THE QUANTUM INTELLIGENCER

An analysis published in Cybersecurity Law & Strategy, written by Brandon Hollinder of Epiq, argues that companies which once declined to report stolen data because it was encrypted cannot safely assume the question is closed. Quantum decryption may render such data readable years after exfiltration, turning an incident long judged harmless into what the author calls a breach without a new breach for the original data owner. The phrase 'harvest now, decrypt later,' long familiar to security teams, has become a compliance and disclosure matter with a long tail. On the institutional side, the article points to instruments already in place: the White House post-quantum Executive Order issued in June, with migration milestones around the late 2020s and 2030; the National Institute of Standards and Technology's first finalized post-quantum standards, ML-KEM, ML-DSA and SLH-DSA; and pilot deployments of hybrid classical and post-quantum TLS. It records no comparable movement on the backward-looking question of data already stolen. No regulator is named as having demanded an inventory of past encrypted-exfiltration decisions, and no company is named as having completed one. Mr Hollinder's advice to organizations is fourfold: inventory incidents where encryption was the reason for silence, rerun the regulatory analysis with quantum in view, consider securities disclosure, and plan migration toward quantum-resistant systems. Whether a later decryption triggers a fresh notification obligation remains a question the article poses rather than answers. The Executive Order and the standards are published instruments; the migration itself remains corporate work, and the article's complaint is that the people who sign off on breach determinations have not yet sustained it. The article supplies a small set of dates and numerals worth separating from its argument. Its illustrative interval spans an exfiltration in 2018 and a notional decryption in 2030. On the strength of existing ciphers, it reports that a properly implemented 256-bit AES key would take longer than the age of the universe to brute-force, while Shor's algorithm could reduce computations that occupy classical machines for thousands of years to hours or minutes. The institutional markers are dated accordingly: a White House Executive Order in June, with migration milestones placed in the late 2020s and at 2030; NIST's first finalized post-quantum standards, named as ML-KEM, ML-DSA and SLH-DSA; and pilot hybrid post-quantum and classical TLS deployments by internet infrastructure providers. No corresponding date appears for the backward-looking task. No authority is cited as having set a deadline for inventorying old encrypted-exfiltration decisions, and none is named as having required one. The instruments divide by direction. The White House Executive Order is a decision by the Executive Branch, carrying a schedule: migration milestones in the late 2020s and at 2030. Its authority is not spelled out in the article, and neither are its penalties; it appears as a direction with a calendar rather than as a statute with enforcement. The NIST standards are decisions of a standards body, and they bind in a different and more modest sense. They name the technical destination, ML-KEM, ML-DSA and SLH-DSA, and give procurement and engineering a common reference; but a standard is a target, not a writ, and the article names no regulator who has made adoption of it a legal condition. The pilot hybrid TLS deployments bind no one at all; they are experiments conducted by providers who chose to run them. Nothing in the article assigns the backward-looking duty. No authority is described as having said that an old encrypted exfiltration must be inventoried, reassessed, or disclosed once decryption becomes possible. The order's milestones run forward; the standards run forward; the pilots run forward. The one deadline that is nowhere stated is the only one that matters to the article's question: a date by which an organization must revisit the incidents it once judged harmless. None is named, and no institution is named as entitled to name one. That leaves the obligations unevenly spread. The government has given itself a calendar. NIST has issued a specification. Private organizations have Mr Hollinder's four recommendations, which may be prudent but are not requirements. An order is not migration, a standard is not adoption, and a recommendation becomes a duty only when an organization decides to treat it as one. The article's complaint is that the organizations with the longest history of encrypted exfiltration have not made that decision, and no instrument cited here compels them to. —Elias Hartwell Dispatch from The Institutional E1