Glitch Exposed Data of Alleged Treaty Violator to FBI

Private data belonging to an alleged treaty violator was accessible to unauthorized FBI agents for months because of a software program flaw.

The glitch in the Palantir program was reportedly exploited by at least four Bureau employees to view data belonging to Singapore resident and US citizen Virgil Griffith. 

Former Ethereum developer Griffith was arrested at Los Angeles International Airport in November 2019 and charged with violating the International Emergency Economic Powers Act by traveling to the Democratic People’s Republic of Korea to give a presentation and technical advice on using crypto-currency and blockchain technology to evade sanctions. 

In January 2020, in a Southern District of New York courthouse, Griffith pleaded not guilty to the charge.  

The Palantir defect exposed data that had been recovered from Griffith’s Twitter and Facebook accounts in March 2020 during the execution of a federal search warrant. Prosecutors in the case against Griffith, who described the glitch in a letter, said it pertained to the program’s default setting.

“When data is loaded onto the Platform, the default setting is to permit access to the data to other FBI personnel otherwise authorized to access the Platform,” wrote prosecutors. 

The prosecutors wrote that word of the unauthorized access came to Griffith’s assigned FBI case agent via an email sent by another agent. The email explained that material seized in the search and entered in Palantir through the program’s default settings had been accessed by FBI analyst.

A letter filed by the Bureau on Tuesday states: “An FBI analyst, in the course of conducting a separate investigation, had identified communications between the defendant and the subject of that other investigation by means of searches on the Platform that accessed the Search Warrant Returns.”

Prosecutors learned that three FBI analysts and an agent had viewed Griffith’s private data owing to the Palantir glitch. None of the FBI employees who accessed Griffith’s data were working on his case. 

Between May 2020 and August 2021, the seized material was accessed at least four times.

Griffith is scheduled to appear in court on September 21.