Picture this: you’re a minister in Europe and Washington quietly asks for a peek. Your emails, drafts and cabinet notes aren’t in a secret vault — they live on someone else’s servers. This episode opens on that impossible, very real moment and follows the ripple effects: threats of sanctions, a neutral Switzerland walking away from Palantir, and the uncomfortable truth that the UK handed that very company the keys to its health, defence and policing systems. We meet the players: Noel Bradford, the Small Business Cybersecurity Guy, who’s spent four decades turning tape backups into survival tactics; Corinne Jefferson, an ex-US intelligence officer who refuses to say “told you so”; Mauven MacLeod, the ex-UK government cyber analyst with biscuits and sarcasm; and Graham Falkner, whose voice narrates the creeping, bureaucratic apocalypse with unnerving charm. Together they pull the camera tight on Palantir — a firm born with CIA-connected funding, hardened in intelligence use, repackaged for civilian life — and show how its DNA matters for everyone from governments to your local charity. The episode walks you through the high-stakes decisions: Switzerland’s 2024 risk assessment that warned data could be reached by American authorities and that leaks from Palantir are architecturally unavoidable; the UK’s contrasting embrace of the same tools across NHS, the MOD and border planning; and how this divergence should set off alarms for every organization that has leaned on US SaaS as neutral plumbing. We translate the legal jargon into a human story. Think of the Cloud Act like an American landlord who can be ordered to open a warehouse — even if your files are stored in London. Encryption doesn’t save you unless you control the keys. UK and EU data rules complicate the picture but don’t yet provide a clean escape. That legal murk leaves businesses and charities sitting on unquantified exposures — not because they’re spies, but because convenience and market share created choke points that politics or courts can exploit. This isn’t fearmongering; it’s a practical wake-up call. Noel guides you through what to do next: a simple Cloud Act exposure audit, naming your crown-jewel data, and deciding which systems deserve extra protection or customer-managed keys. The episode offers concrete, manageable steps — split sensitive fields, demand clear vendor answers, build exit plans — so your small firm isn’t left exposed if geopolitics changes the rules. By the end you’ll see the world differently: your email and CRM aren’t just tools, they’re legal and geopolitical choices. The narrative closes on an urgent but solvable note — map your dependencies, protect what matters, and start asking the awkward questions. The story lands as both a warning and a roadmap: serious, fixable, and essential for anyone who cares where their data really lives.

Ask this episode

“What did the council decide on item 42?” — answered with the speaker and the moment.

Transcript

Related