The questions the new company vying for border dominance in the US needs to answer

Screen-capture from the website OpenSecrets.org showing Anduril's increased spending on lobbying efforts.

While a recent poll suggests that the majority of Americans do not support substantially expanding the border wall, Anduril has been scolding the US defence industry over its preference of giving monolithic defence contractors, rather than tech start-ups, multi-million dollar contracts to develop tech used by the US government.

But earlier this month, the Washington Post reported that Anduril Industries has landed a contract with US Customs and Border Protection (CBP) to expand its digital border security system in California.

Anduril’s ‘solution’ for border security in the US is based on drones, sensors, AI, and machine vision. At present, the public remains in the dark about how such a border security system will operate in practice. Given the intrusiveness of Anduril’s system, Privacy International has written to Anduril and asked the company to provide basic information about how the system works. The system appears to have the potential to affect those entering or exiting the US, those who approach the border, as well as those who happen to live next to Anduril’s border infrastructure.

Questions

Anduril’s Lattice system is apparently able to detect movement, automatically decipher if the movement is an animal or person, and alert border agents to investigate. There are some basic questions that Anduril should provide clarity to:

• Where does the border begin from CBP’s perspective? Exactly on the border line? Or 10 miles from the border? 20 miles? Will sensors and other technology be deployed to cover this entire distance?
• What kind of data is collected by the Lattice platform? Are unique cell phone ID numbers – such as IMSI and IMEI data – of those at or near the border collected? Is cell phone metadata – like who called who, when, and where –  of those at or near the border collected? And will cell phone location data be swept up and monitored?
• Does the platform use interception of any kind? (e.g., via IMSI catchers)
• Is facial recognition software used in Anduril’s cameras?
• Will live video feeds be made available to Anduril or immigration authorities?
• At what point are humans involved? What if the system makes a mistake but the agency using the software is unable to query or probe the system – due either to opacity in the technology or trade secrets claims by Anduril?
• Who is given access to this data? The US government, like many other governments, shares data internally between departments and externally with foreign partners. Will the data be shared, for example, with US Immigration and Customs Enforcement?
• How long will the data be stored by Anduril?

Concerns

CBP has in recent years been the subject of repeated scandals about the treatment of immigrants, including the deaths of immigrant children in custody, as well as abuse of power. In late 2018, 7-year old Jakelin Caal Maquin and 8-year old Felipe Gómez Alonzo both died in the custody of CBP. At the time, the CBP was asked how many children it had in its custody and could not immediately provide an answer.

Last year, records obtained by the Project On Government Oversight revealed that 127 CBP officers had been arrested or charged with corruption-related crimes – such as embezzlement, human smuggling, bribery, money laundering, and others – since 2004.

Any agency that has the power to detain and deport people must be accountable and transparent. That CBP, as well as other immigration and government agencies, are increasingly doing business with companies is concerning because unlike government agencies, which have requirements to answer to the people they serve, companies do not. Companies aim to maximise their bottom-lines and knock out competitors. For these reasons, tech companies tend to keep their systems completely opaque, including due to trade secret concerns. Anduril has little incentive to make its tech transparent, which makes it exceedingly difficult to even begin a public discussion around CBP’s use of Lattice and similar tech.

It’s also important to understand the culture of a company working with such powerful government agencies. Anduril Industries was co-founded by Palmer Luckey in 2017. Seven men comprise the leadership of Anduril, four of whom came to Anduril after working at Palantir. The company has received over $58 million in venture funding, including from one of Peter Thiel’s venture companies Founder’s Fund, where Anduril co-founder Trae Stephens is a partner.

Palmer Luckey is a prominent figure in the world of virtual reality. He founded Oculus VR in 2012 and later sold the company to Facebook. He remained involved with Oculus until 2017 when he was apparently booted from Facebook and cut off from further involvement with Oculus. There has been speculation that the boot came after it was revealed that Luckey had given large sums of money to an anti-Hilary Clinton PAC that spread memes mocking her. There has also been speculation that the boot also came after Oculus lost an intellectual property case brought by ZeniMax. ZeniMax argued that Oculus had stolen ZeniMax intellectual property that was fundamental to the later commercial success of the company. Oculus lost nearly $500 million in the case.

Screen-capture of ZeniMax lawsuit against Oculus.

Heading Anduril’s Corporate and Government Affairs is Matthew Steckman. While he was at Palantir, Steckman played a role in a 2011 smear campaign against progressive groups and labour unions including, among others, Change to Win, US Chamber Watch, and ThinkProgress. Emails show that Steckman was aware and engaged in the campaign. After the emails were published, Palantir tried to distance itself from the scandal. However when emails surfaced showing Steckman’s involvement, Palantir took the decision to put him on leave pending a thorough review of his actions. Palantir tried to paint Steckman as a rogue employee that had taken action without the approval of the company, but this claim was discredited when further emails showed that at least two further Palantir employees were sent details of the plan.

Screen-capture from Salon story reporting on Steckman's involvement in the smear campaign.

Anduril is largely made up of former Palantir employees – in addition to Matthew Steckman, co-founder Trae Stephens, Chief Operating Officer Matthew Grimm, and CEO Brian Schimpf were all formerly with Palantir. Palantir has been embroiled in numerous scandals, such as being sued over accusations of fraud and industrial espionage, being central to the Trump administration’s “deportation machine”, and allegedly discriminating against Asian applicants.

What now?

Companies that have chosen to work closely with the US military or other government agencies are being forced to question those choices. Some have pulled away from working on controversial programs, such as analysing drone images.

Anduril, however, has taken the opposite approach, proudly boasting about its work with the US government's intelligence and security agencies. Some Anduril men have even spoken about their fear that if the US doesn’t provide this tech, other countries like China and Russia will fill the void, which conveniently sidesteps addressing the issue at hand – do Silicon Valley tech companies want to abandon their mantra of making the world better, to focus instead on the simple aim of beating an adversary? The leadership of Anduril seems to have taken an “if you’re not with us you’re against us” mentality towards those companies that examine their relationships with the US government's intelligence and security agencies. Reality is far more complex.

Anduril is vying to sell its system to other powerful agencies whose activities impact fundamental rights and can imperil lives. At the moment, Anduril’s Lattice is being tested by police and border agencies, as well as the US Marines. Late last year it was announced that the Former Senate Armed Services Committee staff director Christian Brose was set to become the head of strategy at Anduril.

Companies such as Anduril, which are vying to work hand and glove with powerful government agencies, while remaining completely opaque, must answer questions about how their technology works. The public should be given the opportunity to understand and scrutinise the technologies that their governments purchase and deploy.

Privacy International has written to Anduril Industries' CEO Brian Schimpf asking the above questions. UPDATE 15/03/19 We have uploaded Anduril's reponse to our questions.