Q-Day: When Quantum Computing Breaks the Internet

In a windowless room beneath the headquarters of a signals intelligence agency — the specific nation doesn't matter, because at least a dozen are doing this — a bank of servers is quietly ingesting encrypted internet traffic. Diplomatic cables. Banking transactions. Medical records. Military communications. Everything that moves across fibre optic cables, every handshake protected by RSA or elliptic curve cryptography, is being copied and stored in vast archival systems.

The interceptors cannot read any of it. Not yet. They are playing a longer game — one measured not in intelligence cycles but in physics breakthroughs. The strategy is called "harvest now, decrypt later," and it represents the most patient espionage operation in human history. The bet: that within the next decade, a sufficiently powerful quantum computer will render every classical encryption algorithm breakable, and every secret harvested today will become readable overnight.

That day has a name. The intelligence community calls it Q-Day.

The Cryptographic Foundation: What Breaks and What Survives

To understand Q-Day, you must first understand the mathematical foundations of modern encryption — and why quantum computing renders them obsolete.

Virtually all public-key cryptography used on the internet today relies on one of two mathematical problems that are believed to be computationally intractable for classical computers:

RSA (Rivest–Shamir–Adleman) derives its security from the difficulty of factoring the product of two very large prime numbers. An RSA-2048 key involves a number so large that the best known classical algorithm would require approximately 300 trillion years to factor it.

Elliptic Curve Cryptography (ECC) relies on the difficulty of the elliptic curve discrete logarithm problem. ECC offers equivalent security to RSA with much smaller key sizes, which is why it dominates mobile communications, cryptocurrency wallets, and TLS connections.

Both systems share a fatal vulnerability: Shor's algorithm. Published by mathematician Peter Shor in 1994, this quantum algorithm can factor large integers and solve discrete logarithm problems in polynomial time on a quantum computer. A sufficiently powerful, error-corrected quantum computer running Shor's algorithm could break RSA-2048 in hours — perhaps minutes.

The qualifier "sufficiently powerful" is doing significant work in that sentence. Current quantum computers are nowhere near the threshold. But the trajectory is pointed directly at it.

Not all cryptography falls to quantum attack. Symmetric encryption algorithms like AES-256 are degraded but not destroyed — Grover's algorithm effectively halves the key length, meaning AES-256 offers roughly AES-128 equivalent security against quantum adversaries. Hash functions like SHA-256 are similarly reduced but remain functional. The existential threat is specifically to the public-key infrastructure that secures virtually every internet transaction, every digital signature, and every encrypted communication channel on earth.

The Quantum Timeline: Where Are We Now?

The original NIST estimate — that quantum computers capable of breaking RSA-2048 could arrive between 2029 and 2035 — has been dramatically compressed by a series of breakthroughs in early 2026. Three landmark papers in three months have rewritten the threat timeline.

December 2024 — Google Willow: Google's 105-qubit Willow processor demonstrated below-threshold quantum error correction for the first time: as physical qubits increased, the error rate actually decreased. This was the foundational proof that fault-tolerant quantum computing is achievable. Willow completed a benchmark computation in under five minutes that would take the world's fastest classical supercomputer 10 septillion (10²⁵) years.

March 2026 — The ECC Collapse: A whitepaper co-authored by Google Quantum AI, researchers from the Ethereum Foundation, and Stanford University demonstrated that the Elliptic Curve Cryptography (ECC) protecting major cryptocurrencies and TLS connections could theoretically be broken with fewer than 500,000 physical qubits — a nearly 20-fold reduction in previous resource estimates. The paper showed this could be achieved in minutes, not hours.

The interceptors cannot read any of it. Not yet. They are playing a longer game — one measured not in intelligence cycles but in physics breakthroughs.

May 2026 — The Oratomic Pinnacle: The quantum startup Oratomic published research on its "Pinnacle" architecture using quantum low-density parity-check (QLDPC) codes, demonstrating that factoring RSA-2048 integers might be achievable with fewer than 100,000 physical qubits. Previous estimates required millions.

The acceleration is not hardware-driven alone. Artificial intelligence — specifically large language models — has been "instrumental" in optimising quantum algorithms, with tools like OpenEvolve enabling researchers to reduce the number of atoms required per logical qubit by 100 times in certain architectures.

The response has been swift and alarmed. Both Cloudflare and Google have moved their internal quantum-preparedness targets to 2029 — six years earlier than NIST's original 2035 migration goal. CNN, Nature, and Time have published major features warning that Q-Day is approaching faster than anyone expected.

IBM's quantum roadmap reinforces the trajectory. The company's 1,121-qubit Condor processor was followed by modular Flamingo and Starling systems designed to link multiple quantum processors. IBM projects quantum systems exceeding 100,000 qubits by 2033 — comfortably above Oratomic's RSA-breaking threshold.

China's quantum programme, though less publicly documented, has demonstrated comparable or superior capabilities. The University of Science and Technology of China's Jiuzhang photonic quantum computer achieved quantum advantage through Gaussian boson sampling as early as 2020, and China's investment in quantum research exceeds $15 billion through government-directed funding programmes.

Michele Mosca, co-founder of the Institute for Quantum Computing at the University of Waterloo, has proposed a decision framework: if there is a greater than 1-in-6 chance that quantum computers will break public-key cryptography within a given period, and migration to quantum-safe cryptography will take longer than that period, then migration should begin immediately.

By every credible estimate, we are no longer merely inside that window. We are approaching its far wall.

Harvest Now, Decrypt Later: The Evidence

The "harvest now, decrypt later" (HNDL) strategy is not hypothetical. It is operational intelligence doctrine.

In 2023, the European Union Agency for Cybersecurity (ENISA) published an assessment confirming that "state-sponsored actors are believed to be intercepting and storing encrypted data with the expectation of future quantum decryption capabilities." The report did not name specific nations, but the implication — consistent with assessments from the US National Security Agency, the UK's National Cyber Security Centre, and the Australian Signals Directorate — is that HNDL programmes are active across multiple nations.

Edward Snowden's 2013 disclosures revealed that the NSA had already allocated $79.7 million to a programme called "Penetrating Hard Targets," which included quantum computing research specifically aimed at cryptanalysis. That was thirteen years ago. The budgets have grown considerably since.

What makes HNDL uniquely dangerous is its retroactive nature. Unlike conventional intelligence failures, which affect future communications, HNDL threatens past communications. Every encrypted diplomatic cable, every protected financial transaction, every confidential medical record transmitted over the last two decades is potentially vulnerable. The data has already been captured. Only the decryption key is missing — and that key is being built in quantum laboratories worldwide.

For certain categories of information — state secrets, intelligence sources, long-term strategic plans, genetic data, infrastructure blueprints — the sensitivity doesn't decay over a decade. A military communication from 2020, decrypted in 2032, could still compromise active operations, reveal agent identities, or expose strategic vulnerabilities.

The NIST Standards: Humanity's Response

Recognising the approaching threat, NIST initiated a Post-Quantum Cryptography Standardisation process in 2016 — a full eight years before the standards would be finalised. The process evaluated 82 initial submissions from cryptographic research teams worldwide, subjected them to years of public analysis and cryptanalysis, and narrowed the field through multiple rounds.

On 13 August 2024, NIST published three finalised post-quantum cryptographic standards:

Organisations that have not yet begun migration will not complete it before the threat materialises. The mathematics is unforgiving.

ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism, formerly CRYSTALS-Kyber): A key encapsulation mechanism for general encryption, based on the hardness of the module learning-with-errors problem. This is the primary replacement for RSA and ECC in key exchange.

ML-DSA (Module-Lattice-Based Digital Signature Algorithm, formerly CRYSTALS-Dilithium): A digital signature scheme for authentication, replacing RSA and ECDSA signatures.

SLH-DSA (Stateless Hash-Based Digital Signature Algorithm, formerly SPHINCS+): A hash-based signature scheme offering a different mathematical foundation from lattice-based approaches, serving as a conservative backup option.

A fourth standard, FN-DSA (based on NTRU lattices), is expected to be finalised in 2025.

The mathematics behind these standards is fundamentally different from RSA and ECC. Lattice-based cryptography relies on problems — specifically, finding the shortest vector in a high-dimensional lattice — for which no efficient quantum algorithm is known. If Shor's algorithm is a master key for number-theoretic cryptography, lattice problems represent a different type of lock entirely.

But having standards is only the beginning. The real challenge is migration.

The Migration Crisis: A Decade-Long Infrastructure Overhaul

Migrating the world's digital infrastructure from classical to post-quantum cryptography is an undertaking comparable in scale to the Y2K remediation effort — but significantly more complex.

The US Government Accountability Office estimates that federal agencies alone operate over 3 billion instances of cryptographic implementations across their IT systems. Identifying, cataloguing, and replacing each one requires a systematic "cryptographic inventory" that most organisations — public and private — have not yet begun.

Historical precedent is discouraging. The migration from SHA-1 to SHA-256 — a far simpler cryptographic upgrade — took approximately 10 years from initial deprecation notices to practical completion across the internet ecosystem. The migration from DES to AES took nearly 15 years. Post-quantum migration involves replacing not just algorithms but entire protocol stacks, certificate chains, hardware security modules, embedded systems, and IoT devices with firmware that may be difficult or impossible to update.

The NSA's CNSA 2.0 (Commercial National Security Algorithm Suite) guidelines, published in September 2022, mandated that all National Security Systems must migrate to post-quantum cryptography by 2035. The White House's National Security Memorandum NSM-10, issued in May 2022, directed agencies to begin preparing for the transition immediately.

Yet by mid-2026, most organisations have not started meaningful migration. A 2025 survey by the Ponemon Institute found that only 23% of large enterprises had completed a cryptographic inventory, and fewer than 7% had begun deploying post-quantum algorithms in production systems. The reasons are predictable: competing budget priorities, lack of cryptographic expertise, uncertainty about algorithm maturity, and the fundamental human tendency to discount threats that are measured in years rather than quarters.

The gap between the NIST timeline (quantum threat: 2029–2035) and the migration timeline (typical enterprise: 10–15 years) creates a mathematical certainty: organisations that have not yet begun migration will not complete it before the threat materialises.

Sectoral Vulnerabilities: Who Falls First

Not all sectors face equal exposure to the quantum threat. The vulnerability map is determined by three factors: the sensitivity of the data, the duration for which it must remain confidential, and the complexity of the cryptographic migration required.

Hope is not a security posture. The data has already been harvested. The only question is when it will be read.

Financial Services: The global banking system processes over $5 trillion in daily foreign exchange transactions alone, all secured by classical public-key cryptography. SWIFT messaging, interbank settlement, and digital payment systems represent a concentrated attack surface. The Bank for International Settlements has identified quantum computing as a "systemic financial stability risk."

Defence and Intelligence: Military command-and-control systems, classified communications networks, and weapons systems rely on cryptographic protections with multi-decade confidentiality requirements. A communication classified today may still require protection in 2050 — well beyond Q-Day.

Healthcare: Electronic health records containing genetic data present a unique long-term exposure. Unlike financial data, which can be re-issued (new account numbers, new cards), genetic information is immutable. A genome sequenced and encrypted in 2024, decrypted by a quantum computer in 2034, compromises that individual's biological privacy permanently.

Critical Infrastructure: Energy grids, water treatment systems, telecommunications networks, and transportation control systems increasingly rely on networked architectures secured by standard cryptographic protocols. Many of these systems run on embedded hardware with 15–25 year operational lifespans and limited firmware update capabilities.

The Sovereign Response: Building Quantum-Resilient Systems

For organisations and nations that take the quantum threat seriously, the response must be architectural, not incremental.

Society OS's approach to quantum resilience exemplifies a sovereignty-first architecture. Rather than retrofitting existing systems with post-quantum patches, the platform was designed from inception with cryptographic agility — the ability to swap underlying cryptographic primitives without restructuring the system architecture. This means that as NIST standards mature and new algorithms are developed, the transition is a configuration change rather than a rebuild.

The platform's provenance layer — which provides tamper-evident audit trails using hash-chaining and digital signatures — has been designed with hybrid classical/post-quantum signatures, ensuring that audit integrity survives the transition through Q-Day regardless of when it arrives.

This approach reflects a broader principle: quantum resilience is not a feature you add. It is an architectural posture you adopt. Organisations that treat post-quantum migration as a compliance checkbox will find themselves perpetually chasing the next standard. Those that build cryptographic agility into their foundational architecture will be able to adapt as the threat landscape evolves.

The Countdown

The clock is not ticking toward Q-Day. The clock has been ticking for years, and the alarm is now within earshot.

The data being harvested today will remain encrypted in adversarial storage systems for exactly as long as it takes to build a quantum computer capable of breaking the encryption. Every day that passes without migration is a day of additional exposure. Every encrypted communication transmitted using classical cryptography is a commitment to the hope that quantum computing will arrive later rather than sooner.

Hope is not a security posture.

The NIST standards exist. The migration pathway is defined. The threat timeline is narrowing — and the March 2026 breakthroughs suggest it is narrowing faster than even pessimistic forecasters predicted. What remains is the question that separates nations, organisations, and systems that will be sovereign on the other side of Q-Day from those that will not: are you migrating now, or are you waiting for the alarm to sound?

By then, of course, it will be too late. The data has already been harvested. The only question is when it will be read.

This article is part of the Sovereign Intelligence Hub's quantum series. For the broader governance implications, see [The Governance Gap](/hub/the-governance-gap-why-ai-regulation-cant-keep-up). For how quantum computing reshapes drug discovery, see [Quantum Drug Discovery](/hub/quantum-drug-discovery-when-molecules-become-computable). For the full quantum-AI threat matrix, see [The Quantum-AI Threat Matrix](/hub/the-quantum-ai-threat-matrix).