The PETs category includes technologies that protect, preserve, and enhance data throughout its processing lifecycle — technologies that have been studied deeply for decades. Homomorphic encryption (HE), for example, became broadly recognized thanks to research published by Craig Gentry in 2009. The timing of the story is similar for secure multiparty computation (SMPC) and trusted execution environments (TEEs). What has changed more recently is the practicality of their broad use at scale. Breakthroughs largely driven by market need and motivation have firmly taken these technologies from the realm of research to commercial readiness. These advances are being driven by a growing ecosystem of VC-backed startups, well-funded research components of global organizations, and academia.

There are a number of great examples of PETs being implemented at scale today. They are enabling cross-jurisdictional data sharing for Know Your Customer screenings and fraud investigations. They are allowing organizations to privately leverage third-party data assets without pooling or replicating data. They are facilitating more accurate risk assessment modeling by expanding the number of accessible data sources. They are protecting sensitive indicators and speeding time to value for applications at the processing edge. In short, PETs are making entirely new things possible across a growing number of industries by overcoming regulatory, organizational, security, and national boundaries to accommodate secure data usage and collaboration in ways that are not otherwise possible.

The power of PETs lies in their ability to protect data while it's being used or processed — when searches, analytics, and machine learning models are being run over data to extract value. This is different from, and complementary to, other traditional measures that protect Data at Rest, such as in the file system or database, or Data in Transit as it moves through the network. While there are many effective, established solutions for protecting Data at Rest and Data in Transit, if organizations want to be able to safely and privately extract value from data assets, these traditional protection strategies are not sufficient. Further, PETs do not replace existing solutions protecting Data at Rest and in Transit; they work alongside them to protect the final segment of the data triad, Data in Use.

In an emerging category like PETs, there is a tendency to pit technologies against each other to evaluate which technology reigns supreme. The reality is that these technologies each offer unique attributes and choosing the right ones depend entirely on the use case requirements, infrastructure, and the desired level and type of protection. PETs can, and often do, work together. For example, organizations can use a SMPC capability that leverages HE and vice versa. Or, SMPC and HE techniques can be leveraged in conjunction with a TEE. Organizations looking to utilize PETs should explore all the options available and educate themselves to determine the best fit. Commercial PETs companies, regulatory bodies, industry consortiums, market analysts, researchers, and other third-party groups have a role to play in these efforts to build awareness and enhance understanding. Likewise, those working in PETs space need to recognize and embrace the role we play in educating the market, in helping differentiate the technologies and explaining their often complementary nature, and do so in a way that acknowledges that the adoption of any and all PETs will best serve to address global privacy challenges.

PETs have a long and rich research history and, as such, many PETs are part of an active ecosystem which includes open source research libraries and algorithms. While it is fantastic to have a research foundation upon which to build, it is also important to remember that these elements are not ready-to-use commercial offerings. For example, HE libraries provide basic cryptographic components, but organizations leveraging them must dedicate engineering, algorithmic, and integration resources in order to mature the basic building blocks into viable, enterprise-grade solutions. Likewise, SMPC libraries offer basic algorithms and TEEs are built into many chips and cloud environments today, however, there is much work and deep expertise required to take these fundamental elements and build practical, commercial offerings to protect Data in Use at scale. That’s the value that commercial PETs software providers bring to the table: deep PETs knowledge and off-the-shelf capabilities that are ready to deploy and use today to solve real problems. The open source research landscape is an awesome tool for advancing innovative technologies and the PETs category has certainly benefited from the efforts of numerous contributors. But, these PETs research efforts are just the beginning of the story. Commercial solutions advance and give these research efforts the ‘wings’ required to add real, measurable value.

When homomorphic encryption (HE) was first theorized, it was simply not practical. Performing even the most basic operation (something as simple as 1+1) in ciphertext would take days and an amount of compute power that made it unreasonable for any broad applicability. But that is no longer the case. Advances in the underlying technology, as well as efficiencies relating to its use, mean that HE can now operate at the speed of business for a number of use cases.

Encrypted searches can be performed over millions of data records and returned within seconds rather than days or even weeks (yes, it started out that slow). Commercial and government entities are using HE operationally at scale today. Not working toward using it, but actually using it in production environments to solve real problems. One of the areas where early adopters have emerged is the financial services industry, for anti-money laundering applications.

Homomorphic encryption uniquely enables encrypted processing, allowing encrypted searches/analytics to be performed over both encrypted and unencrypted data. While HE-encrypted operations can be run over encrypted data, in many use cases, that level of protection is unnecessary. Take, for example, investors performing research to inform decision-making regarding a possible merger or acquisition. They likely turn to standard industry tools, including data aggregators, for the most current information available. Is the underlying data within these third-party environments sensitive? Not at all — investors just need to tap into existing information to learn about the company and its market positioning.

However, is the content of the search and reason behind the query sensitive? Absolutely. Exposing interest in a specific company could expose intent, potentially signaling to other interested parties and jeopardizing the investor’s bargaining power.

One of the most exciting use cases for HE is in the area of secure data sharing and collaboration. By allowing third parties to securely and privately work together, HE enables collaboration that was not previously possible. One of the key elements that has prevented such efforts from moving forward in the past is the need to pool sensitive data assets in order to make them accessible to a collective group. This is impractical for a number of reasons, at the core of which is an understandable unwillingness of organizations to increase their own risk and liability by giving up ownership of their assets.

While some implementations of HE suggest data must be pooled and encrypted in a centralized location, it is rarely practical or desirable. When HE is used specifically to protect the interaction with the data (i.e. the query or analytic), it can be done in a decentralized manner that allows all contributors to maintain control and ownership of their data assets.

While it can be confusing for those unfamiliar with the space, there is a significant difference between an HE library and an HE-powered solution. Think of it this way: an HE solution is the house; HE libraries are the raw lumber.

Homomorphic encryption libraries provide the basic cryptographic components for enabling the capabilities, but it takes a lot of work including software engineering, innovative algorithms, and enterprise integration features to get to a usable, commercial grade product. Companies who build and maintain these libraries do so via research teams. Vendors providing HE solutions have already built the house and often leverage HE libraries — while some may require remodeling to ensure the product addresses specific needs, the heavy lifting is done. When investigating offerings in the space, it is important organizations know what they are getting: raw building blocks, plans, or a house.