Podcast with Itan Barmes - Deloitte

My guest today is Itan Barmes, Quantum Lead at Deloitte Nederland. Itan and I spoke about a new World Economic Forum initiative on quantum computing, the impact of quantum on cybersecurity and much more.

Listen to additional episodes by selecting 'podcasts' on our Insights page

The full transcript is below

Yuval Boger (CMO, Classiq): Hello Itan. Thanks for joining me today.

Itan Barnes (Deloitte): Hi Yuval. Thank you very much for inviting me.

Yuval: Absolutely. So who are you and what do you do?

Itan: My name is Itan Barmes. I'm a physicist by training. After finishing my Ph.D., I moved into cybersecurity, and for the past two years, I've been with the Deloitte cyber team. My role at Deloitte is divided into two. On the one hand, for about 80%, I'm a cyber security consultant focusing on the impact of quantum technologies on cyber, and for the other 20%, I'm in an innovation project within Deloitte on more of the quantum algorithm sides. And as of two months ago, I'm also the project fellow for the World Economic Forum, where Deloitte helps the forum on quantum technologies.

Yuval: That sounds like you have a 120% job, but let's start diving into it one part at a time. You mentioned that the majority of your time is spent on cyber. Is that the quantum impact on cyber, or is it cyber in general?

Itan: I'm generally in the cyber team. At Deloitte, we have very large cyber teams in different geographies, and it's cyber in general. So we do a lot of, in my case, cryptography-related projects, and in the past, well, I would say one to two years, more and more quantum-related projects. I would love that most of our work will be on quantum one day, but that's definitely not the case yet.

Yuval: When you speak to customers, do they worry about quantum and the impact on cyber? They must have read that the RSA code will be broken, and no one will be able to use this and that kind of encryption. Is that something that reaches customers? Are they worried about it?

Itan: Absolutely, yes. And you can also see a very interesting development in the past few years that as quantum becomes more mature and we have quantum computers with more qubits, and we can do more with these machines, then also the negative aspects are becoming more visible. There was an interesting point in 2019 with the Google experiment, quantum supremacy, that there were already quite a few publications about how this machine could break cryptography, which is of course not true, but that was a big buzz. It was good that we put it out quickly because it was just not true. But it does raise awareness, and people are becoming more aware of it and also more interested in it, which is definitely a good development.

Yuval: What do you tell customers when they ask you about it? Do you tell them, "Oh, don't worry. It's ten years out," or do you tell them, "Well, don't worry immediately, but this is what you're going to have to do, and here's how Deloitte could help you," what is the standard answer in this case?

Itan: Yeah, so we've developed a model for this and presenting the two extremes. One of them is we call it the ostrich effect, putting your head in the sand and trying to ignoring it. And the other one is running around and looking for solutions. And we believe in what we call a responsible approach because eventually, as much as quantum is a fascinating technology that is maybe largely misunderstood, the cyber security aspect, it's a threat. Like any other cyber security threat, I need to do proper risk management, analyze the threats, and find the right way for your organization to deal with them. So we're trying to peel out the hype and to make it more concrete and more explainable in simple words and to really understand what it means.

Yuval: Cyber is interesting because when you think about the impact of quantum on various industries, usually the focus is on the positive side. Oh, you can discover new molecules. You can do supply chain optimization better. You could do better quantum machine learning. But on cyber, it's been on the negative side, oh, you're, you'll break this code, and so on. Do you see the positive implications of quantum computing on cybersecurity?

Itan: That is a great question. And there are at least two aspects that are fairly well known on this. And one of them is the random number generation, and the other is QKD, quantum key distribution. And some people present QKD as the solution for the negative aspect of quantum computing. And it's a very interesting topic, and I think that it's not completely decided yet. There is an interesting rivalry between mathematicians and physicists. Mathematicians, cryptographers, realizing that there is a problem with the current cryptography, and then the physicists coming in and providing a solution. And then the cryptographers saying, "You're a physicist; you don't know anything about cryptography." So I think a lot of it is maybe even a language barrier. And, again, in the past few years, there's been a lot of discussion about this.

And I think the industry is becoming more mature, and we are zooming in to specific programs and seeing how these technologies can help. So, in the beginning, it was presented as a solution for everything. Now the discussions are much more focused on seeing what situations and specific solutions can be the proper solution. So, this is one aspect that is very interesting. The other one is random number generation, which is extremely important for cryptography. If you cannot generate random numbers, then the risk literally just doesn't work. So, there are quantum methods to generate real random numbers. It's very easy to explain. It's just because of the nature of quantum mechanics, which is non-deterministic, so that you can generate these numbers.

How much is this going to be used? It's more of a business question because if it costs so much to generate the classical random number, which might be not 100% random, it really depends on this new technology, how cheap it's going to be. After all, eventually, it has to be economical, but both of these aspects of random number generation and quantum key distribution are definitely in the spotlight.

Yuval: Some people have spoken about the quantum equivalent of fuzzing, the ability to analyze multiple paths as a way to find perhaps weak spots for intrusion detection or bug fixing. Do you see that as relevant to quantum as well?

Itan: I think that's more of a general statement. So when we talk about quantum machine learning, if we find the right methods to do machine learning with quantum algorithms, it will have impact on machine learning in general. So one application can be standard and is intrusion detection. I haven't seen serious attempts to do things very specific for cyber, but maybe it's me, but I don't think that is a very mature topic at the moment.

Yuval: So just before we leave cyber, just talk about random number generation. Again, there are random numbers generated today and in very many algorithms, and even though they're not truly random, how much better is it to have a truly random number? How much improvement, how could you quantify or explain to a customer why they need a different random number generator?

Itan: That's, again, a good question and not a very easy one to solve or answer. It's again the difference between theory and practice. In theory, having predictable numbers, you can have really good cryptography. Still, if you generate, let's say, to encrypt two different messages, if you generate the same random number, then an attacker could compare them and derive the private key and completely break the encryption behind it. So, in theory, the numbers you generate have to be 100% random. In practice, these attacks are not that trivial, and it's not necessarily that an attacker would see an encrypted message and has to analyze and define messages that were encrypted with the same random number. So it's not that if you don't have a perfect random number generator, then it will be broken with 100% certainty.

And again, it depends on the application. So how much is breaking a certain message? What's the value of it? If it's breaking blockchain, for example, and stealing Bitcoins, that is worth a lot of money. If it's just one message that if it's broken, it's not the end of the world. Then, it's just putting a price tag on these random numbers. I think that, in general there is also an interesting development in quantum random number generation, new methods that also give you certifiable random numbers. And that is also important for, for example, compliancy. So you need to show that your random numbers are random. And if there is a way with quantum to do it in a simpler way, then it can be very beneficial.

Yuval: You mentioned that 80% of your time is spent on cyber security. And then there's another portion that you spend on quantum algorithms. Is that more of an internal research project, or do you work with customers on that? Could you elaborate a little bit on that side of your activity?

Itan: Yeah. So Deloitte is a global company with, I think, it's about 300,000 employees. And on the quantum front, we have multiple teams in different geographies, and usually these teams focused on different areas. So we have people focusing on finance applications and quantum chemistry and quantum machine learning, and here in the Netherlands, we're where I am, we do more support. So my background is in physics, and we've done a lot of work on understanding how these algorithms work. So I'm doing more support of the team. So we have discussions between the different teams, we have very different backgrounds, so we'd have some people with pure machine learning background, data scientists with less knowledge on quantum and then me and some other people with a stronger, let's say, theoretical backgrounds, we help them also to understand how these things work exactly.

So you also see that the diversity in background is very important and something that in quantum, in general, I think that the whole field definitely started with physicists, and you see that it's getting more mature. Everyone is focusing on what they're good at. So physicists and engineers would do the hardware. I think that even mathematicians might be the best people to understand the algorithms. Data scientists need to use it, so they also need to understand it to a certain level, and putting all these different backgrounds together is really what makes this successful. And this is the approach that we're taking.

Yuval: At Classiq, we think that's a big problem because it seems to be a shortage of people who understand quantum information science. It's very difficult to find the quantum information scientist and it's even more difficult to find one that also understands supply chain or chemistry, or cybersecurity. So we think that allowing people to write algorithms, even if they're not quantum information science experts, is very important. Do you share that view?

Itan: Yeah, I think that's a great point, and I've been thinking a lot about this. And so, I've taught the basics of quantum algorithms to a lot of people with no background in physics, to different levels of success. When you drive a car, you don't have to understand how an engine works, but it is useful to maybe maneuver in a certain way to understand the physics of driving. So you need to understand it to a certain extent. And I think that quantum computing is also a topic that some people are afraid of. People expect an explanation about what superposition is, what is spooky action at a distance. And these things are not necessarily needed to use this technology properly.

So, I think it's very important that a lot of companies work on finding the right way to teach people to a certain extent, but also filter what is not necessary. And our training's for quantum computing for data scientists or computer scientists. And then you focus on relevant things, and if people are interested in spooky action at a distance, that's fine, but you need to stay focused on the things you need to know and then bring in your expertise your knowledge to bridge the gap.

The way to do it, I don't have a clear answer for that. So, there are different approaches, and it's something that, as the field matures, will fine-tune it to make it more successful.

Yuval: As we get closer to the end of our discussion today, you briefly mentioned that you're starting an activity with the World Economic Forum. Could you tell me a bit of that?

Itan: Yeah. And that's also an interesting development in these kinds of technologies that become more mainstream, is maybe going to be too far, but getting more attention. Definitely, on the cyber side, it's something that policymakers need to form an opinion about. And the technology is now mature enough that organizations like the World Economic Forum are picking this up. And that is a very welcomed development. And so the World Economic Forum is starting a large program on this topic, including the mode application side or the positive aspects that you mentioned earlier, as well as the cyber security aspects. And we are helping the forum with this program. It's something that is just starting now. There is a program launch somewhere in September, and we are still working on defining the activities. And the goal is to really bring it to the attention of the executive with companies, policymakers, filtering the noise, on the one hand, focusing on the important aspects and bring more clarity, let's say, for society on this topic.

Yuval: It certainly sounds like a sign of starting to go mainstream. So that's very welcome. Itan, how can people get in touch with you to learn more about your work?

Itan: I think that probably LinkedIn is the best way to get to me. I think Googling my name will probably get some hits. We've published a number of articles recently. One of them specifically about the threats of quantum computing to Bitcoin that turned out to be very successful. So if you're interested in that topic, then look it up. And if there are any questions, then definitely reach out to me.

Yuval: Excellent. Thank you so much for joining me today.

Itan: Again, thank you for inviting me.