Q-Day is coming. The day when the world has machines that can accomplish tasks that traditional computers cannot, is the day we will see an explosion of innovation—and the possibilities are truly exciting. But it will come at a cost. For decades, our current encryption algorithms have proven reliable to defend against cyberattacks from conventional computers. However, a quantum computer will break these algorithms in a matter of seconds. That is Q-Day.
As Amit Mitwa recently wrote in Wired:
“On Q-Day, everything could become vulnerable, for everyone: emails, text messages, anonymous posts, location histories, Bitcoin wallets, police reports, hospital records, power stations, the entire global financial system.”
Quantum computing is growing rapidly, with investment flowing in from governments – particularly the US and China, but also from Europe. Both China and the EU are investing in quantum-resistant communications networks. Integrating quantum computing and defense technology, the People’s Liberation Army of China is pursuing next-generation combat capabilities based on its vision of future conflict, which it calls “intelligentized warfare” using quantum computing.
In the U.S., Congress is currently considering the National Quantum Initiative Reauthorization Act, which would increase funding, expand the role for the National Institute of Standards and Technology (NIST), and focus on practical applications in areas including healthcare, cryptography, and energy. The quantum race is well underway.
With quantum breakthroughs on the horizon, these machines will also unlock the world’s secrets. That world is known as “Post-Quantum Encryption” (PQE) or “Post-Quantum Cryptography” (PQC). The Secretary of Commerce has approved three PQC standards, and they are available for use today:
Federal Information Processing Standard (FIPS) 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard;
FIPS 204, Module-Lattice-Based Digital Signature Standard;
FIPS 205, Stateless Hash-Based Digital Signature Standard.
These standards are designed to resist future attacks by quantum computers. If applied today, they would prevent data stolen by attackers from being decrypted later by a quantum computer.
In anticipation of Q-Day, threat actors are harvesting large quantities of encrypted data and storing it until they can break the encryption keys using quantum computing. So today’s data exfiltration can become tomorrow’s data breach.
It’s important that companies don’t wait for their data to be the next “future data breach.”
Cryptographic infrastructure is complex, fragile, and often left tended by a small group of experts who understand it deeply and maintain it quietly. Migrating to a post-quantum encryption ecosystem will take time, resources, and potentially even training for personnel to make the shift. The U.S. Government is on track to be PQE ready by 2030. Industry lags behind.
A 2024 US Government advisory said it best: “Organizations are often unaware of the breadth of application and functional dependencies on public-key cryptography that exist within the products, applications, and services widely deployed within their operational environments, leading to a lack of visibility.” Time is of the essence.
For businesses that are under obligations to protect or encrypt customer data, failure to plan for quantum migration now may expose you to regulatory fines and oversight in the future. Governments are clear on the threat and the need to begin the migration journey now. Companies that ignore the post-quantum issue will have to be prepared to explain that choice to regulators and customers in the event of a PQC data breach. Government investigators and plaintiffs’ counsel will look to hold companies accountable for failure to plan, mitigate, and migrate should customer data be breached, either in a “harvest now, decrypt later” attack, or in a post Q-Day attack.
Don’t leave legal defenses on the table.
The EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) both require appropriate security for data protection and recognize encryption as a protective measure. Under the CCPA, encrypted data can provide immunity from private rights of action and may limit data breach notification requirements.
There are also a number of sector-specific regulations and standards that create legal obligations around encryption. For example, for healthcare companies, the Health Insurance Portability and Accountability Act (HIPAA) encryption requirements are significant.
For companies involved in payment processing, compliance with the Payment Card Industry (PCI) Digital Signature Standard (DSS) (or, PCI-DSS) and PCI Security Standards Council (PCI SCC) requirements may be by regulation, or by contract. Either way, they create obligations to maintain the ability to encrypt data. The US Federal Trade Commission (FTC) used PCI-DSS in its landmark data security case FTC v. Wyndham Worldwide Corporation, citing Wyndham’s failure to maintain reasonable data security practices, called out the company’s encryption failures and inadequacies in its ruling. Test cases involving failure to migrate to PQE are foreseeable.
If a company cannot encrypt customer data because it has not migrated to PQC, it could be a costly error in the case of a data breach – including a data breach that is decrypted in the future. CISOs should be meeting with their in-house counsel now to understand the legal risks.
It is true that migration to quantum-resistant encryption comes with substantial costs. Businesses must update systems and complex infrastructure to support these changes, and that’s going to require planning to complete migration by 2030. But the choice to ignore or defer migration will be even more costly if a company needs to “rip and replace” in a crisis. Good faith preparations today are also evidence for tomorrow’s investigations.
Once Q-Day comes. For those who haven’t migrated and heeded the warnings, regulators will be waiting.
Cristin is the managing partner of Advanced Cyber Law, a boutique law firm focused on cybersecurity, incident response, threat intelligence, and artificial intelligence. She and her team leverage Cristin’s 17 years as lead cybersecurity counsel at Microsoft, where she was head lawyer for the Microsoft Security Response Center, the Microsoft Threat Intelligence Center, the Government Security Program, cybersecurity law and compliance, and built Microsoft’s Digital Security Unit, fusing threat intelligence with geopolitical analysis, including Microsoft’s seminal Ukraine Report in April 2022. Cristin is also the founder and CEO of Advancing Cyber, a regulatory technology startup.
