The Register

Campaigners against Palantir's involvement in the UK's health sector are set to make themselves heard this week with planned protests at the Labour Party conference and in London. Health justice charity MedAct and medical campaign group Just Treatment are coordinating a protest at the ruling party's annual conference in Liverpool as ministers consider whether to extend the NHS's contract with the US spy-tech company. The groups are among those urging the government not to extend the Palantir-led Federated Data Platform (FDP) contract, which could be worth up to £330 million over seven years. In June, the cross-party Science, Innovation and Technology Committee said Palantir should not play such a significant role in the UK public sector. It urged the government not to extend the FDP contract in 2027 and instead to develop an in-house replacement or seek a UK provider. "Vendor lock-in isn't inevitable, and the current position leaves us seriously exposed," committee chair Dame Chi Onwurah said. Palantir won the lead role in the £330 million FDP contract in November 2023 following a procurement process that NHS England maintains was open and fair. The award followed £60 million in COVID-era NHS contracts awarded without competition. NHS England and Palantir say the platform links data held in disparate systems, helping hospitals use beds and operating theatres more efficiently and tackle the care backlog. Earlier this month, Palantir hired former Labour Party deputy Tom Watson to help guide its work with the UK government. The campaign groups protesting in Liverpool today say September 30 is the contractual deadline for Palantir to provide NHS England with an exit plan should the government choose not to continue the arrangement. The contract's initial term ends early next year, after which the government can extend it for two years, followed by two further one-year extensions. Questions are also being raised about the evidence used to support claims for the FDP's performance. Organizations opposing the rollout include the British Medical Association (BMA), public sector union UNISON, and the United Tech and Allied Workers Union. The BMA has urged members to consider avoiding the platform for purposes unrelated to direct care, citing risks to patient trust and data security. The Chief Data and Analytics Officers Network, which represents senior NHS data staff, has also urged the government to "consider the break clause." In a letter, it said the FDP "has been unable to demonstrate the level of evidence, confidence and realised value that should be expected following sustained investment and extensive policy support." Dr Rhiannon Mihranian Osborne, a No Palantir in the NHS campaigner at MedAct, said: "Patients and NHS staff are united in their opposition to this contract, and the last three years have seen unprecedented levels of professional and patient campaigning. Over 85,000 patients have made formal complaints to their hospitals. The government has an urgent opportunity to choose patients and staff over big tech, it must take it." Just Treatment spokesperson Hope Worsdale said: "Patients and health workers across England want Palantir out of our NHS. A company with a track record in surveillance, military technology and complicity in human rights abuses shouldn't be anywhere near our personal health data." Palantir says its software is helping UK public bodies carry out more NHS operations, keep Royal Navy ships at sea for longer and tackle domestic violence. It maintains that the data processed through the FDP belongs to the NHS and that disclosing it to anyone else would breach its contract. ®

Dutch police have arrested a 24-year-old man on suspicion of involvement with the prolific ShinyHunters cybercrime group. Cops announced the arrest on Monday night and said the Amsterdam resident would appear before judges at Rotterdam District Court today (Tuesday). Officers have not named the suspect. However, a company has identified a person they believe to be the suspect as working for them as an offensive security lead. Dutch broadcaster RTL and other newswires have also published a name. The Register chooses not to do so until a name is officially released by law enforcement. Authorities have not disclosed what conduct he is suspected of or identified any attacks allegedly involving him. The timing has focused attention on the investigation into the February breach of Dutch telco Odido, which was claimed by ShinyHunters and affected 6.2 million customers. Police have not said whether the individual is suspected of participating in that attack or whether he is the caller heard in an audio recording released this month. Investigators said the Odido intrusion began when a Dutch-speaking caller posed as an IT colleague and persuaded a customer service employee to provide access to an internal system. Police released part of the call on September 8 and subsequently received 20 tips, including what they described as "some very interesting information that the investigation team can use moving forward." Reuters reports the suspect was arrested on September 15 and that forensic investigators visited an Amsterdam office to make the arrest that night. They said police deployed flashbang grenades during the operation, although the account does not make clear where they were used. The arrest came a week after the public appeal. The person the news reports named was convicted several years ago of hacking, data theft, and extortion, and sentenced to four years in prison, one year suspended. He subsequently returned to legitimate cybersecurity work. ShinyHunters denial that it is linked to the named individual comes days after it boasted of compromising an FBI recruitment system, exclusively telling The Register that it hacked the FBI to "protect our business." The move is part of an escalating run of attacks and extortion attempts attributed to the group. ®

Microsoft is pushing its data analytics and engineering environment to a new set of commercial users that are an “order of magnitude” greater than its current base. Power BI has become a popular biz intelligence system - with more than 425,000 customers worldwide - particularly among customers of the Microsoft Dynamics application portfolio. Now, Microsoft execs are trying to exploit this penetration by offering Power BI customers high-end database services and app building tools available on its Fabric data analytics and engineering platform. Customers who license Power BI Pro and Power BI Premium Per User will get Fabric Apps and Fabric Database capabilities (up to 1GB per app), along with security, at no additional cost. Microsoft argues that the Apps customers are building in Fabric can be ported to Power BI without much additional work or cost. Arun Ulag, exec veep at Microsoft, told The Register: “We have 40,000 Fabric customers today. Power BI is an order of magnitude larger, with 425,000 customers: organizations, not individuals. The usage of Power BI exceeds 35 million business users every month,” he said. Microsoft is now offering this user base the ability to build data analytics-style apps using Rayfin, an open source SDK. The company says Rafin will let users create their own data applications that accept inputs, write back data, preserve shared state, and support operational workflows across to Fabric. Each application gets a 1GB Fabric SQL database, authentication, and security. As an application grows, users can expand its functionality and hand it off to developers and IT teams without rebuilding it. By bringing Fabric application development to Power BI, Microsoft is showing that the “distinctions between a dashboard and an app are disappearing,” Ulag said. Rayfin is designed to work with GitHub Copilot; Claude Code or Codex; or any coding agent, letting users instruct a coding agent to build an application and deploy where they specify, in a Fabric environment.The feature is scheduled to be available in preview in the coming weeks. Fabric was anounced by Microsoft in 2023 as an integrated analytics, data warehouse and data lake environment. It has since added data mirroring to allow users to run analytics on data in other environments without pushing SQL queries directly to them. Last year, the vendor added transactional databases to the environment, including its document database Cosmos DB and Fabric SQL relational system. Microsoft says it is now extending its integration with other platforms, including Salesforce application and data systems. It is previewing bidirectional integration with Salesforce Data Cloud 360, making data from the CRM vendor available across the Microsoft system for analytics and AI, including as business context for Fabric data agents, without duplicating that data. Salesforce also has its own data environment and agent-building platform.®

Airport departure boards are supposed to tell passengers where and when their flights will leave. Recent examples spotted by eagle-eyed Reg readers have offered some bonus information: a Windows activation reminder, dates from the past, and a glimpse of what appears to be Windows 7 beneath the signage software. Airport borks, it seems, are like buses: three have arrived in quick succession at Heathrow. The first display shows a Windows activation watermark behind a list of departures to glamorous destinations. Milan? How lovely. Cairo? A place to ponder culture and millennia-old construction techniques. Activate Windows? OK, not quite so lovely. Perhaps the destination board had simply embarked on a journey of self-discovery. But at least the date was correct, right? Er, wrong. Time might be moving forward for the rest of the world, but at Heathrow it appears to be going backward. Perhaps heading to a time when air traffic control wasn't beset by problems and air travel didn't involve increasingly performative security protocols that differ country by country. Our second serving of signage silage shows one page dated September 21 and another stuck on September 12. A number switcheroo? A window into the past? Or simply a display that had stopped receiving updates? Alas, things became more unsettling a few days later when another Heathrow screen revealed the eldritch horror lurking beneath the departures display. Is that... Windows 7? The network dialog looks an awful lot like something from the operating system that refuses to die. The taskbar and Start button peeking out from the bottom of the screen only deepen the suspicion. Then again, Heathrow is no stranger to displaying retired technology. A British Airways Concorde remains parked at the airport, reminding passengers stuffed into yet another Boeing or Airbus that air travel was once considerably more ambitious – and perhaps a little more dangerous. When Concorde retired in 2003, Microsoft was two years into the Windows XP era. A different sort of danger, perhaps, but at least nobody had yet asked it to run an airport departures board in 2026. ®

Salesforce has won a contract worth up to £2.4 billion including VAT to provide the UK tax collector with CRM software and related services for at least ten years. HM Revenue & Customs (HMRC) selected Salesforce to supply a software-as-a-service CRM platform and related capabilities including customer and case management, marketing campaigns, messaging, reporting, analytics, and AI. Additional functions, including identity verification, fraud detection, and data integration, may be supplied by third parties. The contract runs until September 2036, with extensions of up to five years potentially taking it to 2041. The contract award notice says HMRC received two final bids. Salesforce beat Pegasystems, better known as Pega, whose platform also combines low-code development, automation, and AI. HMRC initially estimated the procurement at £1 billion during preliminary market engagement in April 2025. The subsequent tender put its potential 15-year value at £2 billion excluding VAT, or £2.4 billion including it. That notice said the new CRM system would need to "seamlessly integrate with [the] updated customer service platforms, including the future Contact Centre as a Service (CCaaS) … directly enhancing taxpayer interactions, streamlining services, and reducing administrative burdens." The Salesforce award forms part of a broader overhaul of HMRC's customer-facing technology. In April, the department awarded Capgemini a contact-center-as-a-service contract worth up to £600 million including VAT. The agreement could also run for ten years and is intended to integrate with the new CRM platform. The overhaul follows years of complaints about HMRC's customer service. In 2025, the House of Commons Public Accounts Committee (PAC) accused the department of deliberately degrading its telephone service to push taxpayers toward online channels. The PAC found that phone performance had reached an all-time low during 2023-24. During the first 11 months of that financial year, HMRC disconnected nearly 44,000 callers who had spent 70 minutes waiting for an adviser because its system could not cope with demand. Only two-thirds of calls were answered, and the average wait time was more than 23 minutes. An earlier National Audit Office report found that callers collectively spent 798 years on hold during 2022-23. ®

EVENT: Somewhere in your organisation right now, somebody is trying to work out which of four copies of a file is the current one. They will probably get it right, after twenty minutes and a message to a colleague in another time zone, and nobody will log the twenty minutes. That is what it costs to run distributed teams on file infrastructure built for an office, and most organisations have stopped noticing. The NAS is still there. So is the VPN, and so is the habit of downloading a file to work on it and syncing it back later, which arrived with the first remote worker and never left. None of it fails outright. The bill turns up somewhere else, as duplicated storage, as time spent waiting, and as a security review that finds one file in three places with three different sets of permissions. The Register is putting that problem to a dinner in Soho on Tuesday 20 October. Joe Fay of The Register chairs. Rupert Watson, VP GTM for EMEA at LucidLink, joins the conversation. It runs under the Chatham House Rule, so what is said can be used and who said it cannot, and the chair’s job includes stopping anyone who starts to pitch. What makes an evening like this useful is the detail people only share in private. The workaround a team adopted the week the office emptied and has been paying for ever since, for instance, and what they did about it once somebody added up the cost. Nobody says that on a recorded webinar. The questions for the table: how organisations are handling the growth in unstructured data, how they support distributed teams without paying for the same file three times, what they are doing about sync and version control, and whether any of it holds up in a security incident. Nobody is proposing to rip the estate out. The evening is about modernising around the storage and governance investments already made. The table is for senior technology, infrastructure and data leaders carrying this now. Dinner runs from 6.30pm to 9pm at The Soho Hotel. Places are limited and go by invitation. Request one here.

The World Wide Web’s decades-long tyranny of box design is finally coming to an end. A new set of CSS features – including the shape() function, and the border-shape and corner-shape properties – offers web designers and their AI agents a broader palette for laying out content in a more fluid manner. When the World Wide Web Consortium (W3C) published its first standard for web page layout in 1996, web sites emulated the grid-defined layouts of academic papers, newspapers, and magazines. At the time, graphics drivers, and browser rendering engines were all in a relatively primitive state. Developers were also trying to grapple with a new medium and generally found that flowing text within a defined space was much easier when the geometric coordinates of that space were kept as simple as possible. But now print is basically dead, webdevs are savvier (and if not, AI is happy to help), and Lord knows GPUs are more powerful. So there's no reason today why a web page has to be square, daddy-o. In Edwin A. Abbott's 1884 proto-Sci-Fi classic Flatland: A Romance of Many Dimensions, the protagonist who lives in flat two-dimensional space is abruptly exposed to the dizzying world of three dimensions, much to his astonishment. Web developers may experience similar emotions when they first use these new CSS constructs. Dev’s choice: vertical or horizontal In their original forms, HTML and CSS could draw only horizontal or vertical lines or borders on a Web page. Fancier layouts required proprietary plug-ins, such as Java Applets, Macromedia/Adobe Flash, or some tedious JavaScript hacks. SVG first broke the boxiness of the web, giving the developers the ability to put curves, squiggly lines, logos or any other wild-ass shape desired by using a series of numerical coordinates to describe the shape (it’s tedious work, though image-to-SVG converters help). SVG was limited to a canvas placed on a Web page, however. CSS ruled the layout of the page itself. The first attempt at bridging the two worlds was path(), which allowed SVG to be embedded directly within CSS. The path() function had some limitations – it wasn’t responsive to changing web page sizes and it didn’t understand variables or CSS units of measurement. Developers had to define all specs in pixels and that was that. Check out those curves The shape() function properly introduced the Web to richer design. A shape() is a set of geometric coordinates of a desired shape or trajectory. Unlike path()’s reliance on SVG, it is built on responsive CSS syntax. When combined with the existing clip-path property, shape() has been used to create ticket stubs, chat bubbles, and other assorted page flotsam. The latest CSS property, border-shape, completes the work by applying CSS-native coordinates defined in shape() to the web page borders themselves. Define the coordinates with shape(), embed it in a border-shape property, and the boundaries are staked out on the page itself. The boundaries are laid out early in the rendering process, rather than clipped in near the end of the rendering. “In other words, putting borders on CSS shapes will become child’s play!” noted self-described CSS hacker Temani Afif, in a tutorial on the CSS-Tricks site. This new property opens a range of design possibilities heretofore too complicated to contemplate – at least within a 40-hour webdev workweek. Afif offers a number of demonstrations in his tutorials: not only can you carve up a Web page any way you see fit, but you can also put borders within borders. Fill in the space between the outer shape and the inner shape to make a cut-out. Shape an open heart inside a square box, for instance, using nothing but CSS. Either the outside border or the internal shape can be animated, allowing the outside border to change shape as the mouse goes over it, or the inside border to be filled with an image or another design. A shape can enlarge or shrink when the mouse hovers over it, or text can be highlighted with little squiggly lines. If hand-crafting the contents of shape() is not your jam, a companion property called corner-shape offers a number of pre-defined fancy border patterns. Most are variations of the standard box, including boxes with rounded edges, beveled edges, notches, scoops, and one called a “squircle.” According to the caniuse.com site, all major browsers now support shape(), while border-shape and corner-shape are still being implemented and considered experimental (though the current releases of Chrome, Edge, and Opera support the standard). Now, it’s up to developers to build a more fluid web. ®

Google’s basic mathematical skills appear a little fragile, after the company revealed its promise of ten years of support for new Chromebooks will only last for eight years. The web giant’s calculation problem appeared in a support document titled “What the Googlebook announcement means for your ChromeOS devices.” Googlebooks are the big G’s replacement for Chromebooks, the web-centric computers it launched in 2011 and which run ChromeOS. Chromebooks have won plenty of admirers in the education sector, especially schools which see them as a fine way to get decent and well-priced computers into kids’ hands without having to take on the burden of managing a full OS. The newer Googlebook range uses more powerful processors than their predecessors, plus a new OS called Googlebook OS that bakes in Google’s Gemini AI – a product the Chocolate Factory is very keen to see succeed as the great AI land grab continues. Google has so far launched Googlebooks only for consumers. None of the web giant’s five current Googlebook hardware partners designed their first models for the education market or other fleet buyers. Those five, and many other OEMs, continue to crank out Chromebooks. Google’s support policy for Chromebooks includes ten years of updates. However the support document states that if you buy a Chromebook today, updates will end in 2034 – eight years into the future, not a decade. “For qualifying devices purchased today whose 10-year support lifecycle extends beyond 2034, Google is committed to supporting your transition to Googlebook OS, with many devices offering direct migration paths,” the support page explains. But those migration paths don’t exist yet. “Many newer commercial Chromebook models will be capable of upgrading to Googlebook OS. Details on migration paths and device eligibility will be shared at a later date,” the document explains. Whenever the migration paths arrive, they will come with a requirement to acquire a new license for Googlebook OS management tools – existing ChromeOS licenses won’t make the trip. While Google has unilaterally changed a policy, it’s hard to imagine many Chromebooks currently in service or acquired in the next year or two will still be in service come 2034. So the shorter support period is largely moot. But Google’s intention to make continued use of Chromebooks unattractive is clear. ®

OpenAI has detailed the extent of the dirty deeds its agents indulged in Down Under in a Tuesday blog post titled How we will do better for Australia, which addresses last week’s news that one of its models improperly accessed a website that stores data related to national health scheme Medicare. “Our models accessed Australian government websites in ways they were not authorised to,” the post opens. “We also should have handled our response better. We are sorry and working to do better in the future.” The post offers some new detail on the Medicare incident, saying that it involved “an experimental, internal-only OpenAI model that was not intended for public release and without the full set of safeguards used in our publicly available products.” OpenAI gave the model the job of researching government spending per person on medicines for skin conditions in one Australian state. “The model had difficulty obtaining that information, and it took actions that we had not authorised it to take,” OpenAI admitted. “In the course of looking for this information at Services Australia’s Medicare Statistics Reporting Service, it discovered a way to gain non-public access to the service. It then used this access to review technical system information and source code related to the service – all still with the objective of trying to find the information it was originally looking for.” The Register last week asked OpenAI if the company conducted the tests itself or used a partner. The company did not respond to our request. In another incident disclosed in the new post, the company’s bots visited the Australian Institute of Health and Welfare and tried, unsuccessfully, to bypass access controls. The agents were still able to retrieve statistics using third-party browsing and download services, including from the institute’s website. “The downloaded material appears to have been publicly available. There was no system compromise. Individual medical records were not accessed,” OpenAI wrote. The company didn’t report the incident because it “did not meet our disclosure thresholds because the way it was accessed seemed consistent with public access.” OpenAI changed its mind and notified the Institute on 24 September – the day Australia’s prime minister announced the Medicare incident. Another concerning incident took place at the State of Victoria’s Agency for Health Information, which OpenAI agents visited after they “discovered an exposed access key.” The agent used that key to “retrieve reporting configuration and aggregate survey statistics.” OpenAI has given itself a pass on this one, writing “The extent to which this information should have been accessible is unclear, and depends on VAHI’s access policies. Individual medical records or identifiable survey responses were not accessed.” A fourth incident revealed in the post saw OpenAI agents visit the State of New South Wales’ Bureau of Crime Statistics and Research and make API and website metadata requests using a public-facing research tool. OpenAI has promised it will “commit the resources needed to help affected agencies understand what happened and assess the impact” – whatever that means. It’s also donating credits for the Daybreak cyber-defense service and promised to “establish a taskforce with independent Australian expertise to develop practical policy recommendations for managing risks from increasingly capable AI agents.” That taskforce “will focus on improving notification processes, strengthening coordination between AI developers and government, and identifying measures to better protect government systems.” OpenAI wants the taskforce to deliver recommendations by the end of 2026. The post is very much of the “We’re sorry and we promise to do better in future” genre, pioneered by Meta and popular with entities that leak data or experience outages. The Register expects more of the same sentiments next week, when OpenAI’s Chief Strategy Officer, Jason Kwon, appears before the Australian Senate’s Joint Select Committee on Artificial Intelligence. “He will answer questions about what we know, how we responded, what steps we have taken, and how we will do better going forward,” OpenAI says. ®

AMD dove deeper into AI model development on Monday with an agreement to acquire Fei-Fei Li's World Labs in a deal valued at approximately $8.2 billion. The House of Zen claims the all-stock deal is expected to close by year's end pending regulatory approval, and will guide the development of future AI hardware, software, and systems. "Building the compute platforms for the next generation of AI requires a deep understanding of how models are evolving," AMD CEO Lisa Su said in a canned statement. Founded in early 2024, San Francisco-based World Labs has focused its efforts on developing spatial-intelligence models often referred to as "world models," which have applications beyond machine intelligence in adjacent fields like robotics. These models are based on a fundamentally different approach to artificial intelligence than LLMs, and work by generating, reconstructing, and simulating 3D environments from text, image, and video inputs. Put another way, rather than predicting what sequence of words comes next, world models work by imagining the environment and working through the problem that way. This approach to AI has gained momentum in recent years with major proponents of the tech including former Meta chief AI scientist Yann LeCun. As part of the deal, World Labs will continue its work on advanced AI models, while Li will join AMD as executive vice president and chief scientist reporting directly to CEO Lisa Su. "Joining AMD will give our team the resources and engineering depth to accelerate our research and help define the infrastructure needed for the next era of AI," Li said in a statement. The acquisition comes just weeks after AMD announced the agreement to purchase Taalas, which builds high-performance AI chips capable of 17,000 tokens a second or more by literally baking their weights directly into silicon. But while that deal was focused primarily on hardware, the acquisition of World Labs could end up playing a bigger role in AMD's future. AMD is no stranger to AI development. But, compared to Nvidia, AMD's software engineering resources are tiny. Nvidia's investments in AI development have not only helped shape the future of its hardware, but have also provided its enterprise customers with the tools and frameworks necessary to put those GPUs to use. It's not just that Nvidia's GPUs are fast, but that they're easy to use. The World Labs team essentially provides AMD with an in-house AI development team that it can use as a springboard for winning over enterprises and guiding development of next-gen hardware. The acquisition is also a hedge that LLMs, which have fueled the AI bubble up to this point, might be a dead end. LeCun has said as much. Li, meanwhile, has offered a more nuanced perspective on the matter. Li isn't anti-LLM - she just believes that true intelligence must be grounded in reality. "We built the company guided by the foundational belief that language alone isn’t sufficient for model development," Li wrote in a blog post. "The universe isn’t made up of words; it’s made of real things. So many of the most important problems for AI to solve, from science to entertainment to robotics, require models to reason over the structure and behavior of the physical world." If this prediction turns out to be right, AMD's early investment in World Labs could give it a leg up building the hardware necessary to run spatial models at scale. ®