The sentence the story stands on
In late August, an FoI officer at the Australian Criminal Intelligence Commission answered a request for records of Fraud Fusion Centre data being fed into Palantir’s software with a refusal about paperwork: “the process for ingesting one FFC dataset into Palantir generates an amount of documents that … would likely not be manageable” [1]. (The ellipsis is the Guardian’s.) That sentence is the load-bearing wall of the whole story. It presupposes that an ingestion process exists and generates records, and it declines to release them because there are too many. The documentation of the surveillance is the stated reason the surveillance cannot be inspected.
To its credit, Guardian Australia is careful about what this proves. The headline and the opening line both say participant data “may have ended up” in Palantir’s platform [1]. The confirmed links are real: the NDIA shares participant information with the Fraud Fusion Taskforce [1]; the ACIC, responsible for the taskforce’s Fraud Fusion Centre, “has used Palantir as part of” that work [1]; and the commission “has paid millions in contracts to Palantir” [1]. The unconfirmed joint is whether participants’ records specifically passed through the ingestion process. The hedge is honest. The problems are packed around it.
The denial that answers a different question
Last month the NDIA “denied using Palantir’s software” [1]. This month its spokesperson confirmed sharing participant information with the taskforce [1]. Both can be true at once: they answer different questions. “Do you use Palantir” is not “does Palantir hold your participants’ data.” The denial is scoped to software use; the live question is about data flow. The Guardian catches the gap and pivots on “However” [1]. But notice the shape of the denial, because the rest of the official language shares it: precise enough to be true, narrow enough to be useless.
The restricted basis
The NDIA’s full sentence: “NDIS participant information is only shared with Fraud Fusion Taskforce partners on a restricted basis where potential criminal conduct is suspected to protect participants from fraud” [1]. Every load-bearing word is undefined. Restricted by what, set by whom, audited where? None of the three versions of this story asks. “To protect participants from fraud” performs the neatest trick in the sentence: the people whose records are shared are the people the sharing is said to protect. The watched and the protected are the same people. That is the oldest sentence in the surveillance handbook, and it is the grammar Orwell’s Ministry of Love was built on.
The ACIC completes the circuit. It used “a suite of analytical tools and capabilities” [1], a phrase that specifies nothing, and says “taskforce-related data collected and stored by the ACIC is consistent with the restrictions agreed with the provisioning agency” [1], a passive whose agreement nobody dates or documents. Then the key line: “The contributing agency is responsible for articulating any use, handling, and disclosure restrictions to the ACIC” [1]. Put the two statements side by side. The NDIA says data is shared on a restricted basis. The ACIC says the NDIA is responsible for defining the restrictions. Each agency’s sentence makes the other one the guarantor. Nobody in the piece claims the guarantor’s job, and no reporter asks. This is not a lie; it is a structure. The actor has been deleted from every clause, and what remains is two passives pointing at each other.
Palantir’s statement is boilerplate worth displaying: the company “builds software that helps organisations use their data to make better decisions and solve their most complex problems” [1] and is “committed to supporting Australian government agencies in tackling complex challenges, including serious financial crime and fraud” [1]. The company whose software is paid to “map connections between people” [1] offers a statement with no people in it. This is brochure vocabulary, printed as balance.
Then there is the name. “Fraud Fusion Taskforce.” The centre “brings in ‘large volumes of information, data and intelligence’” [1] for “bulk data analytics and data-matching across participating agencies’ databases” [1]. Fusion is what happens in stars and kitchens. Here it means aggregating data held across 25 government agencies [1] for pattern-matching against people. The name does the opposite of describing the thing, which is the Ministry-name trick: call the bulk matcher a fusion centre and the reader pictures energy, not exhaust.
The refusal as evidence
One caveat, flagged as interpretation: the FoI officer cited manageability, not secrecy. Nothing in these pieces shows the volume was engineered to defeat the request. But the effect deserves naming. An apparatus whose ingestion process generates too many documents to release has produced its own opacity out of its own scale, and the public learned what it learned only because a refusal leaked its own side effect. That is a fragile way for a democracy to see anything.
The story travels, and sheds
Now watch the story move. News Beep, an Australian outlet, republishes the Guardian’s text wholesale, headline included, with its own slug bolted on [3]. The scrape retains the clause “Guardian Australia can reveal” [3], a first-person claim of original reporting now sitting inside an outlet that revealed nothing. It also retains the furniture: “Sign up for the Breaking News Australia email” [3], and even the navigation string “skip past newsletter promotion” [3]. Copy that ships with another outlet’s newsletter signup is copy no editor appears to have read. This is duckspeak in its purest form: words quacked without engagement, “can reveal” outliving the act of revealing.
UA.NEWS, in Ukraine, is more selective. It attributes honestly (“This was reported by The Guardian” [2]) and then trims. The hedge survives (“may have ended up on Palantir’s analytics platform” [2]). The officials survive: the restricted basis, the ACIC’s handling line, Palantir’s commitment [2]. What does not survive is the dissent. Tom Sulston of Digital Rights Watch, who called the aggregated datasets “a fundamentally de-humanising application of surveillance technology” [1], is gone. Greens senator David Shoebridge, who called Palantir a “global surveillance vampire” [1], is gone. The researcher’s name is unstable across the chain: the Guardian’s “Gabrielle Josling” [1] becomes “Gabrielle Gosling” at UA.NEWS [2]. One of the two is a misspelling, and nothing in either piece lets a reader tell which. It is a small thing, except that this is the name attached to the entire evidentiary record, the person who filed the FoI requests the whole story rests on. What travels is the institutional voice; what gets shed is the alarm. A reader in Kyiv receives the architecture and none of the argument against it.
The vampire is the easy part
The Guardian frames the stakes through personality: a manifesto “described by one UK MP as the ‘ramblings of a supervillain’” [1], the “US Trump-aligned billionaire Peter Thiel” [1], the vampire. These are more shareable than an FoI officer’s manageability complaint, which is precisely the Huxley problem. The story arrives dressed as character drama, villain and billionaire and vampire, while its content is administrative: 25 agencies, an undefined basis, a refusal. It closes on Coles declining to extend its Palantir contract beyond 2027 [1], commerce signing off. None of this is false. All of it is easier to consume than the sentence the story actually rests on.
What a reader would need instead
First, the distinction between the denied claim (the NDIA uses Palantir) and the live one (NDIS data may reach Palantir through the ACIC). The second is unanswered, and “may have” is doing honest work that readers deserve to be told is work.
Second, that Australia has a privacy and FoI regulator, the Office of the Australian Information Commissioner, where FoI decisions can be sought for review. No regulator, commissioner, or parliamentary committee appears in any version. The only external voices are an advocacy group and a Greens senator; the only attestations to the “restrictions” come from the parties doing the sharing.
Third, that no figure for NDIS fraud appears in any version. The taskforce’s existence is the only evidence of the problem’s scale, so no reader can weigh proportionality: how much fraud, against how much data, on what basis, checked by whom. The articles do not say, and do not flag that they do not say.
Fourth, whether the researcher is seeking review of the refusal. The pieces do not tell us.
The phrase to hold onto is “restricted basis.” It stands where a safeguard should be, and three outlets in three countries printed it without asking what it restricts, who set it, or who checks it. When someone names the basis, publishes the restrictions, and accepts the guarantor’s job, the sentence will mean something. Until then it belongs to the same family as “a suite of analytical tools and capabilities”: words shaped like oversight, hollow at the center.