WASHINGTON :The much-needed modernization of the U.S. Army’s battlefield communications network being undertaken by Anduril, Palantir and others is rife with “fundamental security” problems and vulnerabilities, and should be treated as a “very high risk,” according to a recent internal Army memo.
The two Silicon Valley companies, led by allies of U.S. President Donald Trump, have gained access to the Pentagon’s lucrative flow of contracts on the promise of quickly providing less expensive and more sophisticated weapons than the Pentagon’s longstanding arms providers.
Military drone and software maker Anduril boasted it had a prototype of the NGC2 communications platform working during a battlefield test just eight weeks after winning the contract award. But the September 5 memo provides fodder for critics who argue that Silicon Valley’s move-fast, break-things ethos may not be the best approach for vital military equipment.
The memo from the Army’s chief technology officer about the NGC2 platform that connects soldiers, sensors, vehicles and commanders with real-time data paints a bleak security picture of the initial product.
“We cannot control who sees what, we cannot see what users are doing, and we cannot verify that the software itself is secure,” the memo says.
Those concerns have been addressed already as part of the “normal process” of development, Anduril said. “The recent report reflects an outdated snapshot, not the current state of the program,” the company said in a statement emailed to Reuters.
A Palantir spokesperson said, “No vulnerabilities were found in the Palantir platform.”
However, the Army internal memo written by Gabriele Chiulli, the Army chief technology officer authorizing official on the NGC2 prototype, said, “Given the current security posture of the platform and the hosted 3rd party applications the likelihood of an adversary gaining persistent undetectable access to the platform requires the system be treated as very high risk.”
Palantir stock closed down 7.5 per cent on Friday. Anduril is not publicly traded, although company founder Palmer Luckey has said a public offering is planned.
A September 30 article on Anduril’s website touted the NGC2 system’s performance during a live-fire exercise in Fort Carson, Colorado: “Soldiers fired 26 live missions with M777 howitzers on Fort Carson’s live-fire ranges, running AXS side-by-side with legacy crews. The contrast was visible: one team struggling with delays, the other firing digitally in seconds.”
Leonel Garciga, Army chief information officer and Chiulli’s supervisor, told Reuters in an interview on Friday that frank vendor communication is important.
“I think there’s only one application that still has some vulnerabilities that they were working on,” Garciga said, adding that many issues were fixed within a matter of weeks and days.
The Army CTO’s assessment, seen by Reuters and first reported by Breaking Defense, comes just months after Anduril was awarded a $100 million contract to create a prototype of NGC2 with partners including Palantir, Microsoft and several smaller contractors.
The memo said the system allows any authorized user to access all applications and data regardless of their clearance level or operational need. As a result, “Any user can potentially access and misuse sensitive” classified information, the memo states, with no logging to track their actions.
Other deficiencies highlighted in the memo include the hosting of third-party applications that have not undergone Army security assessments. One application revealed 25 high-severity code vulnerabilities. Three additional applications under review each contain over 200 vulnerabilities requiring assessment, according to the document.
Garciga said that next week the Palantir Federal Cloud Service, which the battlefield system relies on, could be approved by the Army to deploy software updates more quickly after receiving a milestone permission known as “continuous authority to operate.”
Palantir and Anduril are leading a new wave of defense firms aiming to transform the U.S. military with cutting-edge technologies, including drones, artificial intelligence and autonomous systems.
Palantir, a data analytics firm known for its work with intelligence agencies, and Anduril have seen their valuations surge under Trump’s presidency, as Washington increasingly turns to Silicon Valley-style innovation to counter rising threats.
Anduril recently signed a $159 million deal for an initial prototyping period to develop a night vision and mixed-reality system as part of the Soldier Borne Mission Command (formerly IVAS Next) program. Palantir signed a $480 million contract for Maven, an artificial intelligence tool that sifts through images and sensor data to provide battlefield analysis.
