Google spinoff Sandbox AQ gets backing from CIA’s venture arm

The Central Intelligence Agency’s venture capital firm has invested in Sandbox AQ, a Google software spinoff that is focused on harnessing artificial intelligence and quantum science.

The CIA’s In-Q-Tel was joined by Paladin Capital Group, which backs innovative tech companies, in Sandbox AQ’s first round of fundraising. The round – which is oversubscribed and still open – has garnered ‘well into the nine figures,’ Sandbox AQ chief executive officer Jack Hidary said in an interview.

Founded in 2016, Sandbox AQ was spun off from Alphabet’s Google earlier this month and is chaired by Eric Schmidt, the search giant’s former CEO. Instead of making a quantum computer of its own, Sandbox AQ seeks to develop software architecture that can replace existing cryptography with complex new algorithms that are deemed impossible to crack by quantum computers, a nascent technology that isn’t yet operationally viable.

Steve Bowsher, president of In-Q-Tel, said the aim of the equity stake was to develop new encryption software that could resist the prospect of code-cracking by emergent quantum computing, as well as quantum sensors and other products.

“We want them to be able to sell into the U.S. government,” Bowsher said in an interview. He added the venture firm had spent the past few weeks introducing Sandbox AQ’s work to some of the eight US intelligence agencies that it works with, which include the National Security Agency, Federal Bureau of Investigation and CIA.

Paladin Capital chief investment officer Chris Steed predicted Sandbox AQ could come to dominate a market that would be worth tens of billions of dollars. Industry analysts IQT Research estimated last year the market for post-quantum cryptography will grow to $2.3bn by 2026 and $7.6bn by 2030.

In-Q-Tel and Paladin’s backing would allow Sandbox AQ to develop relationships to work closely with US and allied governments on roll out, said Hidary. While it was ‘wonderfu’ to have early-mover advantage, the strength of its software, expert team of more than 55 people and alliances were more critical for success, he added.

Scientists differ over when a breakthrough in quantum computing might arrive, with estimates spanning five to 50 years – or never at all.

Joe Altepeter, who manages a quantum research program at the Pentagon’s Defense Advanced Research Projects Agency, said last month there was a lot of ‘hype’ over industry claims about the arrival of quantum computing, which has drawn billions of dollars in investment, though several ‘hardware miracles’ still stand in the way.

While there was “definitely still a possibility that quantum ultimately doesn’t develop” and so the problem would never manifest, Bowsher said it was important to prepare in advance “because you don’t want to be caught flat-footed.”

He added that it was hard to know how close China, which is investing billions of dollars into quantum research, might be to cracking public-key encryption. “If you wait until then, it would be too late,” he said.

Experts warn encrypted data that is stolen and stockpiled en masse could be cracked at scale as soon as quantum computing comes online. That could risk troves of commercial and government secrets, some of which remain classified for 25 years or far longer.

Wary of the coming threat, the Biden administration in January tasked national security systems to come up with transition plans to help defend against the theoretical threat to public-key encryption posed by the arrival of quantum computers.

The National Institute of Standards and Technology, known as NIST, is seeking to select new quantum-proof encryption algorithms from seven finalists shortly as part of a global competition. Two of the shortlisted algorithms come from the team behind PQShield, an Oxford University spinoff that also offers post-quantum cryptographic software. Winners will be slotted into Sandbox AQ’s and other companies’ software architecture.

Sandbox AQ has also newly formed partnerships with Ernst & Young and Deloitte to offer services to thousands of their customers, including initially an inventory of existing software. Financial, pharmaceutical and telecommunications companies, which have some of the most sensitive data to protect, are likely to be at the forefront of efforts to create a new marketplace in post-quantum cryptography.

“We’re not being alarmist and saying you need to change everything today,” said Colin Soutar, who leads cyber strategy at Deloitte Risk & Financial Advisory. “But I do want to say that organizations should start taking a prudent look at what they have.”

Some in the private sector are already taking the plunge. Mount Sinai Health System in New York and its 7,000 physicians became a customer of Sandbox AQ’s discovery services last month, said Chief Information Officer Kristin Myers. That will enable the healthcare company, which has revenue of $9.3 billion a year, to review all the software it would need to update to prepare for post-quantum cryptography, before determining if it will go ahead with the transition.

“I think this is the way the industry will go, especially in the next five years,” Myers said, adding she took the step to safeguard patient confidentiality.

Read: Google to acquire cybersecurity firm Mandiant for $5.4bn