Eric White So tell us about this latest bill in the Senate that looks to protect against quantum cryptography attacks, and then we can kind of go into where things currently lie.
Rebecca Krauthamer Absolutely. So since 2022, there’s been sort of a string of government action in the U.S. saying first, hey, look, take this very seriously, start looking at your encryption, start inventorying. All the way through to now, so in January, there was an executive order that really pushed things a little bit further once again. And now we’re seeing yet again, there is another act that’s going through and likely to be signed. At the end of 2022, H.R. 7535 was signed into law almost by unanimous vote. This is also expected to pass and enhance that. So really the crux of it is that, what we know is that China has put in something north of $15 billion into quantum computing research. And many nations with the U.S. and China being the leaders in this space, are putting a lot of money into researching and developing quantum computers, which will do great good, but also at a certain scale, they will be cryptographically relevant. And that means, like you said, they can then slice through our cryptography that we use to keep data as it travels over a network secure. The acceleration that we’re seeing in government action really comes down to this idea of harvest now, decrypt later, or the idea that nation states can harvest data, stockpile it for that later decryption when a quantum computer comes online that is cryptographically relevant.
Eric White So is that what this new legislation and previous legislation mostly calls for, just the idea of putting money towards it, or are there any actual requirements that it is going to start holding agencies accountable for?
Rebecca Krauthamer So now it is official that agencies have to, every year, I believe in April, agencies have produce an updated inventory of their cryptographic assets. So there’s a template. These agencies have to now deliver this. I’ve taken stock. Here is where my cryptography lives. And it is still, we’re still in that planning phase, but what we’re seeing, we work, for example, closely with Air Force and Army. We do that migration part of it. So that is what this new action is pushing forward, putting money towards that migration piece, not just the inventory piece, because it’s nice to know where your cryptography lives, but really what matters at the end of the day is protecting it. And so that’s what this action gets a little bit closer to.
Eric White I’m going to ask you a simple question that probably is a very complicated answer. So as best as you can break it down, I’m going ask you to do so. How does necessarily staying ahead of potential cryptography attacks, how does that work necessarily? Is it just all about keeping — having the faster gun? Or are there certain things that you can do when that data is getting put out? Can you set your data up so that, okay, you can hold on to it, but it can’t come back to bite us in the future. Like I said, I know I’m oversimplifying it, but that’s what we do here.
Rebecca Krauthamer No, no, that’s exactly right. And so one of the forefathers of quantum computing, Richard Feynman said something like, if you can’t explain something simply, then you don’t really understand it. So I love it. And yes, what most people still, I think, find surprising is you do not need a quantum computer to fight against a quantum computer. You just need better math. So there are new standards put out by NIST [(National Institute of Standards and Technology)] that are called post-quantum cryptographic algorithms. They’re just regular math problems that we know, via mathematical proofs, stand up against quantum decryption. So that’s what we do is we work with agencies to essentially retrofit, whether it’s legacy infrastructure or otherwise, we pop those new algorithms in. And we know that if data is encrypted with those algorithms, even if it’s harvested for later decryption, they’re not going to be able to decrypt it with a quantum computer or a regular computer. So the fix is, yeah, I won’t call it simple, but it is a lot less complicated than a lot of people assume.
Eric White And has that been, I guess, your main job other than actually doing it? How has the powers that be taken to having this explained to them? Like you said, it’s been seen as success with the administration and Congress obviously taking it seriously, but I’m going to assume that wasn’t always the case.
Rebecca Krauthamer No. So we started QuSecure back in late 2019, and we got initial funding from the Air Force. So they were thinking about it, but it was up until let’s say, really 2022, we were kind of, for lack of a better word, the crazy people that were talking about this quantum threat thing. But a lot of the government did see it. But so much of our job, yes, has been this education, because I think people see this big bad, and so much money is put into, I’ve heard it called China’s Manhattan Project,. But it’s been a fun job to just be able to go in and say, hey, this is not that scary, this is not that complex. It’s yet another encryption migration and that we know that these encryption algorithms are going to stand up for quite some time under the threat of quantum logic and regular logic. Now, also a lot of what we do is educating as well. No encryption is meant to last forever. So really fundamentally what we’re doing right now, quantum is in some ways a great catalyst. We have a fix, but it is also forcing us to think about how we manage encryption in a whole new way that is more agile, whether it’s for AI threats in the future, quantum threats in future, or people love to talk about quantum AI threats in the feature. It’s a lot of buzzwords combined together, but it’s really forcing us to rethink the fundamentals of how we make sure encryption adapts to dynamic future threats. And so that’s also a lot of what we talk about as well.
Eric White Yes, that was a shotgun blast of buzzwords there, looked like my inbox.
Rebecca Krauthamer To make it simple, I think the top thing, that we talk to everyone from lawmakers all the way to program PEOs to everyone in between. And it really comes down to, it’s encryption, it’s math, it’s regular math, no quantum is involved. And when people realize that they can solve it today, rather than going through many years of R&D or retrofitting stuff that they’ve put millions and millions of dollars into building, that they don’t have to pull that out. Those are the aha moments that we’ve kind of loved having in the last several years.
Eric White We’re speaking with Rebecca Krauthamer. She is the CEO for QuSecure. And obviously, this isn’t your main concern. Well, maybe it is a little bit. But the adversary or opponent is clear in this space, and that is China. What can you tell me about where that race currently stands and if they do anything different? Obviously, I’m sure they do. Or maybe they don’t. Is it really just a race to try to get to the next step before the other person?
Rebecca Krauthamer So China has a very centralized program and they’ve been putting lots and lots of money into this for many, many years. In the U.S., a lot of the money has gone into private enterprise and from everything that we know, the U.S. is more advanced. The thing I would point out is that when what they call that cryptographically relevant quantum computer comes online, and that’s a quantum computer of, let’s say 4,000 qubits, we’re likely to know. And if you have that powerful of a technology, you’re probably not going to write a press release about it. You’re going to keep that secret, just like in World War II, when Bletchley Park, like Alan Turing, came up with a way to break the German codes, didn’t advertise that, right? Used it to our advantage for quite some time. That’s where we are with quantum computers. We’re unlikely to know when there is a quantum computer that can break those codes. And in the meantime, all of that data is being stockpiled and intercepted for when that day comes. If someone tells you they know when a quantum computer will be able to break encryption, they’re probably lying, but it is likely that it will happen in the next five to 10 years, and we won’t know, which makes that the idea that we have to put in those new algorithms all the more urgent.
Eric White And obviously, there’s always room to improve. You all seem to be happy about these steps that the government and the administration and Congress are taking. What more can be done in this area? If you were in charge, what would you do?
Rebecca Krauthamer So a lot of the effort focuses on that housekeeping, that take stock, take inventory, report on what you have. One of the heads of our federal group, he said it well. He said, if the house is on fire, it’s not really the time to organize your filing cabinets. So if I were in charge, what I would put a lot more focus on is the actual, let’s adopt these new algorithms. Because again, it is a lot more simple than most people give it credit for. And this applies throughout government. It also applies throughout private enterprise, right? I heard the previous CTO of the CIA put it this way. He said, in the next 10 years, everyone is going to have their own WikiLeaks moment if they don’t — if they’re not using services that are protected for post quantum world, post quantum cryptography. So that is what I would focus on, the migration, rather than the cleanup and filing cabinets.
Copyright
© 2025 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.
