Terry Gerton You are an expert in quantum computing. And every time I hear about quantum computing, it’s just around the corner, just around the corner just around the corner. Is there something that’s happening now that makes it like on this corner and not around the next corner?

Victor Foulk Well, I’d argue it’s more than a planning issue today. It’s really become, in many ways, suddenly an execution issue. I think we’re loosely following a trajectory like the way we saw for artificial intelligence. With that, similar argument. AI had been researched since the ’50s, and then suddenly a confluence of new technological approaches, the availability of hyperscale compute and massive funding and regulations triggered what I’d say is a state shift in our world order. The various technologies underlying, you know, big Q quantum, have been evolving since the ’80s and are now strikingly similar in my eyes in terms of trajectory. If you look at the data, we’ve got innovators multiplying by leaps and bounds globally. We’ve got technological breakthroughs in compute and sensing that hit the headlines almost daily. And let’s be honest, the forecast for the security implications are more dire in the headlines than ever. Other data, in the U.S. Standards have arrived. NIST finalized post quantum encryption standards in August of ’24. And before that, prepare for quantum was just advice. Now it’s actual migration with specifications and a due date. Policies move from planning to doing. In June, two executive orders landed on the same day. One was pushing quantum innovation, the other securing against quantum cryptographic attacks. OMB followed closely after that with a memo emphasizing execution of migration, not just planning. And lastly, I’d say money has moved, a lot of it. In May, commerce signed letters of intent worth something on the order of $2 billion across nine companies and took equity stakes. Three of those were finalized just days ago and globally, billions and then billions more flowed into quantum investments. And that’s just the past couple of months. I think we’re pretty clearly at an inflection point.

Terry Gerton I love the comparison to AI. I think about that exponential growth curve. Sounds like you’re saying we’re kind of at that near the curve or maybe on the upward slope there. But all of those things that you just talked about all say quantum, but when we talk about quantum, it’s not just a single technology, right? There are a whole bunch of different pieces in that. Help us unpack what the different pieces of a quantum strategy would be.

Victor Foulk Absolutely. I mean, that’s always been a challenging aspect of this domain and that big Q quantum, as we call it, it’s always several different technologies. And let’s be honest, not all of them are quantum. We’ve got different maturity, different budgets, different owners and different timelines. And they’re separately, these are all separate work streams hiding under that one word. And practically that matters because you can’t fund a single monolithic quantum initiative. In terms of broad bucket categories, we’ve got quantum sensing. Which applies to leveraging the technology for timing, navigation, and detection. We’ve got computing, which is the machine that everyone glamorizes today. And then there’s post-quantum cryptography, which is protecting today’s systems against tomorrow’s machine, which isn’t quantum at all. It’s classical cryptography running on systems that agencies own today. And it’s designed to defend against the forecasted compute capability on the horizon. There’s no qubits anywhere in it. I’d say sensing is closest with fielded hardware. Computing is genuinely still early, though some modalities like annealing are supporting real workloads and ROI today, which we can talk about. But the most urgent priority for all of us is post-quantum or quantum-ready cryptography, because the harvest now decrypt later challenge is, it’s more than a buzzword. It’s a very real nation-state threat.

Terry Gerton Tell us more about that because for people like me who can barely spell quantum, that part, I can get my head around. Harvest now, decrypt later.

Victor Foulk We’re talking about this now because we’re almost definitely already late. The reality is encryption has to protect data for its entire useful life, not just today and not just in transit. Earlier in my career, I served as one of a small number of servants in government that, that had the unique authority to make original classification determinations, that’s identifying what must be legally withheld from the public for how long and why those are, those are decisions we sign our name to, and we do so based on real security risk and often with lives at The information that we’re talking about here, it’s classified for five, 10, 15, 25, or 50, or more years depending on the subject. And the reason for that is because the danger from compromise is real for that long. That means an adversary copying your encrypted traffic today doesn’t need to break it right now. They just need to to break it before it stops being important. Which means storage and prioritization are the only limitations for them between now and then. So for us, the right question isn’t, when does a quantum computer arrive? The question is really, how long do my secrets need to stay secret? And the reality is we’ve got billions of dollars and years of work to migrate ourselves out of this problem. On timing, I’d argue nobody credible is locking in the exact doomsday date, where this future computes gonna be a reality. But we all know that for some of the information we have to protect, it’s essentially already lost.

Terry Gerton Victor Foulk is vice president of emerging technologies at CGI Federal. So Victor, I get that concept. You have to protect it for as long as it’s viable and important, but how do you protect something against a decryption technology that you can’t even imagine?

Victor Foulk Well, that’s really where the mandates and the NIST requirements come into play. We have to migrate. This is a big legacy IT modernization challenge ahead of us. Not unlike the legacy IT modernization challenges that have plagued government forever, but we have to migrate to new cryptologic standards. We have to protect the data that we need to protect today. And the clock is ticking.

Terry Gerton That conversation about harvest now decrypt later is a lot about cybersecurity. Let’s go back to sensing for a minute. You said that we’re closest there. Can you give us some examples of how sensing quantum is creating real mission value?

Victor Foulk Absolutely. So if you think about the global contested environment from a defense and national security perspective, you don’t need thousands and thousands of qubits like you do with compute to do effective quantum sensing. Areas where this is proving incredible value today and has incredible promise is with alternate position navigation and timing. You think about being able to execute a global mission, whether that be national security or logistics. Being able to do that on the globe without GPS, it’s a pretty challenging proposition. And so we’ve been working for a very long time with alternate position navigation and timing technologies to be able to divorce ourselves from GPS, which can be jammed and be able to continue those mission critical missions with technology like this.

Terry Gerton And so if you are an agency, CIO or CISO, and you’re trying to build your quantum migration strategy, where do you start and what are the practical steps that should be at the top of your priority list?

Victor Foulk So I call this the rule of four and five. So the first thing that I’ll say is there’s four rules around discipline that need to be followed. The first rule of the first pillar of discipline, build a coalition across government, industry, and academia. Aside from the cyber mandates, there’s still time to get this right. And really nobody should be solving this as a one-off. Fund the three workstreams separately. If appropriate, sensing, computing, cryptography, whichever one’s applicable, name the leaders, build the strategy. Third, buy outcomes and not machines. Access to these capabilities, really an API call these days, there’s no reason for an agency to focus on owning hardware to find out if it applies to the mission. We learned this with AI and the same thing applies here. And the fourth pillar is plan for year eight and that’s the one everyone skips. The technology clock’s real, but acquisition, integration, accreditation, and sustainment are all real clocks that need to be managed. And then for CISOs and CIOs, I think the near-term steps are pretty actionable. Inventory the cryptography, because you can’t migrate what you can find. This is the asset management challenge that applies to vulnerability management, legacy IT modernization, and spades. Second, map your data lifetime and sort the data, knowing how long it has to say secret and its exposure. That, not mission criticality, or system criticality rather, is the migration priority order. The crown jewels in an air gap SCIF may actually be a lower priority than mission data that flows over contested wires. Then I’d say read the OMB memo, notice the verb. It says execution. Ask then who owns this in your agency because GAO looked at federal quantum threat mitigation. They found no single federal entity owns coordinating the strategy. If nobody owns it inside your organization either, that’s your first fix. Lastly, build crypto agility. We have a big lift ahead of us to modernize legacy IT systems to the modern cryptographic standards. The goal isn’t to modify and swap one algorithm for another, we’re going to have to swap again at some point in the future. We want to make sure the next transition is easy and not a decade long program. Bonus sixth, get the acquisition workforce ready. We learned this in spades with AI. The requirement being right matters more than the pathway being fast. And those are lessons learned from the AI evolution that we can apply to the quantum era.

Terry Gerton All right, so I’m going to assume that every CISO and CTO is brilliant and has followed your advice, but they still have to compete for resources to execute that plan. How do they convince their non-IT leader, somebody like me who doesn’t know this from any other requirement that’s being brought to my desk, how do they make the case that this is urgent and needs to happen now?

Victor Foulk Well, I go back to the, there’s a couple of things. There’s the executive orders, the mandates. Mandates always play. The risk of information, the original classification discussion that we had earlier in the discussion, I think is part of the sense of urgency. The third thing that I’d say is, don’t treat this as a one-off technology evolution. Legacy IT modernization is an ongoing reality across government. We still have agencies that are modernizing their data state to truly capitalize on artificial intelligence. Those legacy IT modernization programs are funded. They have a multi-year pathway. This is just a new set of technical requirements that can be built into existing IT modernization portfolios. And if you treat it as a holistic evolution, you may get some changes in your prioritization strategy in terms of which systems and which technologies you upgrade first. But overall, this just applies some new requirements and some new risks to apply to an existing legacy IT modernization portfolio.