PALANTIR: War, Surveillance, Artificial Intelligence

Part 5: Controversy and Regulation, The Shadow of the Surveillance State

Chapter 10. Legal Checks and Europe's Counterattack

Attorney Kyungjin Kim

A. The German Federal Constitutional Court's Unconstitutionality Ruling (February 2023)

(1) The Ruling Declaring Palantir Use by Hesse and Hamburg State Police Unconstitutional

On the morning of February 16, 2023, a ruling was read aloud in the chambers of the German Federal Constitutional Court in Karlsruhe. Presiding Judge Stephan Harbarth spoke in a calm but firm voice: "Section 25a, paragraph 1 of the Hesse Public Safety and Order Act, and Section 49, paragraph 1 of the Hamburg Police Data Processing Act, are unconstitutional."

The eleven plaintiffs gathered in the courtroom held their breath. With the help of the civil liberties organization Gesellschaft für Freiheitsrechte (GFF), they had carried on this fight for six years. The target was software developed by Palantir, a data analytics company from Silicon Valley.

The Hesse state police had been operating Palantir's Gotham platform under the name "hessenDATA" since 2017. Some 2,000 police officers had access to the system. The official purpose was terrorism and organized crime investigations. But reality was different. Its use rapidly expanded to include residential burglaries, ATM bombings, and traffic accident witness tracking. According to Hesse Ministry of Interior data, police used the software thousands of times per year.

Hamburg had not yet activated the system. It had only established the legal basis and was preparing for deployment. The Constitutional Court ruled on both states' statutory provisions.

The core of the ruling was clear. The court held that automated data analysis violated the "right to informational self-determination" guaranteed by Articles 2(1) and 1(1) of the Basic Law. The ruling stated: "Particularly in light of the broadly defined text of the authorization, the basis for interference, with regard to both data and methods, falls far short of the constitutionally required threshold of identifiable danger."

Put simply, this means: for police to analyze citizens' data with Palantir software, a specific and clear danger must exist. A vague notion of crime prevention is insufficient. The abstract goal of preventing terrorism cannot serve as a legitimate basis for violating individual privacy.

The court ordered Hesse to amend its law by September 30, 2023. In Hamburg's case, since the law had not yet been implemented, it was immediately invalidated.

(2) Violation of the 'Right to Informational Self-Determination'

The "right to informational self-determination" invoked by the German Federal Constitutional Court is a landmark concept in German constitutional history.

In 1983, the Constitutional Court issued the Census Judgment (Volkszählungsurteil). At the time, the German government was planning a detailed census. Citizens objected. In this case, the court derived a new fundamental right: every individual has the right to determine who uses information about them, for what purpose, and in what manner.

The birth of this right was rooted in Germany's dark history. The Nazi Gestapo collected and categorized citizens' information to identify Jews, homosexuals, and political opponents. After the war, East Germany's Ministry for State Security, the Stasi, built an even more sophisticated surveillance apparatus. By some estimates, out of East Germany's population of 16 million, approximately one million served as the Stasi's informal collaborators. It was a society where neighbors spied on neighbors and family members informed on family members.

In the 2023 ruling, the court recalled this historical context. The ruling explained that automated data analysis constitutes a qualitatively different new form of interference compared to traditional data collection. Connecting individually collected pieces of information generates "new knowledge." Combining police records, communications metadata, social media activity, and vehicle location data can reconstruct an individual's behavioral patterns, social network, and movement history. This goes beyond the original purpose of information collection.

The court emphasized the principle of purpose limitation and the principle of proportionality. Data collected for a specific purpose must be used only for that purpose. Using it for other purposes requires a separate legitimate basis. also, government interference must be proportionate to the objective pursued. Extensive surveillance cannot be permitted to prevent minor crimes.

(3) Warning About "Profiling with a Single Click"

Franziska Görlitz, a lawyer with the GFF, spoke at a press conference immediately after the ruling: "A person who filed a complaint, a crime victim, or someone who was simply in the wrong place at the wrong time can all become subjects of this software's analysis."

Her statement was no exaggeration. According to internal documents from the Hesse state police, hessenDATA could integrate police records systems, criminal investigation databases, communications metadata, and social media information. In December 2022, Hesse Interior Minister Peter Beuth told the state parliament that the software had been used in the investigation of the far-right underground organization "Reichsbürger," which had plotted to overthrow the German government.

Constanze Kurz, a spokesperson for the Chaos Computer Club (CCC), was more biting: "This is Palantir-style dragnet investigation. Police are combining different datasets for purposes other than the original ones. Automated mass analysis must not become routine in law enforcement."

The core of the problem was the opacity of the algorithms. Palantir's software is written in proprietary code. Neither outside experts nor the agencies using the system fully understand how the algorithms create their connections. In 2023, the state of Bavaria commissioned the Fraunhofer Institute for Secure Information Technology to review the source code. The institute concluded there were no "secret backdoors." However, this evaluation report was classified as confidential, citing "security concerns" and "Palantir trade secrets."

The ruling pinpointed this issue precisely. "The fact that unlimited data analysis technology is not currently available does not resolve the problem. Constitutional requirements must be based on the legally possible scope of interference." As technology advances, more extensive analysis becomes possible. If the legal scope of permission is broadly set, surveillance can expand to fill that scope.

(4) The Order to Amend Hesse's Law by September 2023 and the Invalidation of Hamburg's Law

After announcing the ruling, Presiding Judge Harbarth emphasized one point to reporters: "Each state retains the option of constitutionally shaping the legal basis for further processing of stored data files."

This statement was double-edged. The Constitutional Court did not ban Palantir software itself. It determined that the laws supporting its use did not meet constitutional requirements. This also meant that continued use was possible if laws specifying stricter conditions were enacted.

Hesse amended its law by the deadline. The new law specified the requirements for data analysis. But critics argued the amendment was insufficient. As of 2025, the GFF has filed a new lawsuit before the Hesse State Constitutional Court.

Hamburg chose a different path. After its law was invalidated, it did not pursue new legislation. Fundamental skepticism toward Palantir adoption had emerged within the Hamburg state parliament.

The ruling's aftershocks spread throughout Germany. Police in Bavaria and North Rhine-Westphalia were also using Palantir software under the names VeRA and DAR, respectively. The GFF and the Chaos Computer Club filed constitutional complaints against these two states as well. The lawsuit against Bavaria is pending before the Federal Constitutional Court as of 2025.

B. GDPR and the Era of Data Sovereignty

(1) Setbacks and Recalibration of the European Expansion Strategy

Alex Karp took the stage at a corporate investment conference in February 2024. It was the FII Institute event in Miami. In his characteristically rapid-fire speaking style, he appealed to the audience.

"We stopped countless terror attacks in Europe. And frankly, if those things hadn't been stopped, you'd be looking at a very different political reality in the West right now. It's the truth." He paused briefly, then added: "I love that I get yelled at in European cities. Keep yelling. The only reason nobody in between me and you is doing the goose step is our products. Say thank you."

The goose step. It was a reference to the marching style of 20th-century German and Italian fascists. Karp was claiming that Palantir had saved Europe from a revival of fascism.

This remark caused a major stir in Germany. It starkly revealed the barriers Palantir's European expansion strategy faced. Ironically, the very history Palantir claimed to have prevented became the source of resistance against Palantir's adoption.

Distrust of state surveillance runs deep in Germany. The experiences of the Nazi Gestapo and the East German Stasi remain as collective trauma. This history was what GFF lawyers repeatedly invoked in their constitutional complaints.

The European Union's General Data Protection Regulation (GDPR) was born out of this historical context. Enacted in 2018, GDPR is regarded as the world's strictest personal data protection framework. It has several core principles. Data minimization: only the minimum data necessary to achieve the purpose may be collected. Purpose limitation: data cannot be used for purposes beyond the original collection purpose. Right to be forgotten: individuals can request the deletion of their data.

Palantir's business model conflicts with these principles. The essence of Palantir software is to integrate and connect data from diverse sources to discover new patterns. It does not minimize data; it maximizes it. It uses data for purposes beyond the original collection intent.

The European Court of Justice's 2020 Schrems II ruling made the situation even more complicated. The court determined that U.S. surveillance laws, particularly Section 702 of the Foreign Intelligence Surveillance Act (FISA), did not adequately protect EU citizens' personal data. The EU-U.S. Privacy Shield agreement was invalidated. Transferring EU citizens' data to U.S. companies itself became a legal problem.

(2) The Polizei 20/20 Project and the Merz Government's Re-Push

Palantir's European strategy has not experienced only setbacks. Attempts to turn crisis into opportunity are underway.

The structural characteristics of Germany's police system provide the backdrop. Germany is a federal state composed of 16 Länder (states). Police forces belong to each state government. At the federal level, there is the Federal Criminal Police Office (BKA) and the Federal Police, but day-to-day policing is handled by state police. The problem is that each state police force's IT systems are different. Information collected in one state is not shared with others. Federal-level databases and state-level databases are not connected.

In 2019, the federal and state governments launched a project called "Polizei 20/20" to solve this problem. A budget of 300 million euros was allocated. The goal was to integrate the decentralized police databases of the 16 states.

Conservative politicians advocated introducing Palantir software to this project. Friedrich Merz and Alexander Dobrindt of the CDU/CSU were prominent voices. They emphasized that Palantir had already been proven in intelligence agencies and militaries around the world.

In 2023, then-Interior Minister Nancy Faeser of the Social Democratic Party blocked this plan. She prevented the Federal Criminal Police Office, the Federal Police, and the Customs Investigation Office from using Palantir software. The decision came shortly after the Federal Constitutional Court ruling.

But the situation changed when the CDU/CSU won the early 2025 general election. A new coalition government led by Chancellor Merz was formed. The Interior Ministry portfolio went to the CSU's Dobrindt, a longtime supporter of Palantir adoption.

In March 2025, the Bundesrat (upper house) passed a resolution calling for the rapid introduction of a joint "automated data analysis platform" for federal and state police. The resolution did not explicitly mention Palantir. However, under the framework agreement Bavaria had already signed with Palantir, other states and the federal government could join without a new procurement process.

Not all states agreed. According to an investigation by Bayerischer Rundfunk (BR), Hamburg and Mecklenburg-Western Pomerania explicitly demanded a European alternative that would "exclude the use of products from the market-dominant American supplier Palantir." Bremen, Lower Saxony, Saarland, Schleswig-Holstein, and Thuringia supported this position. But the motion failed to secure the required majority in the Bundesrat.

(3) The Dilemma of Digital Sovereignty

One of the reasons several state governments oppose Palantir is the issue of "digital sovereignty."

Peter Thiel, Palantir's co-founder and chairman of the board, is a prominent supporter and political donor of President Donald Trump and Vice President JD Vance. At least ten officials in the current Trump administration are reportedly holders of Palantir stock. In April 2025, Palantir signed a $30 million contract with U.S. Immigration and Customs Enforcement (ICE). The contract was to develop an operating system called "ImmigrationOS" for identifying undocumented immigrants and tracking voluntary departures.

Social Democrat parliamentarian Johannes Schätzl told German newsweekly Stern: "Palantir is not a neutral IT service provider. It is a company with deep connections to U.S. intelligence agencies that pursues clear geopolitical interests."

There are also legal problems. The U.S. CLOUD Act, enacted in 2018, allows U.S. authorities to compel U.S. companies to produce data stored anywhere in the world. In theory, even if Palantir software processes only German citizens' data on German police servers, the possibility that the U.S. government could demand access cannot be entirely ruled out.

Palantir dismisses these concerns. Jan Hiesserich, Senior Vice President of European Strategy, told German business newspaper Handelsblatt: "Palantir brings software, not data. Which data is relevant to an investigation is determined solely by the customer in accordance with the relevant regulations."

Palantir works with Deutsche Telekom subsidiary T-Systems in Germany. The software runs on police-owned servers. The official position is that no data is transferred to the United States.

But critics argue this is not enough. Green Party federal parliamentarian Konstantin von Notz said: "A nationwide rollout should be off the table, especially in an era where the U.S. government is becoming increasingly unreliable."

The new coalition's agreement contains an interesting phrase: "Digital policy is power politics." A goal of reducing dependence on foreign technology is also stated. But at the same time, they are re-pushing Palantir adoption. It is a contradiction to emphasize digital sovereignty while introducing American surveillance software.

C. The Crisis of Democratic Control

(1) When an Unelected Technology Company Takes Over Core State Functions

At the end of July 2025, the Baden-Württemberg state parliament passed legislation authorizing the use of Palantir Gotham software. It was a Green-CDU coalition. Even the environmental party, the Greens, did not oppose it.

According to reports, Baden-Württemberg had already signed a 25-million-euro contract with Palantir in March 2025. This was before the legal basis had been established. The order was reversed. Contract first, law second. The inertia of technology adoption outpaced democratic deliberation.

This is the "vendor lock-in" phenomenon critics warn about. Once the Palantir system becomes deeply integrated into police workflows, switching to another system becomes increasingly difficult. Specialized training, data migration, and workflow redesign require enormous costs. The promise to switch to a future European alternative becomes realistically unachievable.

The case of Bavaria's VeRA system illustrates this. The framework agreement Bavaria signed with Palantir in 2022 includes a provision allowing other federal states and the federal government to join without a new procurement process. A decision made by an individual state becomes a nationwide precedent. De facto standards are created without sufficient deliberation by elected representatives.

A more fundamental problem exists. Nobody knows exactly how Palantir's algorithms work. The source code is a trade secret. Even the Fraunhofer Institute's review results were classified as confidential. When police authorities accept the algorithm's recommendations, there is no way to verify the logic behind those recommendations.

Researchers call this "automation bias." Humans tend to over-trust computer system outputs. When an algorithm classifies a particular individual as "high risk," investigators are more likely to follow that judgment than question it. When the algorithm is wrong, it is difficult to detect and correct that error.

(2) Questions of Sovereignty and Accountability: Who Watches the Algorithms

Peter Thiel wrote a provocative sentence in a 2009 essay: "I no longer believe that freedom and democracy are compatible."

Alex Karp has said at multiple public events: "Our products are sometimes used to kill people."

Palantir's founders do not hide their values. They claim to be defending Western democracy. But who decides the manner and scope of that "defense"? A democratically elected government, or Palantir?

Palantir's governance structure makes this question even sharper. The company employs a differential voting rights structure. The three founders (Thiel, Karp, and Stephen Cohen) exercise approximately 80% of voting rights through Class F shares. Control by shareholders and oversight by the board of directors are both limited. The founders determine the direction of the company.

This company handles core national security functions of democratic states. Palantir's algorithms determine who is a terrorist suspect, who is a surveillance target, and how data is connected. An unelected technology company has entered a core domain of national sovereignty.

The German Federal Constitutional Court's 2023 ruling was one answer to this problem. But it was not a definitive answer. The court did not ban the use of Palantir itself. It merely demanded that the legal basis be made stricter.

The GFF and the Chaos Computer Club continue to fight. Constitutional complaints against Bavaria and North Rhine-Westphalia are underway. But the political tide is moving in the opposite direction. Under the Merz government, Palantir's proliferation is accelerating.

No fundamental solution is in sight at the EU level either. GDPR proclaimed strong data protection principles, but grants each member state discretion regarding the use of surveillance technology in the national security domain. The EU AI Act introduced regulations for high-risk AI systems, but many exceptions apply to the law enforcement domain.

In the end, the problem is not technology. It is a choice. What balance to strike between efficiency and privacy, between security and freedom, between convenience and democracy. The answer to this question cannot be provided by an algorithm. Citizens must decide for themselves.

The 1983 Census Judgment that the German Federal Constitutional Court recalled, and the history of the Nazis and the Stasi that it evoked, serve as a warning. Technology is neither inherently good nor evil. But when it becomes a tool of power, when it goes unchecked, when it lacks transparency, technology can threaten democracy.

Palantir's name comes from the "palantír" in Tolkien's The Lord of the Rings. The seeing stone. But in Tolkien's story, many of those who used the palantír were captivated by its gaze and met their doom. The watcher became the watched. The tool dominated the user.

The question facing Germany and Europe is this: Who will control the palantír? Will we use it, or will it use us?