Where Is the All-Hands-On-Deck Plan to Adopt Quantum-Safe Encryption and Protect Global Data by 2029?

 

By James Myers

What would you do if you woke up one morning to discover that all your passwords have been compromised, and your bank and retirement accounts drained by the criminals who have stolen your digital identity? 

If you’re a rare person who hasn’t yet suffered a data breach, chances are you know someone who has. Online hacking has become so common that it is a practically accepted feature of our digital experience, but as bad as it now is the problem could very soon become catastrophic. That would be the outcome if current public-key cryptography methods haven’t been replaced by the time that criminals gain access to quantum computers and their decryption algorithms. 

Quantum decryption algorithms are so powerful, and quantum computers will be so fast, that practically every type of encryption now commonly used will fail. When the day will come nobody knows, but there is a good chance that fully functioning quantum computers will arrive much sooner than many assume. 

Quantum computer developers are confidently predicting that error-free machines will be available by 2029, which is a short 3 years away.

Major quantum computing hardware developers, including Google, Microsoft, and Quantinuum, have pledged to develop fully functioning machines by 2029. Google is among the leading quantum computer developers, and in its March 2026 news post entitled Quantum frontiers may be closer than they appear  the company announced that is accelerating its migration to post-quantum cryptography (PQC) within three years. “As a pioneer in both quantum and PQC, it’s our responsibility to lead by example and share an ambitious timeline. By doing this, we hope to provide the clarity and urgency needed to accelerate digital transitions not only for Google, but also across the industry.” 

Advising that it is prioritizing PQC migration for its authentication services, Google notes that “Quantum computers will pose a significant threat to current cryptographic standards, and specifically to encryption and digital signatures.” Google’s announcement is particularly important given the enormous amount of data under the control of its parent company, Alphabet, which owns YouTube and Android, operates a major cloud computing platform, and delivers 90% of the world’s web searches. 

A month earlier, another Google news post entitled The quantum era is coming. Are we ready to secure it? expressed concern that quantum computing’s “unique ability to unravel scientific mysteries will also allow them to bypass our current digital locks, like the public-key cryptosystems that protect things like bank transfers, private chats, trade secrets and even classified information. To put that plainly: The encryption currently used to keep your information confidential and secure could easily be broken by a large-scale quantum computer in coming years.”

 

 

A major quantum competitor to Google is Microsoft, which recently announced a significant step toward fully functioning quantum computing with its new Majorana 2 quantum computer chip that is 1,000 times more reliable than its predecessor. Thanks to the company’s publicly available AI platform called Discovery, Microsoft engineers were able to construct the new chip atom-by-atom, maintaining each in the correct position within a crystalline structure that uses lead as a superconductor.  

With the achievement of its new chip, the company stated that, “Microsoft now expects to achieve a scalable quantum computer by 2029, cutting its original timeline in half.” 

When chips have typically sustained quantum information bits (called “qubits”) for only microseconds – for instance, Microsoft’s Majorana 1 introduced in early 2025 was capable of 12 milliseconds using superconducting aluminum – Microsoft states that Majorana 2 “offers a mean qubit lifetime of 20 seconds, with some instances lasting as long as one minute. That improvement is roughly comparable to inventing a phone battery that instead of dying in a day could last for nearly three years on a single charge.”  

Majorana 2 facilitates a type of quantum computing that’s called “topological.” In topological quantum computing, calculations are based on “on” and “off” (1 and 0) signals that are triggered by measurements of electrons. In a particular measurement configuration, the electron number is either even – meaning that the configuration is divisible by 2 – or otherwise odd and therefore not divisible by 2. Topological quantum computers store quantum information based on the parity of one qubit to another: when both are even, or both or odd, there is parity, but there’s no parity between opposites. The state of parity or non-parity triggers the 1 and 0’s in the calculations. 

Microsoft explains that its topological measurement process improves quantum error correction. Quantum circuits are fragile and easily disconnected by external factors like heat and electromagnetism, and circuit error (called “decoherence”) has been the major stumbling block to creating a fully functioning quantum computer. However, there have been and continue to be other significant advancements in conquering the decoherence problem, as highlighted in our October 2026 article New Entanglement Methods Boost Prospect of Full-Scale Quantum Computing by 2029. Is 3 Years Enough Time to Re-Encrypt the World’s Data? 

Quantinuum, which describes itself as the world’s largest quantum computing company that integrates hardware and software, announced on October 19 that it had exceeded by 10 times the world record for error correction. Circuits in Quantinuum’s Helios quantum computer achieved 99.9995% logical fidelity, meaning that in a million operations there were only five errors, which the company says was ten times less errors than it had achieved only a month earlier.

 

 

To achieve its breakthrough, the company used a technique known as “code distance” to determine how many physical qubits were required to protect quantum information as the error correction scales. The company reports that, “Each tested increase reduced the remaining logical errors by a record factor of 12, demonstrating increasingly effective error suppression as the code grows—a critical capability for scaling fault-tolerant quantum computing. Quantinuum believes this result suggests it can deliver fault-tolerance with significantly fewer qubits than are required for other modalities.” 

Quantinuum’s Helios is not a topological system but instead operates with trapped ions that create qubits from atom-sized electrically charged particles held in place by lasers. The company states that its achievement with Helios “reinforces Quantinuum’s error-correction leadership and validates that its accuracy performance is now within the target range for Apollo, the company’s planned universal fault-tolerant quantum computer expected to be available by 2029.” 

How serious is the threat of sensitive data decryption by quantum algorithms?

The decryption threat posed by quantum algorithms has been known for many years and defensive measures have more recently been tested and accepted as standards. However, now that quantum computers are so close to becoming a reality, some are beginning to question whether enough time remains to secure the world’s data from criminals who will exploit vulnerabilities. In a scheme known as store-now-decrypt-later, some criminals are already amassing troves of data that they plan to decrypt when fully functioning quantum computers become operational. 

Despite increasingly stringent measures to protect encrypted data, criminals are often one step ahead in finding and exploiting security weaknesses. The $6.3 billion theft from cryptocurrency exchange Binance on October 29 is a recent and exceptionally large example of the scale of online losses and the speed at which they occur. Wired Magazine reports that the theft from Binance cryptocurrency wallets was accomplished over a short 20-minute period in a cyberattack that appears to have been state-sponsored by North Korea.

 

 

The risks of loss are compounded by AI applications like Anthropic’s Claude Mythos that have recently demonstrated an exceptional ability to locate software security vulnerabilities. Mythos is so powerful as a potential hacking tool that Anthropic has embargoed its public release, initially limiting access to 12 tech companies and 40 other organizations. Claude Mythos has proven exceptionally capable of finding long-dormant bugs in decades-old computer code, of the types that still operate in many large systems with vital functions in finance, public utilities, hospitals, and other sectors that are core to daily living.  

There is no shortage of criminals and online scams – as practically every internet user around the world knows – that steal vast pools of sensitive credit card numbers, personal data, business secrets, military information, and other forms of data that circulate around the globe at the speed of light. Each bit of data crisscrossing the planet is a potential criminal target, and there is an incalculably large amount of data in the cloud. Among many sources of online data, Statista estimates that there were nearly 400 billion e-mails sent around the globe each day in 2026 – which is equivalent to 50 every day for every human on Earth, and e-mails make up only a fraction of our daily online interactions. 

Public-key cryptography is used worldwide to secure sensitive data, using mathematical problems like the factoring of large prime numbers that are difficult or impossible for current (often referred to as “classical”) systems to solve. However, using code like Shor’s Algorithm, quantum computers operating with far greater speed and processing capacity are expected to have the power to crack difficult mathematical problems like prime number factoring and expose encrypted data. 

The decryption risks posed by Shor’s Algorithm operating in quantum computers has been known for at least 25 years. The algorithm was introduced by mathematician Peter Shor in 1994, and in 2001 a group at IBM demonstrated its effectiveness in factoring prime numbers. Twenty-one years later, in 2022, alternative encryption techniques for post-quantum cryptography (PQC) were announced by the United States National Institute for Standards and Technology (NIST). Although NIST’s methods are expected to be secure against quantum decryption, there remains much hard work to identify and reconfigure the world’s vast number of systems to operate with PQC standards.  

Given the global interconnectedness of systems in key areas like finance and banking, medicine, public utilities, transportation, military, and other essential functions, decryption risks cannot be underestimated. Since The Quantum Record’s June 2024 feature article Race for Post-Quantum Cryptography: Will Proposed Encryption Standards Secure the World’s Data?, the potential for exposure of sensitive data has been heightened by rapid progress toward development of fully-functioning quantum computers. 

With full-scale quantum computing so near on the horizon, public-key encryption systems like the widely used RSA are vulnerable. The public encryption key is created by multiplying two large prime numbers, raising them to a predetermined exponent, and attaching an auxiliary number. While the encryption key is public and can be created by anyone using the algorithm, the decryption key is a secret and to break it would require the practically impossible task of factoring the product of the prime numbers. To decrypt, the receiver’s device must synchronize with the values in the encryption, and the part of the encryption that contains the means to make the receiver’s key symmetric with the sender’s is in imminent danger from the quantum algorithms. 

Action to avoid the looming and long-known quantum decryption threat can no longer be deferred. What are governments doing?

Countries around the world are beginning to react to the urgent need for adopting post-quantum cryptography, but targets have not been adjusted for the accelerated 2029 timeline of the major quantum computing companies. 

In June 2026, the U.S. president issued an executive order requiring the federal government and its agencies to adapt high-risk systems for quantum-secure cryptographic keys by the end of 2030 and PQC signatures a year later. The order does not establish, however, a transition timeline for systems not judged high-risk. 

In June 2025, the European Commission established for the European Union’s 27 member states A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography. Although EU members aren’t bound by the roadmap, it recommends that each state establish a transition plan by the end of 2026 for PQC implementation in high-risk systems by the end of 2030.

 

The United States National Institute for Standards and Technology (NIST) explains the path taken to establish post-quantum cryptography standards. 

 

Although the United States National Institute for Standards and Technology (NIST) sets standards applicable to the U.S. federal government, its research and recommendations have gained international respect and are the basis for post-quantum cryptography standards in many countries. For example, Canada has adopted NIST’s Advanced Encryption Standard (AES) algorithm (pdf available), which was last updated in May 2023 and originally adopted by NIST in 2002.  

The Canadian Centre for Cyber Security (“Cyber Centre”) set April 2026 as a milestone for federal government departments to establish a post-quantum cryptography plan incorporating AES and other necessary defences against decryption by quantum algorithms. Departmental plans should identify high-priority systems for replacement of public-key cryptography and migration to new security standards by the end of 2031, with remaining systems to be completed in the following four years.  

The Cyber Centre’s guidance notes that “Departments will need to clearly understand their cryptography usage. IT infrastructure, both hardware and software, and data will need to be analyzed across the entire enterprise. Starting the PQC migration early is important to leverage existing IT lifecycle budgets as much as possible.” The Cyber Centre’s authority does not, however, extend to the governments and agencies of Canada’s 13 provinces and territories, each of which is responsible for establishing its own standards and timetable for securing systems in public healthcare, transportation, public utilities, social benefits, and other crucial responsibilities of each provincial jurisdiction. 

Creating an inventory of cryptographically vulnerable systems used in organizations as large as governments and their agencies, comprising hundreds of thousands of employees and large numbers of diverse systems, is a difficult task that is complicated by interconnections with many legacy systems. Sometimes operating with code written in outdated languages that decreasing numbers of programmers understand and support, older systems pose additional risks if documentation on their functions and connections is not updated at the same time that the newer systems they support are updated. 

Acknowledging that PQC migration “is a mass technology change that will take a number of years,” the U.K. government’s National Cyber Security Centre has established 2028 as a deadline for organizations in the country to define their goals, inventory their existing systems and cryptography methods, and create a migration plan. Highest-priority systems in the U.K. should be made PQC secure by 2031, and all other systems should be secured within the following 4 years. 

Where’s the all-hands-on-deck approach?

Google’s February news post concludes: “Here’s the bottom line: We believe quantum computing can help shape a brighter tomorrow — but we need an all-hands-on-deck approach to make sure the quantum era is defined by breakthroughs, not breakdowns. Working together we can prepare today and promote greater security tomorrow.” 

Google calls on policymakers to “drive society-wide momentum, especially for critical infrastructure,” and to “reduce global fragmentation: we need a unified approach.”

 

 

The absence of global oversight and coordination mechanisms for post-quantum cryptography adoption in crucial systems relied on by individuals, companies, governments, and scientists adds great risk at the same time that the world is contending with dangers from the rapidly evolving capabilities of AI and AI agents. For example, Anthropic, which makes the popular AI-powered large language model Claude, warns in its initial public share offering that “our most capable models have demonstrated, and future models are expected to demonstrate, capabilities that could provide meaningful assistance to malicious actors seeking to develop chemical, biological, or other dangerous weapons.” 

Anthropic notes that in September 2025 the company “detected and assessed with high confidence that a Chinese state-sponsored hacking group manipulated our Claude Code tool into attempting infiltration into roughly 30 global targets, including large technology companies, financial institutions, chemical manufacturing companies, and government agencies, resulting in a limited number of successful intrusions. We believe this is the first documented case of a large-scale cyberattack executed without substantial human intervention.” 

The warning signs for data encryption are plain to see and rapidly multiplying, raising serious questions for public safety. 

Are large commercial and government organizations nimble enough to adapt to accelerating schedules for the introduction of fully functioning quantum computers and decryption algorithms that criminals are already preparing to deploy? Official plans generally call for securing high-risk systems by 2030 or 2031, which will be a year or two after quantum decryption algorithms are expected to be operating. 

Even if high-risk systems are secured before decryption tools fall into criminal hands, what will result from the combined effects of successful attacks on lower-risk systems? 

In an interconnected world, will differing actions and timetables of individual nations be sufficient for PQC, or will the absence of international coordination prove fatal? 

And what about protections for individuals and our large arrays of internet-connected devices? 

Every passing day affords less time to answer these and other crucial questions. With the world’s data at risk, where’s the all-hands-on-deck approach to tackling the problem and avoiding catastrophic damage?

---

Craving more information? Check out these TQR articles

• Reverse Transcriptase: The Viral Enzyme Helping Scientists Rewrite DNA 
• Is the Link Between Prediction Markets and Social Media Algorithms Another Form of Human Fracking? 
• Engineered for Overconsumption: The Health Risks and Regulatory Battle Over Ultra-Processed Foods 
• Personal Data Tracking Is Everywhere: Why Privacy Protection Remains Uneven 
• The AI Boom is Drawing Public Opposition to Data Center Expansion and Burden on Local Resources