The relationship must be very strained already if they are publicly blaming each other. Customers always blame their vendors. On the Palantir side, their account/product managers should be asking whether or not their ACL config is sufficiently intuitive. If this mistake was easy for a customer to make, if it's a mistake that couldn't have been avoided without consultancy, then Palantir should treat it like a defect.

It's because the FBI doesn't have any leverage to threaten palantir for passing the blame. "Government agency is incompetent" is a very potent narrative that blocks the usual expectation that cloud products should be difficult to use insecurely.

Complaining publicly has no downsides for palantir here.

Their leverage is contract. Palantir's position as vendor of choice is kinda limited right now. They don't seem to service regular corps in US.

The complaint can have a real ramifications ( loss of future contracts and so on ). That said, at certain point enough is enough I suppose.

> "Government agency is incompetent" is a very potent narrative that blocks the usual expectation that cloud products should be difficult to use insecurely.

Whether the government purchased a defective product that was insecure or misused a good product, the government should be held to account for the failure, same as with any company.

Palantir can host its products on-prem, and for the FBI very well might have. But where it was hosted wouldn't have any relevance here.

Ultimately, that's why the customer is paying the vendor.

Could as well be. Properly managing access controls for a complicated data platform might actually be harder than securing the software to begin with. Setting up protocols for who is able to access what and why and who is in charge of changing the config is non-trivial.