Quantum Risks Pose New Threats for US Federal Cybersecurity

The U.S. federal government is racing against time – and foreign adversaries – to safeguard critical infrastructure from the looming threat of quantum-powered cyberattacks.

See Also: OnDemand | Extended Access Management: Securing Access for All Identities, Devices and Applications

In the month after the National Institute for Standards and Technology formalized adoption of three post-quantum encryption algorithms, experts say federal networks remain significantly vulnerable to future quantum-enabled threats (see: US NIST Formalizes 3 Post-Quantum Algorithms).

Adversaries including China are investing heavily in quantum computing in an apparent effort to outpace the United States, where bureaucratic red tape and unforeseen costs could significantly hinder federal efforts to keep up.

“Upgrading this infrastructure isn’t going to be quick or cheap,” said Georgiana Shea, chief technologist of the Foundation for Defense of Democracies’ Center on Cyber and Technology Innovation. Testing for quantum-resistant encryption could reveal compatibility issues with legacy systems, such as increased power demands, reduced performance, larger key sizes and the need to adjust existing protocols and application stacks for keys and digital signatures, she told Information Security Media Group.

The Foundation for Defense of Democracies is set to release new guidance for CIOs on Monday that will aim to lay out a roadmap for quantum readiness. The report is structured as a six-point plan, starting with designating a leader, taking inventory of all encryption systems, prioritizing based on risk, understanding mitigation strategies, developing a transition plan and regularly monitoring and adjusting it as needed.

NIST unveiled post-quantum standards for general encryption along with two digital signature standards in August, and announced plans to formalize an additional algorithm for digital signatures, known as FALCON, later this year


The guidance followed a July White House report that estimated the cost of transitioning key federal systems to post-quantum encryption will be at least $7.1 billion through 2035.

Announcing the new standards last month, NIST Director Laurie Locascio said quantum computing technology “could become a force for solving many of society’s most intractable problems.”

In September, Department of Defense officials outlined several initiatives to enhance quantum readiness at the Quantum World Congress summit, including a Defense Advanced Research Projects Agency program designed to assess whether a quantum computer can be developed more quickly than currently expected. John Burke, principal director of quantum science for the Pentagon, told audiences that quantum computing at the Pentagon “might come very soon.”

Government watchdog reports have long warned that quantum technologies can process and transmit data in ways existing systems cannot, urging federal agencies and the Pentagon recruit a highly specialized staff in physics to address emerging risks associated with quantum computing. A 2021 Government Accountability Office report called for “billions of dollars in investments” and said advanced development of U.S. quantum readiness and technologies will require further collaboration and supply chain and workforce development.

“There is a global race to understand quantum computing and develop a cryptographically relevant quantum computer,” Shea told ISMG. “The winner will have a significant advantage in cyber warfare, cyber espionage, and advancing critical research areas.”