The Oracle of Surveillance: How Larry Ellison Built America's Invisible Empire
Part 3: The Acquisition Machine
That's the number. 145 acquisitions over two decades, totaling north of $110 billion in spent capital. Not invested. Spent. Because Oracle doesn't invest in innovation the way most technology companies understand the word. Oracle doesn't tinker in garages. Oracle doesn't fund moonshot research labs. Oracle doesn't cultivate the kind of reckless, caffeine-fueled creative chaos that produces the next Java or the next relational database or the next anything.
Oracle watches other companies do that. Then it buys them.
This is not a criticism. This is a business model. And it is one of the most successful business models in the history of American enterprise, measured purely in terms of market capitalization growth and competitive dominance.
Larry Ellison has never pretended otherwise. In boardrooms and on earnings calls, in interviews and keynotes, Oracle's leadership has been remarkably transparent about the strategy, if you know how to listen. They don't talk about "innovation pipelines." They talk about "strategic acquisitions." They don't announce new products born from internal R&D breakthroughs. They announce new products born from the carcasses of companies they consumed whole.
And here's the thing nobody noticed, or at least nobody said out loud until it was far too late: every single acquisition was a data play. Every one. Even the ones that looked like infrastructure deals. Even the ones that looked like enterprise software consolidation. Even the ones the business press covered as "Oracle strengthens cloud position" or "Oracle expands middleware offerings" or "Oracle enters hospitality market."
Strip away the press releases. Ignore the analyst calls. Forget the purchase price and the projected synergies. Look at what Oracle actually acquired in each deal. Not the software. Not the brand. Not the customer contracts. The data those systems touched. The data they generated. The data they stored. The data they moved.
When you do that, the pattern isn't subtle. It's screaming.
What emerges is not a technology company expanding its product line. What emerges is something closer to an intelligence apparatus assembling its collection infrastructure, one acquisition at a time, each deal adding a new data type to the pile. HR records. Customer databases. Point-of-sale transactions. Web browsing behavior. Health records. Financial statements. Device fingerprints. Offline purchase histories.
Layer by layer. Year by year. Deal by deal.
Nobody builds a stack like this by accident. Nobody spends $110 billion without knowing exactly what they're buying. And nobody assembles a data collection apparatus this comprehensive without having a very clear idea of who's going to use it.
So let's walk through it. Chronologically. Acquisition by acquisition. And watch the surveillance machine assemble itself in real time.
Acquisition #1 - PeopleSoft: The Hostile Beginning ($10.3 Billion, December 2004)
It started with a fight. The ugliest kind of fight. The kind that ends up in federal court with the Department of Justice trying to stop you.
In June 2003, Oracle launched an unsolicited, hostile takeover bid for PeopleSoft, the dominant provider of human resources and enterprise management software in the United States. PeopleSoft wasn't just any company. It was the HR backbone of American institutional life. Universities ran on PeopleSoft. Hospital systems ran on PeopleSoft. Fortune 500 companies entrusted PeopleSoft with the most sensitive details of their workforce management. The Department of Defense ran PeopleSoft.
PeopleSoft's board rejected the offer immediately. Its CEO, Craig Conway, called Ellison's bid "atrociously bad behavior" and compared Oracle's tactics to those of a hostile nation-state. Conway publicly accused Ellison of trying to destroy a competitor rather than genuinely acquire one.
He wasn't entirely wrong about the hostility. He was entirely wrong about the motive.
What followed was an eighteen-month war that played out across courtrooms, regulatory agencies, and the pages of the Wall Street Journal. PeopleSoft adopted a poison pill defense. Oracle raised its bid. PeopleSoft rejected it again. Oracle raised it again. PeopleSoft's board launched a public campaign to rally customers against the acquisition, warning that Oracle would sunset PeopleSoft's products and force customers onto Oracle's own platform.
Then the Department of Justice stepped in.
The DOJ filed an antitrust lawsuit to block the deal, arguing that combining Oracle and PeopleSoft would create a dangerous monopoly in the enterprise application software market. The case was built on the premise that the merger would eliminate meaningful competition for large-scale HR and financial management systems, ultimately harming customers through higher prices and reduced innovation.
The attorney general who oversaw the DOJ during this period was John Ashcroft. Hold that name in your head. Write it on a napkin. Tattoo it on your forearm if that helps. Because the AG who tried to stop Oracle's first major data grab would, years later, end up on Oracle's payroll. The revolving door between government enforcement and corporate compliance is a well-worn path in American life, but this particular rotation has a stench to it that we'll examine closely in Part 5.
The DOJ's case went to trial in June 2004. And in September 2004, U.S. District Judge Vaughn Walker threw it out. Entirely. He ruled that the government had failed to prove the merger would substantially lessen competition, partly because he accepted Oracle's argument that the relevant market was broader than the DOJ had defined it. The government didn't appeal.
Oracle raised its offer one final time to $26.50 per share, a significant premium over its original bid. PeopleSoft's board, exhausted and legally outgunned, finally accepted in December 2004.
The deal cost $10.3 billion. It was, at the time, the largest hostile takeover in technology history. And the manner in which it was executed, the relentless escalation, the legal warfare, the willingness to fight the federal government and win, established a template that Oracle would follow for the next two decades. If you have something Oracle wants, Oracle will get it. The only question is the price.
The press covered the deal as a software consolidation play. Two enterprise giants becoming one. Market share. Synergies. The usual vocabulary of corporate mergers that makes analysts nod approvingly and investors calculate earnings-per-share accretion.
But look at what Oracle actually acquired.
PeopleSoft's Human Capital Management suite was the backbone of HR operations for roughly half the Fortune 500, along with hundreds of universities, hospital systems, and government agencies at every level. The software managed employee records at a granular level that most people outside of HR departments never think about. Social Security numbers. Salary histories. Tax withholding data. Benefits elections, including health insurance selections that reveal family structure, medical conditions, and risk profiles. Performance reviews. Disciplinary records. Home addresses. Emergency contacts. Bank account numbers for direct deposit. Immigration status for international workers. Security clearance levels for defense employees.
This wasn't customer data. This was employee data. The most intimate financial and personal information that American workers entrust to their employers, processed and stored and managed by PeopleSoft's systems across thousands of organizations.
Oracle didn't just buy a software company. It bought the HR nervous system of American institutional life. Every major university running PeopleSoft for its faculty and staff records. Every hospital system using it for physician credentialing and nurse scheduling. Every defense contractor relying on it to manage the clearances and compensation of workers with access to classified information.
One acquisition. Tens of millions of employee records. The most personal data most people will ever generate in the course of their working lives.
The foundation was laid. And nobody talked about the data.
Acquisition #2 - Siebel Systems: The Customer File ($5.85 Billion, September 2005)
Nine months after swallowing PeopleSoft, Oracle was hungry again. The digestion period was barely over before the next course arrived.
Siebel Systems was the undisputed king of Customer Relationship Management software, commanding roughly 45 percent of the CRM market at its peak. Tom Siebel, the company's founder, was himself a former Oracle executive who had built his company into the dominant platform for managing customer interactions across sales, marketing, and service. There was a personal dimension to this acquisition that the technology press loved to emphasize. The protégé, consumed by the mentor. But the personal drama was a sideshow.
Unlike PeopleSoft, this wasn't a hostile deal. Siebel's market position had eroded under pressure from Salesforce.com's cloud-based upstart model, and the company was receptive to acquisition. The board voted. The shareholders approved. The deal closed in January 2006 for $5.85 billion. Clean and quiet.
And again, the business press told a clean story. Oracle was consolidating enterprise software. Building a complete suite. Competing with SAP. Industry analysts published notes about market share percentages and total addressable markets.
And again, the data story was entirely different.
CRM systems are, at their core, customer surveillance platforms. That's not a conspiracy theory. That's not hyperbole. That's literally what they're designed to do. The entire value proposition of a CRM system is to give a company comprehensive visibility into its relationships with its customers and prospects. Every email sent and received. Every phone call logged. Every sales meeting noted. Every demo delivered. Every complaint filed. Every purchase made. Every contract renewed or lost. Contact information, communication preferences, buying patterns, service histories, account values, churn risk scores.
Siebel's clients were among the largest companies and government agencies in the world. The systems held detailed behavioral and transactional records for hundreds of millions of individual consumers and business contacts. These weren't abstract data points. These were intimate portraits of commercial relationships. How often does a customer call? What are they angry about? What's their spending trajectory? Are they a flight risk? What offer would keep them?
Now step back and look at what Oracle had assembled in less than two years.
PeopleSoft gave them the employer side. Every detail about how people earn their money. Where they work, what title they hold, what they're paid, what benefits they carry, where they live, who their emergency contacts are.
Siebel gave them the customer side. Every detail about how people spend their money. What they buy, how often, through which channels, how much they complain, how loyal they are, what their lifetime value is to the companies that serve them.
Employer data and customer data. Two halves of the same coin. Two views of the same human being, seen from opposite sides of the transaction. The worker and the consumer. The earner and the spender.
Oracle now held both views. For hundreds of millions of people. Across thousands of organizations worldwide.
Two acquisitions. Two data types. One increasingly complete picture of human economic life.
Acquisition #3 - BEA Systems: The Plumbing ($8.5 Billion, January 2008)
This one confused people. And that confusion was itself instructive.
BEA Systems made middleware. Specifically, it made WebLogic, the application server platform that sat between databases and user-facing applications, routing data, managing transactions, handling the invisible computational plumbing that made enterprise software actually work. BEA also made Tuxedo, a transaction processing system used by banks and telecommunications companies to handle millions of simultaneous operations.
Middleware is not glamorous. It doesn't show up in consumer-facing products. It doesn't generate headlines or inspire TED talks. When Oracle announced the $8.5 billion acquisition in January 2008, most coverage focused on the competitive dynamics with IBM, which made competing middleware products, and debated whether Oracle had overpaid.
Nobody talked about what middleware actually does.
Middleware is where data moves.
Think of it this way. If databases are the vaults where information is stored, middleware is the highway system that connects them. Every request a user makes to an enterprise application, every transaction that gets processed, every query that moves between a browser and a database, passes through the middleware layer. It's the nervous system of enterprise computing. The connective tissue. The central switchboard.
Controlling the middleware means controlling the flow. It means understanding the architecture of information movement at the deepest level. It means knowing where every pipe leads, which systems talk to which other systems, how data moves between applications, and where the integration points are.
This is a pattern that intelligence agencies have understood for decades. You don't need to open every letter if you control the post office. You don't need to tap every phone if you own the switching station. The most efficient form of surveillance has always been infrastructure-level access, positioning yourself at the chokepoints where information naturally flows.
Oracle didn't buy BEA for the data it contained. Oracle bought BEA for the data it touched. For the position it occupied in the enterprise architecture. For the pipes. For the knowledge of how enterprise data moves, where it goes, and how it connects.
After BEA, Oracle didn't just have vaults full of HR records and customer files. It had the plumbing that connected those vaults to everything else in an enterprise's technology stack. It could see the architecture from the inside.
Three years. Three acquisitions. Vault. Contents. Pipes. Three layers of the same machine, each one making the others more valuable.
Acquisition #4 - Sun Microsystems: The Ecosystem ($7.4 Billion, April 2009)
IBM wanted Sun Microsystems. Badly.
In early 2009, as the financial crisis was gutting the technology sector and valuations were collapsing across the board, IBM entered negotiations to acquire Sun for approximately $7 billion. The talks leaked to the press. And then they collapsed, reportedly over price disagreements and IBM's plans for Sun's workforce.
Oracle swooped in like a raptor spotting a wounded animal on a highway. In April 2009, Ellison announced the acquisition for $7.4 billion, outbidding IBM for a company that was, on the surface, a hardware manufacturer in terminal decline. Sun's server and workstation business had been hemorrhaging market share for years. Its stock had cratered from a peak of over $250 during the dot-com bubble to single digits.
The business press was genuinely baffled. Oracle was a software company. A database company. What did it want with Sun's struggling server and workstation business? What did a company that sold enterprise software need with manufacturing facilities and a hardware supply chain?
The answer was not in the hardware. The hardware was the wrapping paper. The answer was in what Sun had built and given away for free over the preceding decades, embedding itself so deeply into the global computing infrastructure that it had become impossible to remove.
Java). The programming language running on more than one billion devices worldwide. The language that powered Android applications, enterprise banking systems, ATMs, Blu-ray players, parking meters, smart cards, and an unknowable number of government and military systems. Java was everywhere, woven into the fabric of global computing like rebar in concrete. Removing it would mean demolishing the building.
MySQL. The most widely used open-source database in the world. The default data store for millions of websites, startups, and small businesses. The database running underneath WordPress, which at the time powered roughly a quarter of the entire internet. The database trusted by companies that couldn't afford Oracle's enterprise pricing but still needed reliable data storage.
Solaris. The enterprise-grade Unix operating system trusted by banks, telecommunications companies, and government agencies for their most mission-critical workloads. The operating system you run when downtime isn't just expensive but catastrophic.
Oracle didn't buy Sun for its rack-mounted servers gathering dust in data centers. Oracle bought Sun for ecosystem control. For developer dependency. For the ability to shape the platforms that hundreds of millions of applications and billions of devices depended on, and for the leverage that comes with that position.
Java alone was worth the price of admission. Not because of the licensing revenue, which under Sun's stewardship had been modest by design, but because of the leverage. When you own the language, you own the terms of engagement for every developer who writes in it. You own the runtime environment. You own the update cycle. You own the compatibility certifications. You decide what's compliant and what isn't.
And you own a certain kind of visibility into the technology stack of every organization that depends on your platform. You know who's running what versions. You know who's behind on patches. You know, at a high level, the shape of the technology footprint for every entity that depends on Java, MySQL, or Solaris to function.
Oracle proved what this leverage meant almost immediately. Within years of acquiring Sun, Oracle launched aggressive litigation against Google over Android's use of Java APIs, seeking billions in damages. The message was clear. Java is ours now, and if you've built something on top of it, you owe us.
The Sun acquisition wasn't a data grab in the traditional sense. It was an infrastructure grab. And in the world Oracle was building, piece by piece, acquisition by acquisition, infrastructure and data were becoming the same thing.
There's a postscript to the Sun deal that tells you everything about how Oracle treats the things it buys.
Run a reverse DNS lookup on IP address 138.1.33.162. Go ahead. Anyone can do this. It's public information, sitting right there on Shodan for anyone who bothers to look.
That single IP address hosts over eighty domain names. mysql.com is there. java.com is there. sun.com is there. opower.com. bigmachines.com. crowdtwist.com. push.io. The domain names of dozens of acquired companies, the digital headstones of once-independent technology firms, all pointing to the same single address. Eighty-plus domains.
One IP. A mass grave with a 301 redirect.
And it gets better. Sitting on that same IP, right alongside the production domains for some of the most important open-source projects in computing history, are staging and disaster recovery endpoints. ocomtld-stage.appoci.oracle.com. ocomtld-dr.appoci.oracle.com. Staging environments. On the same IP as production. The kind of configuration that would get a junior DevOps engineer fired on their first day at any company that takes infrastructure seriously.
This is how the acquisition machine works in practice. Buy the company. Strip the data. Park the domain on a shared IP with eighty other corpses and a staging server. Move on to the next meal.
Acquisition #5 - MICROS Systems: The Hidden Gem ($5.3 Billion, June 2014)
If you've eaten at a restaurant in the United States in the last fifteen years, there's a good chance MICROS handled your transaction. If you've checked into a hotel, there's an even better chance.
MICROS Systems was the dominant provider of point-of-sale technology for the hospitality industry, holding roughly 35 percent of the restaurant POS market and a commanding position in hotel property management systems. The numbers were staggering in their reach. Over 330,000 customer sites. 180 countries. The terminals and software that processed your credit card when you paid for dinner. The systems that managed your hotel reservation, tracked your room charges, catalogued your minibar consumption, scheduled your spa appointments, and recorded what you ordered from room service at 2 AM.
Oracle's $5.3 billion acquisition of MICROS in June 2014 was covered primarily as a vertical expansion into the hospitality technology market. "Oracle Enters Restaurant Tech," the headlines read. Oracle expanding its cloud strategy. Moving into new verticals. Nothing to see here.
Everything to see here.
MICROS gave Oracle something that none of the previous acquisitions had provided: real-world, physical-world transaction data at massive scale. Not what people did at work. Not what they bought through enterprise procurement channels. Not what they clicked on a website. What they did with their physical bodies and their physical credit cards in physical locations on specific dates and times.
Which restaurants they ate at and how often. What they ordered. What they drank. How much they tipped. Which hotels they stayed in, in which cities, on which dates, with how many guests in the room. Whether they used the minibar. Whether they ordered room service. Whether they visited the hotel spa or the hotel bar or both.
This is behavioral data of the most intimate kind. It tells you where a person is, what they're doing, and often who they're with. It captures the patterns of daily life in a way that digital data alone never can. Your web browsing history might reveal your interests. Your MICROS transaction history reveals your life.
And here's why 2014 matters so much. Because MICROS wasn't the only thing Oracle acquired that year. In the same twelve-month period, Oracle also bought the two companies that would complete the digital-to-physical tracking loop.
The timing was not coincidental. It was strategic. And it was brilliant in its ruthlessness.
Acquisitions #6 and #7 - The Surveillance Stack: BlueKai and Datalogix (2014)
In the same year Oracle acquired MICROS, it also quietly absorbed two companies that would form the backbone of what Oracle would eventually brand as its "Data Cloud." These acquisitions received a fraction of the press coverage that MICROS or PeopleSoft generated. They deserve ten times more. Maybe a hundred times more.
BlueKai was a data management platform, a DMP in industry jargon, that specialized in collecting and categorizing web browsing behavior at industrial scale. Every website you visited, every ad you clicked, every product page you lingered on, every search term you entered. BlueKai's tracking technology was embedded across thousands of websites through cookies and tracking pixels, silently hoovering up behavioral data and sorting it into targetable audience segments for the advertising industry. Oracle acquired it for approximately $400 million.
In 2020, a security researcher would discover that BlueKai had been exposing a massive database of this user tracking data on a server accessible to anyone on the internet. No password. No authentication. No encryption. Billions of records of intimate web browsing activity, just sitting there, readable by anyone who knew where to look. Oracle quietly acknowledged the breach. The press covered it for approximately one news cycle. Then everyone moved on to the next thing.
We'll revisit that breach, and what it revealed about Oracle's data hygiene, in Part 4.
Datalogix was something different and, in many ways, considerably more disturbing than BlueKai. While BlueKai tracked what people did online, Datalogix tracked what people bought offline. Its business model was built on partnerships with major grocery chains, pharmacies, retailers, and data brokers that gave it access to purchase records covering an estimated $2 trillion in annual consumer spending. Loyalty card swipes. Pharmacy transactions. Grocery purchases. The physical-world buying behavior of more than a hundred million American households.
Oracle acquired Datalogix for approximately $1.2 billion and merged it into the same Data Cloud infrastructure as BlueKai.
Now connect the dots.
MICROS gave Oracle real-time point-of-sale data from restaurants and hotels across 180 countries. Datalogix gave Oracle historical offline purchase data from grocery stores and pharmacies. BlueKai gave Oracle web browsing behavior across thousands of websites.
Three acquisitions in the same year. Three layers of tracking. Digital behavior. Physical purchases. Real-time location. Combined together, they gave Oracle the ability to track a person from their morning web browsing through their afternoon grocery run to their evening restaurant dinner. Online to offline. Digital to physical. Click to purchase.
We'll go deep on exactly what Oracle built with these pieces, how the Data Cloud actually operates, and what the "five billion profiles" number really means, in Part 4. For now, just understand what the pieces are. Understand what they do individually. And understand that Oracle bought them all within months of each other in a coordinated acquisition spree that nobody in the press connected into a coherent strategy.
That's not coincidence. That's architecture.
Acquisitions #8 and #9 - AddThis and Crosswise: The Web and The Thread (2016)
By 2016, Oracle's appetite for tracking infrastructure had become almost comically brazen. The acquisitions were no longer disguised as enterprise software consolidation or cloud strategy plays. They were, transparently, surveillance infrastructure purchases. And the market barely blinked.
AddThis was a social sharing widget company. You've seen their product a thousand times even if you've never heard the name. Those little rows of share buttons at the bottom of news articles and blog posts. The Facebook icon, the Twitter bird, the Pinterest pin, the email forward button. The ubiquitous social sharing toolbar that seemed to appear on every website on the internet. AddThis provided those widgets, free of charge, to approximately 15 million websites, reaching an estimated 1.9 billion unique users every single month.
Fifteen million websites. Let that number settle.
What most publishers and website operators didn't fully grasp, or perhaps chose not to think about too carefully, was that AddThis widgets weren't just share buttons. They were tracking pixels with a user interface bolted on top. Every time a web page loaded with an AddThis widget embedded in it, the widget fired a tracking beacon back to AddThis servers, recording the visit. The user's browser fingerprint. Their device characteristics. Their approximate location. Their browsing path across every website running AddThis code. The share buttons were the bait. The tracking was the product.
The client list was staggering in its ideological range. WhiteHouse.gov ran AddThis widgets. So did YouPorn.com. Government websites and pornography sites, news organizations and conspiracy forums, health information portals and gambling sites, all instrumented by the same tracking infrastructure, all reporting user behavior back to the same servers.
Oracle acquired AddThis and folded it directly into the Data Cloud alongside BlueKai and Datalogix.
In the same year, Oracle made another acquisition that received even less attention but arguably mattered more. Crosswise was a tiny Israeli startup, barely a blip on the radar of the technology press, that specialized in what the industry euphemistically calls "cross-device identity resolution." In language that doesn't require a marketing degree to understand, Crosswise's technology could determine that the phone browsing Instagram at a coffee shop, the laptop checking email at an office across town, and the tablet streaming Netflix on a living room couch at 10 PM all belonged to the same human being.
This is the stitching technology. The thread that ties disparate data points into a single identity. Without cross-device resolution, Oracle's data was fragmented. A phone profile here, a laptop profile there, a tablet profile somewhere else. Three anonymous devices doing different things. With Crosswise, those three anonymous devices became one named person with a complete behavioral pattern spanning every screen they owned.
Crosswise was founded by veterans of Unit 8200, the Israeli military's elite signals intelligence division. The same unit that produced the founders of NSO Group, Checkpoint, and dozens of other companies operating at the intersection of intelligence and technology. This detail was mentioned in trade press coverage at the time without much comment, as though the intelligence community pedigree of the founders was merely a credential, a resume line, rather than a signal worth investigating.
One acquisition. A tiny Israeli startup founded by signals intelligence veterans. It would connect Oracle to something much larger, a web of relationships between Silicon Valley, the Israeli intelligence establishment, and the global surveillance industry that stretches far beyond anything we can cover here. We'll pick up that thread in Part 6.
For now, register what Oracle had assembled by the end of 2016. Not just data about individuals, but the ability to follow those individuals across every device they own. Your phone, your laptop, your tablet, your work computer. All stitched together into a single identity profile by technology built by people who learned their craft in military signals intelligence. Feeding into a data cloud that already contained your web browsing history, your offline purchase records, your restaurant meals, and your hotel stays.
The walls were going up. And there was nowhere to hide.
Acquisition #10 - NetSuite: The Books ($9.3 Billion, July 2016)
NetSuite was the leading cloud-based Enterprise Resource Planning platform, providing accounting, financial management, inventory tracking, order processing, and e-commerce capabilities to tens of thousands of small and mid-sized businesses worldwide. It was the QuickBooks of the cloud era, if QuickBooks handled a hundred times more complexity and served companies doing tens of millions in annual revenue.
Oracle acquired it for $9.3 billion in July 2016.
There was a problem with this deal that everyone acknowledged and nobody seemed willing to do anything about.
Larry Ellison personally owned approximately 40 percent of NetSuite. He had been an early and significant investor. His ownership stake was not a secret. It was public knowledge, documented in SEC filings, mentioned in every piece of coverage about the deal. When Oracle announced its intention to acquire NetSuite, the conflict of interest was so glaringly obvious that even Oracle's own board, a body not historically known for its independence from Ellison's influence, had to form a "special committee" of independent directors to evaluate whether the deal was fair to Oracle's shareholders.
The fundamental question was simple. Was Oracle paying $9.3 billion for a company worth $9.3 billion? Or was Oracle paying $9.3 billion because its co-founder and largest shareholder stood to personally pocket billions from the transaction?
The special committee retained independent financial advisors. They evaluated the deal. They approved it. The acquisition closed. Ellison's personal NetSuite stake was worth billions. And the corporate governance questions that should have prompted serious regulatory scrutiny were instead resolved by the thinnest possible veneer of procedural compliance.
We'll examine the full implications of this transaction, and the broader pattern of Ellison's personal financial entanglements with Oracle's corporate strategy, in Part 7. For now, put the governance issues aside and focus on the data. Because the data story is where this acquisition fits into the larger pattern.
ERP systems are the complete financial nervous system of a business. They contain everything a company knows about its own economic existence. Revenue figures. Cost structures. Profit margins. Vendor relationships and payment terms. Customer invoicing and payment histories. Inventory levels and supply chain dependencies. Payroll integrations. Tax filings and compliance records. Cash flow projections. Accounts receivable and accounts payable.
If you wanted to understand a company, truly understand it at the level of its financial DNA, you would want access to its ERP system. And if you wanted to understand tens of thousands of companies simultaneously, you would want access to a cloud ERP platform that served them all.
NetSuite's customers were primarily small and mid-sized businesses, the segment of the American economy that collectively employs the majority of the workforce and generates a significant share of GDP. These weren't Fortune 500 companies with armies of lawyers and dedicated data governance teams and the negotiating leverage to demand favorable contract terms. These were companies with a few hundred employees, maybe a few thousand, companies that trusted their cloud ERP provider with their complete financial lives because they didn't have the resources or the expertise to build and maintain their own systems.
Oracle now had their books. All of them. Revenue, expenses, margins, cash flow, vendor dependencies, customer concentrations. The complete financial anatomy of tens of thousands of American businesses.
Combined with PeopleSoft's HR data for their employees. Combined with Siebel's CRM data for their customers. Oracle could now see an organization from every angle simultaneously. How it paid its people. How it served its customers. How much money it made doing both. Where it was vulnerable. Where it was growing. Where it was dying.
Three dimensions of the same target. Workforce. Customers. Finances. One company holding all three views.
Acquisition #11 - Cerner: The Health Files ($28.3 Billion, June 2022)
Then came the big one.
Not the most expensive acquisition in Oracle's history, though it was that too. Not the most strategically significant, though it was arguably that as well. The most consequential. The one that completed the picture in a way that should have triggered alarm bells in every regulatory body, privacy organization, and congressional oversight committee in the country.
Cerner Corporation was one of the two dominant electronic health record companies in the United States, alongside Epic Systems. Cerner held approximately 25 percent of the hospital EHR market. Its systems processed patient records, clinical data, lab results, imaging orders, medication lists, and care documentation for roughly one in every four American hospitals. Major health systems. Regional hospitals. Community clinics. Urgent care centers.
But the real prize wasn't the private sector hospitals. The private sector was the appetizer.
Cerner held the contract for the Department of Veterans Affairs electronic health record system. The VA health system is the largest integrated healthcare system in the United States, serving approximately nine million enrolled veterans. Their medical records. Their psychiatric evaluations. Their disability ratings and the medical evidence supporting them. Their substance abuse treatment histories. Their prescription records, including controlled substances. Their PTSD diagnoses. Their traumatic brain injury assessments. The complete medical histories of the men and women who fought America's wars and came home carrying the wounds, visible and invisible.
Cerner also held contracts with the Department of Defense for military health record systems. Active duty service members. The people who currently hold security clearances, operate weapons systems, fly aircraft, command units, and have access to the nation's most sensitive military information. Their annual physicals. Their fitness-for-duty evaluations. Their mental health screening results.
Oracle acquired Cerner for $28.3 billion in June 2022. It was the largest acquisition in Oracle's history by a factor of three. Larger than PeopleSoft. Larger than Sun. Larger than any of the data broker acquisitions combined. The company was promptly renamed Oracle Health, because apparently in Silicon Valley, you can rebrand a surveillance capability as a healthcare initiative just by changing the name on the door.
The business press covered this as Oracle's ambitious entry into healthcare IT. A cloud transformation play. The modernization of legacy health systems. The future of digital health. Exciting new product roadmaps.
Read that framing one more time and try not to laugh.
Or cry.
Whichever feels more appropriate.
Oracle, the company that had spent two decades quietly assembling the largest commercial data aggregation infrastructure in the history of capitalism, just acquired the health records of approximately 25 percent of American hospital patients. Plus nine million veterans. Plus active duty military personnel.
Diagnoses. Prescriptions. Mental health evaluations. Substance abuse treatment records. Genetic test results. Reproductive health data. STI testing. HIV status. Cancer screenings. Psychiatric medication histories. Therapy notes. Every intimate detail that a person reveals to their physician under the assumption that it is protected by the most sacred confidentiality principles in American medical ethics and law.
HIPAA exists for a reason. Medical confidentiality exists for a reason. These protections were established because health data is uniquely dangerous. It is the data type that can destroy a person's career, their insurance coverage, their relationships, their custody arrangements, their security clearance, and their reputation with a single unauthorized disclosure.
Oracle now held this data for millions of Americans. Including the nine million who served their country and trusted the VA with their most vulnerable moments. Including the active duty service members whose mental health status is directly relevant to national security operations.
And Oracle renamed the whole thing "Oracle Health," slapped a fresh logo on the website, and carried on as though this were just another product launch.
Here's how seriously Oracle took the integration of its biggest acquisition ever.
Three years after closing the $28.3 billion Cerner deal, a Cerner application domain called khapps.com is still running on Cerner's old DNS nameservers. Not Oracle's nameservers. Not OracleCloud DNS. The nameservers at ns3.cernerns.com and ns4.cernerns.com. The dead company's infrastructure, still running, still resolving, still serving the health applications that touch veteran medical records. Anyone with a terminal and the dig command can verify this in thirty seconds.
This isn't an obscure technical footnote. Oracle's own Corporate Security Practices document, version 3.6, states that "companies that Oracle acquires are required to align with these security practices as part of the integration process." Three years and $28.3 billion later, they haven't even migrated the DNS. The nameservers still say "cerner" in the domain name. That's not a delayed integration timeline. That's abandonment with a purchase receipt.
And while we're poking around Oracle's DNS, here's a fun one. Oracle maintains four separate Amazon SES verification records in its DNS. Amazon Simple Email Service. The transactional email platform built and operated by Amazon Web Services. Oracle, a company that spends billions of dollars a year trying to convince enterprises that Oracle Cloud Infrastructure is a viable alternative to AWS, sends its own email through Amazon's infrastructure. The company that wants your cloud budget can't even trust its own cloud to deliver a password reset email.
You genuinely cannot make this up.
Five Billion Dossiers
Let's stop.
Let's stop adding acquisitions to the list and instead look at what we've built. Not what Oracle says it built. Not the version on the investor relations page with the clean infographics and the upward-trending revenue charts. Let's look at the actual data stack, assembled acquisition by acquisition, layer by layer, over twenty years of relentless and methodical consumption.
Start with PeopleSoft. You have a person's employment record. Where they work. What their title is. What they're paid. Their Social Security number. Their tax withholdings. Their health insurance elections. Their 401(k) contributions. Their home address. Their emergency contacts. Their performance reviews. Their disciplinary history. Their security clearance level.
Add Siebel. Now you have their customer record too. What they buy from the companies that serve them. How often they buy. Through which channels. Their communication preferences. Their complaint history. Their account value. Their loyalty score. Whether they're a flight risk.
Add BEA. Now you understand how all of this data moves through the enterprise systems that generate it. You know the architecture. You know the pipes. You know the integration points.
Add Sun. Now you own the platforms those enterprise systems are built on. Java. MySQL. Solaris. The programming language, the database, and the operating system. The foundation layer beneath the application layer beneath the data layer.
Add MICROS. Now you have their physical transactions. Which restaurants they eat at. Which hotels they stay in. What they order. What they drink. What they tip. Where they were, physically, on a given Tuesday evening in a specific city.
Add Datalogix. Now you have their grocery receipts. Their pharmacy purchases. Their retail transactions. Two trillion dollars in annual consumer spending, mapped to individual identities.
Add BlueKai. Now you have their web browsing. Every site they visited. Every ad they clicked. Every product page they lingered on. The digital trail of their curiosity, their desires, their anxieties, their fears.
Add AddThis. Now you have their content consumption across 15 million websites. Which news articles they read. Which political content they engaged with. Which health information they searched for. Including the sites they would never admit to visiting. All captured by share buttons they never clicked.
Add Crosswise. Now stitch all of it together across every device they own. Their phone. Their laptop. Their tablet. Their work computer. One identity. One thread. Pulling everything into a single, unified profile.
Add NetSuite. Now you have their business finances, if they run a company. Revenue. Costs. Margins. Vendors. Cash flow. The complete financial anatomy of their enterprise.
Add Cerner. Now you have their health records. Diagnoses. Prescriptions. Mental health treatment history. Substance abuse records. Genetic markers. Reproductive health data. The things they told their doctor that they've never told another living soul.
Stack it. All of it. One layer on top of another on top of another on top of another. Employment. Purchasing. Location. Browsing. Content. Devices. Finances. Health.
All connected. All in one company's infrastructure. All under one roof.
Oracle's own marketing materials, in the years before public scrutiny forced a retreat into vague language, referenced a data asset covering approximately five billion consumer profiles worldwide. Five billion. On a planet of eight billion people. That is not a customer database. That is not a marketing tool. That is not a cloud service.
That is a census. A private census, built and maintained by a corporation with no democratic mandate, no electoral accountability, no constitutional constraints on its data practices, and a direct financial pipeline to the defense and intelligence communities of the most powerful nation on earth.
No government agency in a democratic society could have built this. Not legally. The constitutional constraints, the congressional oversight requirements, the Fourth Amendment protections that nominally prevent the government from assembling comprehensive dossiers on its own citizens without probable cause or judicial warrant, all of that would have stopped a government program dead in its tracks. The Church Committee reforms of the 1970s were specifically designed to prevent American intelligence agencies from doing exactly what Oracle has done.
But Oracle isn't the government. Oracle is a private company. And private companies operate under an entirely different set of rules. They can buy data. They can combine data. They can sell data. They can share data with government agencies through commercial contracts that never require a warrant, never trigger Fourth Amendment protections, and never face meaningful congressional oversight.
The acquisition machine wasn't building a product. It was building a capability. A capability that the government couldn't build for itself. A capability that, once built, the government could simply purchase as a service.
And that is exactly what happened.
The Pentagon Is Calling
Five billion files.
That's what 145 acquisitions add up to when you connect them. Not software products. Not cloud services. Not enterprise solutions. Not market share. Files. On people. On their employment, their health, their spending, their browsing, their location, their devices, their finances, their content consumption, their restaurant habits, their pharmacy purchases, their hotel rooms, their secrets.
Oracle built the most comprehensive commercial surveillance infrastructure ever assembled by a private corporation, and it did it in plain sight. Every acquisition announced in a press release. Every deal covered by business journalists who dutifully reported the purchase price and the strategic rationale and the analyst consensus without once asking the obvious question: what happens when you connect all of this together? What does it look like when one company holds the employment records, the customer records, the physical transactions, the web browsing, the device fingerprints, the financial statements, and the health records of billions of people simultaneously?
Nobody asked. So nobody had to answer.
We're asking now.
Because Oracle wasn't just building profiles. It was building profiles for someone specific. The pattern of acquisitions doesn't make rational sense as a pure commercial play. The data types are too varied. The coverage is too comprehensive. The investment, $110 billion over two decades, is too large to justify on advertising revenue and enterprise software licensing alone.
This machine was built for a customer. A customer with deep pockets, vast appetites for information, and an insatiable institutional need to know everything about everyone. A customer that can't legally build this kind of capability itself but can legally buy access to it.
The Pentagon was already calling. Had been calling for years, in fact. The intelligence community was already at the door. And the revolving door between Oracle's executive suites and the highest levels of government power was already spinning so fast it was generating its own gravitational field.
The attorney general who once tried to stop Oracle's very first acquisition? He was about to switch sides. But that's Part 5.
Next in The Red String Wire: Part 4, "Five Billion Files," where we crack open Oracle's Data Cloud and show you exactly what it does with everything it collected. The machine is built.
Now watch it run.
We'll see you all at the next drop, but until then always remember to Follow The Red Threads.
Sources
Every claim is sourced. Feel free to check our work.
Acquisition Count & Total Spend
Oracle's 145 acquisitions, total deal count and sector breakdown: Tracxn — Acquisitions by Oracle
Complete list of Oracle acquisitions with dates and values: Wikipedia — List of Acquisitions by Oracle
PeopleSoft Hostile Takeover ($10.3B, 2004)
PeopleSoft CEO Craig Conway calling the bid "atrociously bad behavior": CBS News — PeopleSoft CEO Conway Ousted
DOJ antitrust lawsuit and Judge Vaughn Walker's ruling: CNET — Oracle Wins Antitrust Case
Judge Walker ruling Oracle could proceed with hostile bid: New York Times — Judge Allows Oracle to Bid for PeopleSoft
FTC lessons learned from the DOJ case: FTC — Lessons Learned from United States v. Oracle Corp.
Oracle's press release on the PeopleSoft acquisition: Oracle — Oracle Buys PeopleSoft
John Ashcroft and the Revolving Door
Ashcroft's consulting firm hired by Oracle, paid $220,000 for antitrust lobbying: ZDNet — Ashcroft Firm Lobbies for Tech Titans
The Ashcroft Group consulting on antitrust and homeland security for Oracle: Chicago Tribune — Ashcroft Turns Into Hired Gun
Ashcroft's lobbying disclosure details: Washington Technology — Homeland Watch
Siebel Systems ($5.85B, 2005)
Siebel's CRM market dominance (~45% market share at peak): Wikipedia — Siebel Systems
Oracle acquisition of Siebel for $5.85 billion: New York Times — Oracle to Acquire Siebel Systems
BEA Systems ($8.5B, 2008)
Oracle's $8.5 billion acquisition of BEA and WebLogic middleware: ZDNet — Oracle Buys BEA Systems
Sun Microsystems ($7.4B, 2009)
IBM's failed $7 billion bid for Sun: CNBC — IBM Withdraws $7 Billion Offer for Sun
Oracle swooping in with $7.4 billion acquisition: Computerworld — Oracle Buying Sun in $7.4B Deal
Java programming language, over 1 billion devices: Wikipedia — Java)
MySQL, most widely used open-source database: Wikipedia — MySQL
Oracle v. Google Java API lawsuit, seeking $8.8 billion in damages: Wikipedia — Google LLC v. Oracle America, Inc.
Supreme Court ruling in Google's favor on fair use: The Verge — Supreme Court Sides with Google
MICROS Systems ($5.3B, 2014)
Oracle's acquisition of MICROS, 330,000+ customer sites in 180 countries: Oracle Press Release — Oracle Buys MICROS Systems
MICROS background, hospitality POS market dominance: Wikipedia — Micros Systems
Washington Post coverage of the $5.3 billion deal: Washington Post — Oracle to Acquire MICROS Systems
BlueKai (~$400M, 2014)
BlueKai acquisition, data management platform background: Wikipedia — BlueKai
2020 data breach exposing billions of tracking records: TechCrunch — Oracle's BlueKai Tracks You Across the Web
Forbes coverage of the "billions of records" breach: Forbes — Oracle's BlueKai Spilled Billions of Records
Datalogix (~$1.2B, 2014)
Oracle paid over $1.2 billion for Datalogix: Forbes — Here's Why Oracle Paid Over $1.2 Billion for Datalogix
Datalogix tracked $2 trillion in annual consumer spending across 110 million households: Wired — Oracle Buys the Company Facebook Uses to Track Your Offline Purchases
Oracle's press release on Datalogix acquisition: Oracle — Oracle Buys Datalogix
Privacy International analysis of the Datalogix deal: Privacy International — Oracle Acquires Datalogix
AddThis (~$200M, 2016)
AddThis acquisition, 15 million websites, 1.9 billion monthly users: TechCrunch — Oracle Buys Audience Tracking Firm AddThis
AddThis background and reach: Wikipedia — AddThis
Deal value estimate between $100M-$200M: Business Insider — Oracle Acquiring Web Tracking Company AddThis
Crosswise (~$50M, 2016)
Oracle acquires Crosswise, Israeli cross-device tracking startup: Times of Israel — Oracle Acquires Israeli Big Data Firm Crosswise
Crosswise founders' military intelligence background, Oracle's Israel shopping spree: Jewish Telegraphic Agency — Oracle Buys Army Vets' Big-Data Firm
Cross-device identity resolution technology details: AdExchanger — Oracle Acquires Crosswise
Unit 8200 background, Israel's signals intelligence unit: Wikipedia — Unit 8200
NSO Group, another Unit 8200-connected company: Wikipedia — NSO Group
NetSuite ($9.3B, 2016)
Oracle's $9.3 billion acquisition of NetSuite: Oracle Press Release — Oracle Buys NetSuite
Ellison's ~40% ownership stake, worth $3.5 billion from the deal: Business Insider — Larry Ellison's NetSuite Stake Worth $3.5 Billion
Conflict of interest and Ellison family's 40% stake: Los Angeles Times — Oracle Buying NetSuite in $9.3B Deal
Cerner ($28.3B, 2022)
Oracle closes $28.3 billion Cerner acquisition: TechCrunch — Oracle Quietly Closes $28B Deal to Buy Cerner
Cerner managed health records for ~25% of American hospitals: Business Insider — Inside Oracle's Deadly Gamble on Cerner
VA signed $10 billion EHR contract with Cerner: VA.gov — VA Signs Contract with Cerner
DoD shared electronic health record system: Military.com — Electronic Health Record System Unveiled
Oracle acquisition announcement, key VA tech provider: FedScoop — Oracle to Acquire Key VA Tech Provider Cerner
Cerner renamed Oracle Health, VA renegotiates contract: The Register — VA Reboots Oracle Health Records Project
VA renegotiates $10B contract with stronger penalties: Fierce Healthcare — VA Renegotiates EHR Contract
Cerner Corporation background: Wikipedia — Cerner
Intelligence Community & Legal Context
Church Committee reforms limiting domestic intelligence gathering: Wikipedia — Church Committee
Hundreds of Unit 8200 veterans working in Big Tech: Drop Site News — Former Israeli Spies in Big Tech
Inside Israel's secret startup machine: Forbes — Inside Israel's Secret Startup Machine
DNS & Infrastructure Findings
Shodan IP lookup for 138.1.33.162 (80+ Oracle-acquired domains on single IP): Shodan
DNS verification of Cerner nameservers (ns3.cernerns.com, ns4.cernerns.com): Verifiable via
dig khapps.com NSfrom any terminalAmazon SES records in Oracle's DNS: Verifiable via
dig oracle.com TXTfrom any terminal