UN moves to renew Palantir deal despite unresolved privacy, governance risks

The United Nations World Food Programme (WFP) is preparing to renew a five-year agreement with Palantir Technologies even though a confidential internal audit reportedly found that privacy concerns surrounding the data platform have not been adequately resolved and that the agency has no clearly defined strategy for leaving it.

The August 2025 audit by WFP’s Office of the Inspector General classified shortcomings in risk management as a high-priority issue, according to a joint investigation by France 24 and PassBlue, which reviewed the document. The audit has not been released publicly.

Its findings sharpen a dispute that has followed WFP’s relationship with the U.S. data-integration company since it was announced in 2019.

The argument is no longer only about whether Palantir can see the personal or biometric records of people who receive food aid, it is also about how deeply the company’s Foundry software has been embedded in the systems WFP uses to move food and money through one of the world’s largest humanitarian operations, what information passes through those systems, and whether WFP could now replace the platform without disrupting its work.

WFP told France 24 and PassBlue that it was finalizing a new five-year agreement whose general scope and terms would remain the same as those of the 2019 contract. Sources told the news organizations that the agreement was expected to be signed in August.

The agency said it conducts extensive due diligence, retains control over its data, and places strict governance, privacy, and security requirements in its technology agreements.

WFP also rejected the suggestion that it is locked into one provider. Palantir said it does not use, retain, or sell customer data for its own purposes and does not train models on customer information. The company declined an interview but said it was proud of its work with WFP.

The sensitivity was also visible inside the agency. Pedro Garbellini, a former communications officer in WFP’s technology division, told the news organizations that an unwritten rule had taken hold: “Never speak about Palantir.” He said the subject became a reputational hot potato between WFP teams.

At a Rome headquarters meeting in April, an employee’s question about why the partnership continued was reportedly met with applause from other staff members.

The relationship began with a pilot in 2017 and was formalized two years later through a five-year, in-kind agreement valued at $45 million.

Under the arrangement, Palantir supplied Foundry, software designed to combine information held in separate systems so it can be analyzed and used in operational applications.

WFP’s 2023 annual performance report said the partnership had been renewed that year.

WFP and Palantir first used the software to support Optimus, a tool for designing food baskets and comparing procurement and delivery options. They later developed an enterprise platform known as DOTS, which WFP has described as a central data engine that draws information from systems across the organization.

DOTS provides near-real-time visibility into supply chains and an expanding collection of corporate data.

WFP records show that Palantir Foundry underpins applications used for planning, logistics, and data reconciliation.

A 2024 evaluation said the supply-chain portion of DOTS alone contained 74 structured data models of varying size and complexity. The publicly listed examples included records on distributions, food losses, purchase orders, suppliers, warehouses, transporters, vehicle trips, retailers, and cash-based transfers.

The operational case for retaining the technology is substantial. WFP said the initial Optimus pilot produced more than $30 million in savings.

Its current management plan reports that Optimus, Prisma, and two other supply-chain tools together saved $3.2 million and more than 10,000 staff hours in 2024, although the document does not attribute all those gains to Palantir alone.

The leaked 2025 audit reportedly found that WFP still lacked a unified and trusted data-management system, while reputational concerns about Palantir had contributed to institutional uncertainty.

More consequentially, it said WFP had not developed a clear exit strategy for DOTS or determined the costs of ending the relationship, even as the agency continued making substantial investments in the platform.

That finding is consistent with WFP’s own hiring and planning documents. Job notices described WFP as investing heavily in its deployment of Foundry and recruiting personnel to expand DOTS.

Other notices call for WFP staff to work with a Palantir focal point and engineering team on the platform’s product roadmap.

The Tech for Bad report, which is based largely on WFP evaluations, audits, job postings, and United Nations procurement records, argues that the public description of the partnership has not kept pace with its operational reach.

It found that DOTS supports tools including Optimus and Prisma, an AI-enabled supply-chain control tower that consolidates information for predictive and prescriptive planning.

WFP’s management plan says it will continue investing in Prisma and other advanced supply-chain applications.

The most sensitive question concerns SCOPE, WFP’s beneficiary information and transfer-management system. SCOPE supports enrollment, identity management and aid distribution and can include biometric verification.

WFP said in 2019 that Palantir would have no access to data providing beneficiary information and that its software would analyze only information unrelated to individual aid recipients.

Public WFP documents show that the boundary is more complicated than a complete separation of the systems, although they do not show that Palantir receives identifiable or biometric beneficiary records.

A December 2025 WFP audit of SCOPE In-Kind, an expanded function intended to track food from warehouses to recipients and reduce diversion, said the system integrates with DOTS for data reconciliation.

The same audit expressly said DOTS is designed to ingest only non-personally identifiable information, so reconciliation is performed at an aggregate level and cannot identify discrepancies within individual households.

The Tech for Bad report therefore concludes that aggregate beneficiary information now enters the Palantir-powered environment and argues that this still warrants scrutiny because combining large operational datasets can reveal patterns even when names and direct identifiers have been removed.

But the available documentation does not establish that Palantir has access to SCOPE’s biometric identity database, and it would be inaccurate to treat aggregate reconciliation as proof that raw beneficiary records are being shared.

Nonetheless, that distinction intensified after a May cyberattack exposed personal information associated with roughly 600,000 households in Gaza. WFP said the breach was confined to its Self-Registration Application for Palestine and had no direct connection to Palantir software.

The incident demonstrated the stakes involved when humanitarian agencies hold names, identity numbers, telephone numbers, and location information on populations living in an active conflict zone.

The joint investigation also described contractual language that has revived questions about what Palantir may learn from the relationship.

An unnamed humanitarian technology expert familiar with the 2019 agreement told France 24 and PassBlue that a provision allowed Palantir to use data to improve system performance.

The source said the language could potentially permit algorithmic training. Palantir, however, says it does not train AI models on customer data.

There is an important difference between retaining WFP’s raw information, using non-identifying product telemetry to maintain software, and carrying lessons from one deployment into products sold elsewhere.

Because the contract is not public, it is impossible to determine where WFP and Palantir drew those lines. WFP has not disclosed the agreement, the permissions it grants, or the risk assessment supporting the renewal.

The dispute has broader implications because WFP is co-leading work under the UN80 reform initiative to integrate supply chains across the United Nations.

WFP Executive Director Cindy McCain told the agency’s board in February that its digital technologies would underpin a UN-wide integrated supply-chain platform.

WFP management has also said Prisma will continue to be used while the agency develops an interoperability roadmap.

The Tech for Bad report warns that WFP’s leadership could become a path for Palantir’s technology to spread across the UN system, bringing other agencies’ operational and partner data into the same environment.

That remains a risk identified by the researchers, not an announced procurement decision. No public UN or WFP document reviewed says Palantir Foundry has been selected as the enterprise platform for the UN80 supply-chain project.

The report identifies the International Atomic Energy Agency as Palantir’s other known UN-agency relationship, but its investigation is centered on WFP.

The scale of WFP’s operations, its role as a logistics provider to other humanitarian organizations, and its stewardship of beneficiary data make the unanswered questions unusually consequential.

Palantir’s defense and intelligence work adds to the ethical dispute. Its platforms support U.S. military, intelligence, and immigration enforcement operations, while WFP is required to observe the humanitarian principles of humanity, neutrality, impartiality, and operational independence.

WFP’s position is that the company’s software has produced efficiencies that allow scarce humanitarian resources to reach more people while contractual controls protect the data.

Article Topics

biometrics  |  data privacy  |  humanitarian  |  identity management  |  Palantir  |  United Nations  |  vendor lock-in