CIA-Backed Palantir: What the Public Record Actually Shows

In-Q-Tel-backed Palantir, and its Gotham platform, was built for U.S. intelligence data fusion. Current CIA use is classified. Maven Smart System is a Defense Department program, not a CIA product. The public record supports the core of the claim and rejects several of its details.

Bottom line: “CIA-backed Palantir” is accurate only as a description of an early In-Q-Tel investment, not as a statement of current agency control. Collapsing CIA, FBI, and Maven into one “CIA tracking” stack is the error this brief exists to prevent.

Published: September 28, 2026 · Scope: a fact-check brief separating the settled public record from open, classified, or unconfirmed claims. · By Justin Ray, Narracomm

What happened

In 1999, then-CIA Director George Tenet’s agency chartered In-Q-Tel as an independent, not-for-profit investor, to reach commercial technology that ordinary procurement could not. The CIA’s current technology-collaboration page still describes the relationship in those terms: CIA partners with In-Q-Tel “to find and assess startup companies that meet the Agency’s specific strategic technology needs.” In-Q-Tel is not a CIA office; it is a Virginia corporation funded mainly through contracts with the CIA and other government partners.

Palantir was founded in 2003 by Peter Thiel, Alex Karp and co-founders after the Sept. 11, 2001, attacks. The company’s S-1 registration statement and later annual reports state the origin in the same sentence: “We were founded in 2003 and started building software for the intelligence community in the United States to assist in counterterrorism investigations and operations.” Mainstream venture firms passed. The Wall Street Journal reported in 2009 that In-Q-Tel invested about $2 million and arranged for Palantir engineers to meet intelligence analysts — for about two years the engineers returned to Washington every other week with a revised product.

That work produced Gotham. Palantir’s IPO filing described the problem the software was built to solve: analysts were “hunting for needles not in one haystack but in hundreds and thousands of them,” and soldiers in Afghanistan and Iraq were “mapping networks of insurgents and makers of roadside bombs by hand.” Gotham, Palantir wrote, “enables users to identify patterns hidden deep within datasets, ranging from signals intelligence sources to reports from confidential informants.”

By September 2009 the Journal reported the software was “now being used by the Central Intelligence Agency, the Pentagon and the Federal Bureau of Investigation,” and that spy agencies and military intelligence organizations had “hundreds of databases each, most of which aren’t linked up.” That is the factual basis for the “siloed databases” claim — contemporaneous reporting, not a current agency disclosure.

The relationship did not stay smooth. In 2017 BuzzFeed News published an internal 2015 video in which Karp, using an internal code name for the CIA, said the agency was “recalcitrant” and “may not like us,” and that Palantir’s relationship with the NSA had ended. The CIA and NSA declined to comment. It does not prove the CIA stopped using the software; it does prove that “the CIA uses Palantir” cannot be treated as a simple, continuous fact.

Maven Smart System is a different line of work. Project Maven began at the Pentagon in 2017 to apply computer vision to drone and other imagery; Google was an early partner and withdrew in 2018. Palantir became the primary industry partner for the software layer that became Maven Smart System. In May 2024 the Defense Department awarded Palantir a five-year, $480 million contract to scale it; in March 2026 Deputy Defense Secretary Steve Feinberg directed that Maven Smart System become a program of record. In September 2026 senior Pentagon research official James Mazol said users had risen from about 50,000 in January to more than 100,000. That is Defense Department infrastructure, not a CIA program.

Why it matters in the building

For a CEO, general counsel, or agency head, the distinction is not semantic. An early In-Q-Tel stake and a documented CIA customer relationship created a durable national-security brand. That brand now sits on a public company, ticker PLTR, whose government segment produced $2.40 billion of revenue in 2025 — 54 percent of total revenue, according to Palantir’s 2025 annual report. Boards that buy, ban, or partner with Palantir are buying into that history whether or not they ever touch an intelligence system.

For intelligence and defense officials, the operational stake is data fusion under existing authorities. Palantir’s public position is that it does not collect data, does not broker data, and does not run surveillance. In a 2025 FAQ the company said: “We do not conduct surveillance, we do not provide surveillance services, nor do we sell our software for the purpose of enabling unlawful surveillance,” and that customers use the software on “data to which they have lawful access.” If that is accurate, liability for collection, querying, and targeting stays with the agency that holds the data and the authority behind it. If it is incomplete, that gap is not visible in public filings.

For procurement and CISO staff, vendor concentration is the live issue. Maven Smart System is being locked in as a Pentagon program of record; Gotham and Foundry sit inside other civilian and national-security agencies. That does not make Palantir the CIA’s operating system. It does make Palantir a single commercial point of failure, upgrade cadence, and political exposure across several missions.

Reputation risk travels with the same facts. Civil-liberties groups and some members of Congress have treated Palantir as a whole-of-government surveillance vendor. Palantir has denied building a “master database” of Americans. Those denials are company statements — not independently audited public inventories of every federal deployment.

Who holds the pen

Inside the Intelligence Community, operational use of any Palantir instance is owned by the agency that licensed it and by the analysts and targeting officers who query it. The CIA director and the relevant deputy directors own any current CIA deployment. In-Q-Tel’s CEO, Steve Bowsher, owns investment strategy, not agency operations. The CIA page that describes In-Q-Tel does not list Palantir or any other portfolio company by name.

Inside the Defense Department, Maven Smart System oversight has been moving from the National Geospatial-Intelligence Agency toward the Chief Digital and Artificial Intelligence Office under the Feinberg directive. Combatant commanders own employment of the system in theater; Palantir owns software delivery; humans, Palantir and Pentagon officials have said, remain responsible for engagement decisions.

Inside a public company or regulated institution that uses Foundry or AIP, the general counsel, CISO, and chief data officer own the data-use policy — Palantir does not. The vendor relationship does not transfer legal authority to query personnel files, financial records, or travel data. Congress holds the purse and the oversight calendar; intelligence-authorization and defense-appropriations language, plus inspector-general reviews, are the public levers. No open docket lists current CIA-Palantir task orders.

What is settled versus what is still open?

The public record is unusually clear about the origin story and unusually silent about present-day CIA use. The split matters for anyone deciding what they can safely assert.

What should an organization review before repeating the claim?

Six concrete checks, aimed at counsel, the CIO/CISO, procurement, and board communications. Each maps a marketing shorthand back to a document or an authority.

Where is the real risk and exposure?

Legal. Use of fusion software does not create collection authority, but it can expand the practical reach of authority that already exists. That is a counsel issue, not a vendor-brochure issue. Classified use, if it exists, cannot be diligence-checked from open sources.

Financial. Government revenue is material to Palantir. A shift in Intelligence Community or Defense Department preference would show up in the government segment, which was $2.40 billion in 2025. Counterparties that treat Palantir as indispensable should price concentration risk.

Operational. Data-integration platforms fail as policy instruments when the underlying sources are incomplete, stale, or wrongly permissioned. The 2009 Journal account of unlinked databases described a real problem; it did not prove the problem was solved for all time.

Political. The In-Q-Tel origin is public and will be restated in every controversy — so will ICE, Maven, and foreign-military work. Those are separate programs. Collapsing them into one “CIA tracking” sentence is the error this brief exists to prevent.