Here is a term you have never used at a dinner party and will now never forget: UEBA. User and Entity Behavior Analytics. Born in a Gartner white paper in 2015, raised in corporate security operations centers, and now, a decade later, quietly running the plumbing of the American surveillance state. It is not a household name. It was never meant to be. The most consequential infrastructure rarely announces itself. It just watches, baselines, flags, and waits.
UEBA's original job was modest: sit inside a corporate network, learn what "normal" looks like for every employee, server, and router, then scream when something deviates. A salesperson who never touches the finance server suddenly downloads four hundred client files at 2 a.m. — that's a flag. A dormant service account starts pinging systems across three continents — that's a flag. It was insider-threat detection, dressed up in machine learning, sold to banks and hospitals as digital hygiene.
Somewhere between the Snowden files and the second Trump term, that modest tool became something else entirely: the behavioral chassis underneath a government-wide effort to know, in something close to real time, what every American is doing. Not because a single villain willed it. Because the incentives of three industries — defense contracting, cloud computing, and Wall Street asset management — pointed the same direction for twenty straight years, through Republican and Democratic administrations alike, and nobody with the power to stop it particularly wanted to.
The infrastructure doesn't care which party is holding the leash. It only cares who's paying for the leash.
Built With CIA Seed Money, Sold as Silicon Valley Genius
Start where the money started: 2004, a converted apartment in Palo Alto, and a data-mining startup called Palantir Technologies, founded by PayPal alum Peter Thiel, Stanford Law classmate Alex Karp, and engineers Stephen Cohen and Joe Lonsdale. Silicon Valley's venture class took one look and passed. Sequoia's Michael Moritz reportedly doodled through the entire pitch meeting. Kleiner Perkins gave the founders a ninety-minute lecture on why they'd fail.
The people who did not pass were at In-Q-Tel, the CIA's in-house venture capital arm, chartered in 1999 by then-Director George Tenet specifically to close the gap between Langley and Silicon Valley. In-Q-Tel put in roughly two million dollars across several rounds — a rounding error next to Thiel's own investment, but a credibility injection worth far more than the cash. It bought Palantir something venture capital couldn't: access. CIA analysts became beta testers. Palantir engineers were embedded directly inside the agency to watch how spies actually worked.
By the time Edward Snowden's documents surfaced in 2013, reporting by The Intercept showed Palantir's software wasn't merely funded by the intelligence community — it had been built in what internal documents called "iterative collaboration" with analysts across multiple agencies over nearly three years, wired directly into Five Eyes and GCHQ data streams. The company that would eventually IPO at a valuation north of fifty billion dollars was not, in any meaningful sense, a garage startup that happened to land government clients. It was intelligence-community infrastructure that went public.
Call it what it is: a surveillance company that spent two decades laundering its origin story through the language of disruption.
Palantir was never operating alone in that ecosystem, either. The same 2013 Snowden disclosures that exposed Palantir's Five Eyes plumbing also revealed PRISM — the NSA program that, per slides published by The Washington Post and The Guardian, drew data directly from the servers of Microsoft (added in 2007), Yahoo (2008), Google (2009), Facebook (2009), YouTube (2010), AOL (2011), Skype (2011), and Apple (2012). The Foreign Intelligence Surveillance Court found PRISM accounted for the overwhelming majority of internet communications collected under Section 702 authority. None of the companies named in that program built their surveillance capacity for the government; the government simply arrived with a court order and a straw, once the capacity already existed. Sergey Brin's Google joined the list in 2009, under Obama, six years before Gartner had even coined the term UEBA. The behavioral infrastructure predates the acronym. The acronym just gave a name to what security researchers were already doing.
Gotham, Palantir's flagship intelligence product, was never subtle about its ambitions. It ingests structured data — spreadsheets, databases, financial records — and unstructured data — images, documents, chatter — into one searchable environment where an analyst can trace a thread from a bank transaction to a phone number to a face in a photograph. It was named, unblushingly, after the seeing-stones in Tolkien's Middle Earth that a certain Dark Lord used to surveil his enemies across the map. Nobody at Palantir seems to have found that branding choice ironic. Or maybe that's precisely the point — a certain species of tech founder finds it delicious to name the panopticon after the thing that inspired nightmares in you as a child, and dare you to say something.
The Office Panopticon Went National
Before UEBA became a government story, it was a human-resources story, and that lineage matters more than the trade press ever admits. The same behavioral-baseline logic that now flags an ICE target was pioneered, funded, and normalized inside corporate IT departments watching their own employees. Vendors like Exabeam, Splunk, and Vectra built substantial businesses selling companies the ability to know, statistically, what "normal Steve from accounting" looks like — what files he touches, what hours he logs in, which printer he uses — so that any deviation, malicious or not, would trip an alarm.
That is the quiet genius, and the quiet menace, of the UEBA model: it was never marketed as surveillance. It was marketed as "insider threat detection" and "zero trust security," language calibrated to sound protective rather than invasive. Nobody objects to a bank protecting its systems from a rogue employee. Fewer people notice when the exact same mathematics — the same baselines, the same anomaly thresholds, the same risk scores — gets exported wholesale from the employee badge system to the immigration file, the tax return, and the license-plate reader. The pitch decks barely need editing. Swap "employee" for "citizen" and "insider threat" for "flight risk," and the software runs unchanged.
Corporate America spent a decade training the public to accept behavioral monitoring as basic hygiene. The state simply inherited a population that had already stopped flinching.
Obama Bought It, Biden Kept It, Trump Weaponized It
Here is the inconvenient part for anyone hoping this is a simple story about one bad administration: Palantir's government book has been building since the Bush years and never stopped, under presidents of both parties. The Department of Defense, the CIA, DHS, the NSA, the FBI, and local departments from the LAPD to the NYPD have all been Gotham customers at one point or another. Under Obama, Palantir tools were used for drone targeting support and counter-IED work in Afghanistan, and ICE — yes, that ICE — signed its first Palantir contracts back in 2011, deep inside the Obama presidency, well before deportation enforcement became a nightly cable-news set piece. Under Biden, those contracts didn't shrink. They renewed.
What changed under the second Trump administration wasn't the existence of the infrastructure. It was the willingness to fuse it across agencies that had, by law and by design, been kept apart.
In April 2025, ICE handed Palantir a thirty-million-dollar contract to build "ImmigrationOS" — a platform explicitly designed, per the contract justification, to speed the identification and apprehension of removal targets, track self-deportations in near-real time, and streamline deportation logistics. Reporting from Wired and 404 Media detailed a companion tool, reportedly called "ELITE," that ICE has used to identify entire neighborhoods for raids based on aggregated data patterns — a UEBA logic applied not to a corporate network, but to a zip code.
Around the same time, the newly created Department of Government Efficiency — Elon Musk's short-lived cost-cutting initiative — began what multiple outlets, including Wired, FedScoop, and Democracy Now!, described as a "hackathon" inside the IRS: an effort to build a "mega API" that would let authorized users query IRS, DHS, and Social Security data from a single interface. The Social Security Administration's own chief data officer, Chuck Borges, resigned in August 2025, alleging that data belonging to more than three hundred million Americans had been copied onto unsecured cloud infrastructure during the process.
The Privacy Act of 1974 built information silos between federal agencies on purpose. It was Congress's direct response to Nixon weaponizing the IRS against his enemies. The silos were never a bug. They were the last wall.
To be fair to the record — and a credible piece has to be fair, even when the facts are ugly — Palantir itself has disputed the more sweeping "master database" framing. Fact-checkers at Snopes found no direct evidence that Palantir was single-handedly compiling one unified file on every citizen; rather, the company holds separate Foundry contracts across Defense, Health and Human Services, and DHS, with talks reportedly underway for Social Security and Education. That distinction — separate contracts creating interoperable access, versus one physical database — matters legally and matters for anyone trying to report this accurately. It also, in practice, may not matter much to the person whose IRS address just became visible to an ICE analyst. Interoperability was always the goal. Whether it lives in one server or fifty doesn't change what it can find.
The Salesman's Vision: Larry Ellison and the Behaved Citizen
If Thiel built the plumbing quietly, Oracle's Larry Ellison said the quiet part into a live microphone. At Oracle's September 2024 financial analyst meeting, the company's founder and CTO — by then one of the two or three richest men alive — laid out an unblinking vision of an AI-supervised society. Body cameras that never switch off. Drones instead of car chases. Satellite feeds cross-referenced against police behavior and civilian behavior alike, all of it fed into models that flag deviation the instant it happens.
"We're going to have supervision," Ellison told the assembled analysts. "Every police officer is going to be supervised at all times, and if there's a problem, AI will report that problem." And then, almost as an afterthought, the sentence that should be etched somewhere: "Citizens will be on their best behavior because we are constantly recording and reporting everything that's going on."
That is not a warning. That is a pitch deck. Ellison wasn't describing a dystopia — he was describing Oracle's total addressable market.
Read the UEBA logic straight through Ellison's comment and the architecture snaps into focus: a baseline of "normal" citizen behavior, continuously updated, continuously scored, with deviation itself treated as the signal worth investigating. It is the exact same model that flags the rogue employee downloading files at 2 a.m., scaled up from a corporate network of forty thousand employees to a nation of three hundred and forty million residents. Oracle, notably, is now positioned to be a central infrastructure partner in the U.S. handling of TikTok's algorithm — placing the company that dreams openly of a fully surveilled citizenry inside the machinery of one of the most-used communication platforms in the country.
Who Pays the Electric Bill for the Panopticon
None of this runs on vibes. It runs on data centers, and data centers run on capital most governments don't have lying around — which is where the third leg of this story shows up, and it isn't an intelligence agency at all. It's asset management.
In September 2024, BlackRock — under chairman and CEO Larry Fink — launched the Global AI Infrastructure Investment Partnership alongside Microsoft, Global Infrastructure Partners, and the Abu Dhabi-backed investment firm MGX, with an initial target of thirty billion dollars in equity and up to a hundred billion once debt financing is layered in. Nvidia and Elon Musk's xAI joined months later. By early 2026, Fink told investors the partnership — renamed simply the AI Infrastructure Partnership — had raised over twelve and a half billion dollars and was still climbing.
Somewhere between an ICE server farm and your quarterly 401(k) statement, there is a straight, unbroken line, and Larry Fink drew part of it.
This is the piece of the UEBA story that rarely makes the alt-press cut, because it isn't cinematic. Nobody is smuggling anything. There's no black site. It's a press release with a photo of executives shaking hands in Abu Dhabi. But it is, in its bloodless way, the most important fact in the entire architecture: the compute layer beneath every behavioral model — corporate, governmental, or otherwise — is being built and owned by the same handful of asset managers, cloud vendors, and sovereign wealth funds, regardless of which agency or which administration ends up renting time on it. The infrastructure is agnostic. It will happily supervise a police officer, an immigrant, a protester, or a corporate whistleblower, provided somebody with a procurement budget signs the invoice.
One Founder, a Dozen Companies, a Single Worldview
It's worth pausing on how small the founding circle actually is, because concentration matters as much as capability. Thiel didn't stop at Palantir. His venture firm, Founders Fund, seeded Anduril Industries — the defense-hardware company founded by Palmer Luckey, a Thiel mentee, and staffed heavily with Palantir and Founders Fund alumni. Thiel was also an early outside investor in Clearview AI, the facial-recognition firm whose technology now shows up in ICE's own procurement records alongside Palantir's. Trade press has taken to calling the resulting network the "Palantir Mafia," an echo of the PayPal Mafia that made Thiel rich the first time — former employees fanning out to found or fund an entire generation of defense-adjacent startups, many with the same Tolkien-inflected branding instinct that named Gotham after Sauron's spy-orb.
This is not a conspiracy in the sense of secret coordination; it's simpler and, in a way, more damning than that. It's a small, self-referential network of people who worked together, share an ideology about the fusion of Silicon Valley speed and state power, and keep re-investing in each other's next venture. When Congress asks Palantir pointed questions about civil liberties — and members of both parties, from Senator Ron Wyden to Representative Alexandria Ocasio-Cortez, have — they are, in practice, asking a company whose alumni network is quietly seeding half the surveillance-adjacent startups that will replace it in a decade. Regulate one company in this space and two more, staffed by its own former employees, are already raising a Series A.
You don't need a smoke-filled room when the org chart already does the coordinating for you.
Multinationals as the New Punitive Class
Here is the thesis, stated plainly, because a reader who's made it this far deserves plain language instead of another rhetorical flourish: the punitive function of the state — the part that watches, flags, and punishes deviation — has been substantially outsourced to multinational technology corporations, and it happened with almost no public debate, because it happened gradually, through procurement contracts rather than legislation.
Congress didn't vote to let Palantir see IRS address data. An interagency data-sharing agreement did that, and it triggered enough alarm that senior IRS officials resigned rather than sign off. Congress didn't vote to let a private facial-recognition contractor sell three-quarters of a million dollars in scanning technology to ICE. A budget line did that. The people building the actual decision architecture — the risk scores, the anomaly thresholds, the "baseline" of acceptable behavior against which every citizen is now silently measured — are not elected, not confirmed by the Senate, and in most cases not even named in the contracts their own lobbyists helped write.
We used to worry about Big Brother. Nobody warned us Big Brother would be a vendor with a quarterly earnings call.
This is why the partisan framing that dominates cable news misses so much of what's actually happening. It is tempting, and not entirely wrong, to note that ICE's ImmigrationOS budget belongs to the current administration. It is equally true that the underlying Palantir relationship with ICE predates it by more than a decade, and that Google — Sergey Brin's company — turned up in the very first tranche of documents Snowden leaked in 2013, described as a participant in the NSA's PRISM data-collection program, under an administration of the opposite party. The behavioral-surveillance infrastructure is not a Republican project wearing a MAGA hat or a Democratic project wearing a rainbow pin. It is bipartisan by default, because building it has never required either party's voters to notice it was happening.
What We Actually Don't Know
Intellectual honesty requires a pause here, because altnews has earned its bad reputation partly by refusing to admit the edges of its own knowledge. We do not have documented evidence of a single unified "master file" containing every American's tax, medical, immigration, and biometric data in one queryable record — Snopes is right about that, and a careful reporter says so. What we do have is a documented trend line: agencies that were statutorily separated for fifty years are being technically bridged, contract by contract, API by API, with Palantir's Foundry and Gotham platforms showing up as the connective tissue in DHS, HHS, Defense, the IRS, and soon possibly Social Security and Education. Whether that constitutes a "database" in the narrow sense matters far less than whether it constitutes access — and on access, the reporting from Wired, the Fortune, and congressional oversight letters from both Senator Wyden's and Representative Connolly's offices is not in serious dispute.
We also don't know, with certainty, how the behavioral risk-scoring inside these systems is weighted, what triggers a human review versus an automated flag, or what recourse — if any — exists for a citizen incorrectly flagged by a model trained on historically biased policing data. Palantir maintains it employs "privacy and civil liberties engineers." Company co-founder Alex Karp has, at various points, positioned himself as an internal check on his own product's worst impulses. Readers can weigh how much comfort that offers against a thirty-million-dollar deportation-tracking contract and decide for themselves.
The Baseline Is Watching You Establish It
There is a particular cruelty embedded in UEBA logic that's worth sitting with before you close this article: the system doesn't need to know anything is wrong with you. It only needs to know what "you, doing nothing unusual" looks like — and then it waits for the day you deviate, for any reason, good or bad, voluntary or not. Lose your job and your spending pattern changes. Visit a sick parent and your location data spikes somewhere new. Attend one protest and your movement pattern breaks baseline for the first time in three years.
None of that is a crime. All of it is a flag.
A surveillance state doesn't have to arrest you to control you. It just has to make sure you know it's watching for the deviation — and let your own good behavior do the rest of the work.
Larry Ellison said that part out loud. He wasn't threatening anyone. He was closing a sale.
###
User and Entity Behavior Analytics (UEBA): The Watching Machine