This story isn't actually about Oracle, despite that being the most frequently mentioned aspect:

"Another revelation in the document is that NASA paid $4.36 million in software license violation penalties during FY 2021 alone. NASA was able to negotiate some fees down to zero but sent $3.85 million to SUSE and $415,000 to SAP. The auditor suspects other payments may have been made over the last five years – probably to the tune of $20 million."

Does SUSE also have hostages?

The Reg's story seems pretty reasonably written. The problem here is not with the vendors, who ultimately just want to get paid in the way NASA already agreed to pay them. The problem here - and even the Reg is a bit too polite to point it out - is that NASA's managers are aware that NASA is routinely engaging in software piracy and contract violations, yet apparently prefer to [make the taxpayer] pay fines rather than fix it.

Just if you want to be a hostage, they could change a don't did it.

I swear reporters really should talk about ratios like this more more than gross sums when they report on big fines. Too bad that's not sensational enough for the current rat race.

I thought the same but having worked 2 years close to CIOs I have realized their job is quite hard as it is. CIOs have to navigate hundreds of technologies and each vendor wants their cut, sometimes US startups are the worst… so choosing an old established technology still makes sense for most of IT people to manage tech and vendor risks… not a great answer, I know.