Pentagon Races to Deploy Post-Quantum Cryptography Before 2030 Deadline

HONOLULU—Defending against quantum computer attacks requires two critical steps: identifying precisely which systems require upgrades and ensuring leadership fully grasps the severity of the risk to sensitive data secured by conventional encryption.

“Our adversaries are already working with quantum technology. We don’t fully understand how advanced their capabilities are, but the threat is real,” said Matt McFadden, vice president of cyber at GDIT, during a panel at the TechNet Info-Pacific conference in Honolulu. “Post-quantum cryptography brings the ‘harvest now, decrypt later’ problem into sharp focus. Under that scenario, adversaries can collect encrypted data for years, waiting until a quantum computer is powerful enough to break today’s standard encryption.”

Post-quantum cryptography—the mathematical algorithms designed to protect networks and systems from quantum-based attacks—is a challenge every branch of the military must address. The White House has established a firm timeline through an executive order issued June 22: federal agencies must implement PQC for key establishment in high-value and high-impact systems by December 31, 2030. The deadline for adopting PQC for digital signatures is set for 2031.

“This is simply another threat vector we must account for as we build resilient architectures,” said Col. Tassika Davis, director of cyber operations and warfighter communications for Pacific Air Forces Command. “Our systems must be cryptographically agile, allowing us to adapt and maintain mission capability without degradation while deploying the latest defenses.”

Achieving that requires mapping the entire IT ecosystem as it currently exists, assessing the full threat landscape, and planning accordingly, she said.

While it may sound straightforward, identifying exactly what needs protection is a critical—and difficult—first step, McFadden noted during the panel.

“Migration is difficult when you don’t know what you own,” he said. “The first step is a comprehensive inventory that includes certifications for applications, devices, and networks. Organizations quickly realize how dependent they are on third-party providers. Success requires collaboration with system owners, suppliers, and supply chains to build a governance team capable of driving compliance and crypto agility—the capacity to defend against quantum cyber threats.”

Securing systems against post-quantum threats is further complicated by the fact that many platforms slated for upgrades are constantly on the move.

“Ship deployments are being extended more frequently, and crises are arising across the globe,” said Capt. Victor Taylor, director of communications and information systems for Pacific Fleet. “Previously, maintenance availabilities provided nine months to a year for modernization. Today, that window has shrunk to roughly 45 days. The challenge is how to divide large modernization efforts into modular, shorter timeframes; manage configuration at scale; field teams across multiple locations; and schedule work amid constant change. Relying on legacy processes simply won’t work.”

A key component of upgrading high-value Pentagon and military systems to resist quantum attacks is ensuring personnel understand the nature of the threat.

“The first step is acknowledging that this is a real problem,” said Peter O’Donoghue, chief technology officer at Quantum Sky, in an interview with Defense One after the panel. “Q-Day isn’t some distant event beyond our retirements—it will almost certainly arrive within the next five years. Once you accept that, you have to plan for it and provide the necessary funding.”

The Pentagon released its post-quantum cryptography strategy earlier this year. Its implementation could be integrated into the Department of Defense’s existing network modernization efforts, O’Donoghue added.

How organizations approach these upgrades will vary, but awareness is essential, he said.

“There is no universal solution,” O’Donoghue said. “Each department and agency must understand its specific risks, begin mitigating them, and take decisive action. Paralysis through over-analysis is not an option, and neither is denial.”

Source link