a Ban Flock Act on October 2, to bar federal agencies from using the cameras or their data.16 Sen. Josh Hawley unveiled a Stop Flock Abuse Act that would require deletion within 10 days, ban facial recognition, and require written approval and an audit log for searches.17 As far as I could confirm, none has cleared committee.
The states are moving faster, and not only the blue ones. Washington’s law, signed March 30, limits use to named investigations, requires deletion after 21 days, bars immigration enforcement use, and keeps readers away from schools, clinics and places of worship.18 Connecticut’s took effect October 1. It also has a 21-day limit, requires a judge-approved warrant for out-of-state requests, and requires the receiving state to promise it won’t use the data for immigration or reproductive-care investigations.19 New Mexico and Kentucky have acted too.20 In the last days of August, Florida ordered readers removed from its state highways and Texas barred state agencies from spending money on Flock.21 Missouri’s governor ordered most plate data deleted within 30 days and barred facial recognition from being paired with it.22 At least 30 localities have cancelled or deactivated Flock since the start of 2025.4
The pattern across all of them is short retention, warrants for anyone outside the state, and a ban on immigration use. Those are the right instincts. They are patchwork, because the join does not stop at a state line.
The king in the tower never asked who made his stone, or who else was looking back through it. Neither have we. The stones did not lie. They showed true things, selected by someone else, and that was what ruined the people who looked.
Sources
1. Palantir Technologies, Form 424B4 prospectus, SEC, 2020. https://www.sec.gov/Archives/edgar/data/1321655/000119312520258493/d904406d424b4.htm
2. 404 Media, “ICE Taps into Nationwide AI-Enabled Camera Network, Data Shows.” https://404media.co/ice-taps-into-nationwide-ai-enabled-camera-network-data-shows
3. Congressional Research Service, Insight IN12735, September 3, 2026. https://www.everycrsreport.com/reports/IN12735.html
4. NPR via KUNC, “Why some cities are ditching their Flock license plate readers,” February 17, 2026. https://www.kunc.org/npr-news/2026-02-17/why-some-cities-are-ditching-their-flock-license-plate-readers
5. Colorado FOIC / Colorado Newsline, Denver Flock search logs. https://coloradofoic.org/news/frequent-immigration-related-searches-of-denver-flock-camera-data-revealed-in-logs/
6. NPR via NHPR, “Some sanctuary states discover feds mining local license plate data,” November 7, 2025. https://www.nhpr.org/2025-11-07/some-sanctuary-states-discover-feds-mining-local-license-plate-data
7. Michael Steinberger, “The Evolution of Palantir,” Fast Company, November 24, 2025. https://fastcompany.co.za/business/2025-11-24-the-evolution-of-palantir-from-cia-investments-to-police-partnerships/
8. Fortune, “ICE allegedly uses Palantir tool tracking Medicaid data,” January 26, 2026. https://www.fortune.com/2026/01/26/ice-allegedly-uses-palantir-tool-tracking-medicaid-data
9. 404 Media, “This is Palantir’s justification for building ICE’s master database,” April 2025. https://www.404media.co/this-is-palantirs-justification-for-building-ices-master-database/
10. The Intercept, Palantir’s IRS contract, April 24, 2026. https://theintercept.com/2026/04/24/palantir-irs-contract-data/
11. Colorado Sun, “Are Flock and Palantir both owned by billionaire Peter Thiel?” February 13, 2026. https://coloradosun.com/2026/02/13/are-flock-and-palantir-both-owned-by-billionaire-peter-thiel/
12. Peter Thiel, “The Education of a Libertarian,” Cato Unbound, April 13, 2009. https://www.cato-unbound.org/2009/04/13/peter-thiel/education-libertarian
13. Fortune, Palantir’s “mini manifesto,” April 22, 2026. https://fortune.com/2026/04/22/palantir-alex-karp-mini-manifesto-national-security-defense-tech-ai/
14. Pennsylvania Assembly, “Reply to the Governor,” November 11, 1755, Franklin Papers, Founders Online. https://founders.archives.gov/documents/Franklin/01-06-02-0107
15. Spectrum News, Massie’s Flock Off Act, September 3, 2026. https://spectrumlocalnews.com/louisville/news/2026/09/03/massie-flock-off-act
16. Gadget Review, the Ban Flock Act. https://www.gadgetreview.com/bernie-sanders-aoc-and-jeff-merkley-just-introduced-the-ban-flock-act
17. CBS News, Hawley’s Stop Flock Abuse Act, September 30, 2026. https://www.cbsnews.com/news/flock-cameras-abuse-josh-hawley-bill/
18. HeraldNet, “Washington adds safeguards for Flock cameras,” March 31, 2026. https://www.heraldnet.com/2026/03/31/washington-adds-safeguards-for-flock-cameras/
19. WFSB, new Connecticut license plate reader rules, October 1, 2026. https://www.wfsb.com/2026/10/01/new-ct-rules-automated-license-plate-readers-including-flock/
20. MultiState, “Automatic license plate readers face growing state restrictions in 2026,” September 23, 2026. https://www.multistate.us/insider/2026/9/23/automatic-license-plate-readers-face-growing-state-restrictions-in-2026
21. EFF, “Texas and Florida Step Back from ALPRs,” September 2026. https://www.eff.org/deeplinks/2026/09/texas-and-florida-step-back-alprs
22. KCUR, “Missouri governor orders guardrails on Flock cameras and automated license plate readers,” September 16, 2026. https://www.kcur.org/politics-elections-and-government/2026-09-16/missouri-governor-orders-guardrails-on-flock-cameras-and-automated-license-plate-readers
