Cybersecurity Startup Allegedly Hyped Itself

 

"Encryption System

To Employ Satellites

Arqit Quantum Inc. is building an encryption system designed to protect computer systems from quantum computers, which are forecast to someday be able to break the security on nearly all existing commercial cryptography systems.

The company has said its technology would revolutionize computer security and draw customers from major corporations and the defense sector. Several former senior officials with British intelligence agency GCHQ, as well as retired U.S. and U.K. generals, serve on Arqit's board and advisory committees or in management.

Founded by veterans of the satellite industry, Arqit plans to incorporate space-based transmissions as part of its encryption system, coupled with a different way of distributing secure secret encryption keys than current technology does.

It launched one part of the encryption product in August without the space-based component, which it says will make the system even more secure when it comes online in 2023.

The encryption system -- with or without its satellite components -- depends on the broad adoption of new protocols and standards for telecommunications, cloud computing and internet services that currently aren't widely supported, people familiar with the matter said.

Steve Weis, a San Francisco-based cryptographer, said that what Arqit was proposing -- relying in part on transmitting quantum information from satellites -- is a well-known 1980s-era technology with limited real-world application. "There have been many proofs of concept and companies trying to sell products," he said. "The issue is that there is no practical-use case."

Some senior U.S. national-security officials have reached similar conclusions.

---

A U.K. cybersecurity startup rocketed to a multibillion-dollar valuation when it listed publicly last fall on the promise of making encryption technology that would protect the defense industry, corporations and consumers alike from the prying eyes of next-generation computer systems. Founder and Chief Executive David Williams told investors at the time that his company, Arqit Quantum Inc., had an "impressive backlog" of revenue and was ready "for hyperscale growth."

But Arqit has given investors an overly optimistic view of its future revenue and the readiness and workability of its signature encryption system, according to former employees and other people familiar with the company, and documents viewed by The Wall Street Journal.

While the company says it has a solution to a quantum-computing security challenge that U.S. intelligence last year said "could be devastating to national security systems and the nation," government cybersecurity experts in the U.S. and the U.K. have cast doubt on the utility of Arqit's system.

Arqit's stock price reached its highest level to date of $38.06 on Nov. 30 and has since fallen to $12.49, including a 17% drop Monday. There has been a broad pullback of young tech stocks.

When the company secured its Nasdaq listing last autumn, its revenue consisted of a handful of government grants and small research contracts, and its signature product was an early-stage prototype unable to encrypt anything in practical use, according to the people. The encryption technology the company hinges on -- a system to protect against next-generation quantum computers -- might never apply beyond niche uses, numerous people inside and outside the company warned, unless there were a major overhaul of internet protocols.

Arqit disputed that its encryption system was only a prototype at the company's market debut. "This was a live production software release and not a demonstration or trial," said a company representative. "It was being used by enterprise customers on that day and subsequently for testing and integration purposes, because they need to build Arqit's software into their products."

In Arqit's investor presentation shortly before going public, Mr. Williams said the company's technology can solve the problem of quantum attack "for every connected device in the world and that means that the Arqit business is now suitable for hyperscale growth."

Arqit went public by merging with a special-purpose acquisition company. The SPAC process gives companies more freedom to woo investors with projections of future revenue and profit,a dynamic that has helped many companies with no revenue list publicly at multibillion-dollar valuations.

In light of investment-protection concerns, U.S. regulators last month proposed new requirements for SPACs. Bankers and other supporters say SPACs provide a crucial path for investors to get into fast-growing companies early.

Arqit's stated aim to future-proof communication systems from the danger of a quantum computer is a top concern for policy makers. Senior U.S. national-security officials in recent years have warned with increasing urgency of a potential national-security calamity if China or another adversary achieves a breakthrough in quantum computing, which relies on quantum bits, or qubits, to represent and store information in a quantum state that is a complex mix of zeros and ones, rather than traditional binary computers that store information as either one or the other.

British cybersecurity officials questioned the viability of Arqit's proposed approach to encryption technology in a high-level evaluation they privately shared with the company in the summer of 2020, according to people familiar with the matter.

Asked about the negative review, a spokesman for Britain's National Cyber Security Centre said the agency "helps companies understand the security properties of their products and systems, including those in the quantum sector. We do this on a case-by-case basis, and in confidence."

Through a spokesman, Arqit said it "has a positive, ongoing relationship with the NCSC" and that the agency hasn't reviewed its current technology.

The U.S. National Security Agency and the NCSC published separate assessments in recent years warning against using satellite-based encryption systems like those Arqit is proposing to integrate into its current product in the next few years. The NSA said its warning was unrelated to any specific vendor.

In April 2021, Arqit's chief revenue officer resigned after raising concerns with Mr. Williams that he was overstating contracts and giving unrealistic revenue projections to potential investors, people familiar with the matter said. Several other former employees said they had similar concerns about both the business model and the maturity of the technology, prompting them to also leave since then.

The technology, which is called Quantum Key Distribution, has been the subject of study and debate within the national-security world for decades.

"QKD is a wonderful quantum-physics demonstration and elements of it have potential long-term implications for various technologies," a senior U.S. defense official said. "That said, widespread adoption of QKD would likely require a physical rebuild of the internet to be effective."

Arqit said it "does not, and never has, supplied QKD technology" and instead has invented a new quantum protocol that solves problems presented by previous iterations of the technology and combines that with a different way of delivering encryption services. The company said it has made improvements on 1980s-era QKD protocols and is building a system that is fundamentally different from earlier generations of the technology.

Beyond the technological concerns, Arqit's revenue and profit projections have come under fire. When the company announced its SPAC merger in May 2021, a month after the chief revenue officer resigned, it publicly released forecasts that the startup would rapidly become highly profitable, projecting $660 million in revenue in 2025, from which the company expected $447 million in earnings before costs such as depreciation and taxes.

Key to the company's pitch was its claim that it had a large stream of future revenue locked in as the product was live and already selling well.

"Customers are using the Arqit products today -- and they are universally finding it to be an important part of their technology future," Mr. Williams said in an August investor presentation shortly before the merger closed. He added, "The Quantum Cloud product is live for service and we already have $130 million in signed committed revenue contracts."

"These are contracts where the revenues will definitely be delivered," the CEO said.

The people familiar with the matter said that the bulk of the company's committed revenue isn't from selling its product and that at its public launch, the company had little more than an early-stage prototype of its encryption system.

Several clients the company lists -- including a number of British government agencies -- are simply giving Arqit research grants, nonbinding memorandums of understanding or research agreements that come with no funding, not contracts for its encryption product, they said.

No commercial customer was using Arqit's encryption system with live data when it made its market debut in September, the people said, and the system couldn't meaningfully use any of the common internet protocols required to do nearly anything online. They said it has signed two master distribution agreements with BT Group PLC and Sumitomo Corp. for the still-unrealized satellite component of its technology that are cancelable under certain conditions.

BT declined to comment on what it said were "private contractual agreements." Sumitomo declined to comment, citing a nondisclosure agreement.

Arqit defended the maturity of its technology and said its master distribution agreements contained guaranteed revenue. It declined to discuss specifics. Charles Palmer, a spokesman for Arqit, said it was "incorrect and misleading" to say Arqit's major contracts were cancelable.

In securities filings, Arqit was less definitive about its future revenue: It said its customer contracts are contingent upon the "successful delivery of operational technology, which is still under development," and that some contracts depended on successfully completing pilot programs with customers.

Inside the company, Mr. Williams was frequently an abrasive and volatile presence, former employees said, presenting an additional factor alongside doubts about the product for many who have left the company. The former head of human resources, Jane Bashford-Hobbs, has filed a formal complaint with a British tribunal alleging that Mr. Williams bullied employees and that Arqit discriminates on gender in its compensation. Arqit and Mr. Williams didn't respond to requests for comment on the complaint, which remains under seal.

When Britain's NCSC unfavorably evaluated the company's proposed technology nearly two years ago, Mr. Williams was apoplectic, according to people who worked for Arqit at the time. Employees who witnessed Mr. Williams's reaction were concerned that the incident showed an inability to respond constructively to legitimate feedback, people familiar with the matter said.

Through a spokesman, Mr. Williams declined to comment." [1]

1. Cybersecurity Startup Allegedly Hyped Itself
Tau, Byron; Volz, Dustin.
Wall Street Journal, Eastern edition; New York, N.Y. [New York, N.Y]. 19 Apr 2022: B.1.