Federal Agencies Unprepared for Quantum Cryptography Threat

Why It Matters

None of the 24 Chief Financial Officer (CFO) Act agencies has fully addressed the three preparatory practices needed to transition federal systems to post-quantum cryptography, according to Quantum Computing: Federal Actions Needed to Prepare for Emerging Cyber Threat, a U.S. Government Accountability Office (GAO) report reissued with revisions on Oct. 14. ​

The gaps, rooted in insufficient cryptography expertise, missing inventory processes, and absent testing plans, leave sensitive federal data exposed to a future cryptographically relevant quantum computer (CRQC) that most industry experts believe could arrive as soon as the 2030s.

The Big Picture

Federal agencies rely on cryptography, the mathematical processes that lock, unlock, and authenticate information, to protect sensitive data and systems. Today's quantum computers cannot yet break that cryptography, but a CRQC of sufficient size and sophistication could compromise systems that authenticate users, allowing a malicious actor to access sensitive information or decrypt data collected and stored before such a machine exists. Development estimates for a cryptographically relevant quantum computer vary widely because of uncertainty in qubit growth rates and in how many qubits will be needed.