The Coming Q-Day: US states largely unprepared as quantum computing threats loom - Scripps News

In an inconspicuous building on the western edge of Boston, scientists are using lasers to separate atoms and develop one of the most powerful machines ever created. Once fully operational, it could be able to create new, lifesaving medicines. It could also become the most devastating cyber weapon yet.“It is a mini, little Manhattan Project, and we’re just building this unbelievable device,” said Andy Ory, the CEO of QuEra, a Boston company working to develop a commercially viable quantum computer. The company’s technology sprang from the laboratories of Harvard and MIT scientists and is already one of the country’s most advanced quantum computers.Quantum computers are able to solve problems that would take a supercomputer septillions of years to untangle, and Google’s quantum chip Willow, for example, has already done so. They use the power of atoms, which abide by an entirely different set of physics than the world at large. “This is some of the most complex scientific instruments that humankind has ever built,” Ory said.The risk they pose is known as “Q-Day,” the hypothetical date that highly advanced quantum computers will become strong enough to break the widely used forms of cryptography that protect digital communications, identities and transactions across government and industry. Experts have warned about this risk for decades, but with recent improvements in technology and the help of AI, Q-Day’s arrival could come as soon as 2029, if not before.There is a solution. Post-quantum cryptography (PQC) is designed to replace standard encryption and keep data safe from post-quantum cyberattacks. In June, President Donald Trump signed two executive orders regarding quantum computers. One accelerated the federal government’s transition to quantum-resistant encryption. The other set the end of 2030 as a deadline for agencies to protect their most sensitive systems from post-quantum cyberattack. There has been no similar mandate for most local or state governments, which control highly sensitive information about citizens such as medical, criminal and voting records, along with election systems, power grids, communications and other critical infrastructure.The Howard Center for Investigative Journalism at Arizona State University found that, as the federal government invests billions into developing quantum computers in a race against global rivals, the majority of U.S. states have not begun preparing to transition their systems to PQC. The investigation’s 50-state analysis found an uneven landscape of preparedness:Thirty-two states do not have an active plan and have not provided evidence that they are developing a plan.Governments that rely on IT systems with outdated or archaic components will be more vulnerable.Many state and local cybersecurity teams feel they lack the resources and guidance needed to prepare and protect themselves from the coming threat.The United States and China are among many countries racing to build the first fully scaled quantum computer, and both have invested billions into development. The president’s June 22 order requiring federal agencies to shield their most sensitive systems by 2030 cites the risk of foreign adversaries “collecting United States information now, and decrypting it later once large-scale quantum computers are operational.” This is commonly referred to as a “harvest now decrypt later” attack.In St. Paul, Minnesota, Chief Information Officer Jaime Wascalus questioned whether the president’s orders go far enough. She said both private companies and the federal government should do more to help local governments prepare to protect themselves and their residents.“Is there funding for that kind of work? Is that work going to extend to state, to local? Those are things that I think are really important. It’s really about a collaborative effort when you’re talking about the public sector,” she said. Photo by Gaige Davila / Howard Center for Investigative Journalism Jaime Wascalus, director of the St. Paul Office of Technology and Communications, says that cities will need more cybersecurity protection as quantum computing continues developing. Wascalus is speaking from experience. In July 2025, a ransomware group released the Social Security numbers, addresses, birthdays and phone numbers of more than 12,000 people after hacking the city’s systems. Gov. Tim Walz declared a state of emergency and, for the first time in Minnesota history, deployed the state’s National Guard Cyber Protection Team. The attack did not use a quantum computer but still incurred millions of dollars in recovery costs. A quantum-powered attack, Wascalus said, would be much worse.“When I think about impacts from a major ransomware attack, the top thing that will come to all of our minds is public safety,” she said. “If you have police, if you have fire, sheriffs within your jurisdiction, you want to make sure that they have access to the tools and the data that they need…. The potential for that mass disruption to happen is a risk that we need to prepare for.”For example, she said, the tool that identifies and alerts the first responders to an emergency could be compromised in a quantum-derived hack. St. Paul’s 2026 budget set aside $1 million for cybersecurity upgrades, but none of it is going toward post-quantum cryptography. Wascalus also said American cities are not getting the help they need.“I haven’t gotten any direction in terms of post-quantum readiness from the federal government or our state government yet,” Wascalus said.Funding is only part of the challenge.“This migration is going to be incredibly complex, difficult, complicated, costly,” said Dustin Moody, a mathematician who leads the federal government’s Post-Quantum Cryptography project at the National Institute of Standards and Technology (NIST), which is part of the Department of Commerce.“It’s not an emergency in the sense that if you haven’t migrated by next month, you’re in trouble and you’re going to get hacked,” Moody said. “But if you delay, this is going to potentially cause risk to your organization in the future.”Developing a quantum machine that can break encryption is happening in the shadows, Moody said. “If a government or a spy agency is building these, we may not know when it’s built.”He doesn’t expect every federal agency to meet the 2030 deadline requiring high-value and high-impact systems to begin using post-quantum cryptography, noting that millions of devices need protection and securing them will take more than a simple software upgrade.“There’s still ATMs out in the wild where they’re using cryptography that they really shouldn’t be using,” Moody said. “Because that ATM was put out there in 1990 and never gets an update.”Traditional computer chips – the ones in your laptop and phone – run on bits. A bit is either a one or a zero, a piece of binary code. Quantum computers use qubits, which can be both a one and a zero at the same time. Standard encryption on traditional computers uses complex math problems with a singular solution that require calculations too large for those same computers to solve. Since quantum computers can try all of the solutions simultaneously, they have the potential to break into sensitive systems that use standard encryption much faster.“If you have a quantum computer that can break encryption as we know it today, that’s almost like having a nuclear bomb,” said U.S. Rep. Suhas Subramanyam, D-Va. “Because you can get into all sorts of information. An adversary, in their hands, can do a lot of damage.”In August 2025, Subramanyam introduced a bill that would require a federal assessment of U.S. quantum readiness, how far public and private organizations have come in adopting post-quantum security measures, and the economic sectors most at risk. In April, the House Science Committee sent the proposal to the full House as part of the National Quantum Initiative Reauthorization Act. The pending bill does not specify funding; a Senate version would authorize roughly $2.7 billion for federal quantum programs over five years.In 2021, the Department of Homeland Security published a post-quantum cryptography roadmap “to raise awareness and provide guidance to federal, state, local, tribal, and territorial partners as well as critical infrastructure owners and operators and others in the private sector.” Two years later, DHS and NIST issued a fact sheet calling for organizations to start making their systems quantum-secure.“A lot of the federal government is not ready. A lot of states aren’t ready,” said Garfield Jones, who led the federal Cybersecurity and Infrastructure Security Agency’s post-quantum cryptography migration effort for five years. The mandate Trump issued in June “is going to set people on fire to try to change.” But, he said, “Aircraft carriers can probably turn easier than what this is going to be like.”Before leaving CISA, which is part of DHS, in late 2025, Jones spent a year meeting with states to talk about threats related to quantum computing.Many information department heads didn’t fully understand the urgency, he said. Photo by Gaige Davila / Howard Center for Investigative Journalism Garfield Jones, the former lead of the federal government’s strategy on transitioning to post-quantum encryption, says neither the federal government nor states are prepared for Q-Day. A 2024 White House report to Congress estimated the cost of making high-priority systems at federal agencies quantum-secure at $7.1 billion, not counting national security systems. Jones said post-quantum encryption includes ongoing reviews and updates, making the true costs much higher.“The main message to the states and who's responsible for it, I think you've got to look at the (Chief Information Officers),” Jones said. “The governors, the representatives, the senators – you have to be on board with this because that's where the money’s going to come from.”Subramanyam said the risk quantum computers pose is not a partisan issue, but there is still a struggle to make other lawmakers understand the threat.“I think people aren’t scared of quantum because they don’t quite know exactly what the potential is,” he said. “I’m a little scared of quantum, if I’m gonna be honest here.”Through open records requests and other reporting, the Howard Center identified only four states with an active plan to migrate to PQC. Another 14 states are committed to or are in the process of developing a migration plan.The other 32 states have not committed to requiring their agencies to use PQC or refused to confirm whether plans exist. Seven of those states are aware of the risk and are researching the need for a plan. Officials in nine states either did not fulfill a request for records or cited security concerns in refusing to discuss whether any PQC-related policies exist or are in development. The other 16 states did not provide any evidence that they are preparing and said they had no records related to any PQC plan, roadmap or migration timeline. New Jersey, New York, Maryland and Missouri confirmed plans to make their systems quantum-secure. New Jersey’s security manual requires all state agencies to identify vulnerable systems and develop a migration plan. New York’s statewide encryption policy requires all state agencies to create an inventory of vulnerable systems for the purpose of migrating to quantum-secure encryption.Missouri’s Office of Administration confirmed by email to the Howard Center that the state has “established a multi-step Post-Quantum Cryptography (PQC) Implementation Roadmap” that builds on “existing infrastructure by utilizing a cross-functional PQC Planning Team” to identify vulnerabilities, choose vendors and budget for the hardware and software upgrades required.In Maryland, where NIST and the National Security Agency are headquartered, the state’s Department of Information Technology provided a redacted executive briefing indicating the state has a roadmap and is “confirming the feasibility of a rapid, statewide rollout” of quantum-secure computer systems. The briefing makes the urgency clear, reading: “The global transition to PQC is a critical imperative because the maturation of a quantum computer will lead to the instant and irreversible exposure of stockpiled, encrypted state data, resulting in a catastrophic and unrecoverable breach of long-term sensitive state information.”James Saunders, Maryland’s state chief information security officer, confirmed that PQC migration is a priority. While state agency migration does not automatically trickle down to the local level, his department intends to be a resource for cities and counties.“We cannot and will not forget about our local government partners, and that's from local counties and municipalities and anyone else that wants to engage with us,” he said. “We“We may or may not be able to extend technology into those environments due to various different reasons, but we can show ‘this is the journey we took’ and then bring them along the way.”Mississippi is among the states not yet taking action.By email, the Department of Information Technology Services said the state “has not adopted, nor is it currently developing, a formal post-quantum cryptography readiness plan, implementation roadmap, migration timeline, or statewide policy.” But, the statement said, Mississippi “is actively engaging with national organizations, peer states, and other partners to understand emerging approaches, implementation considerations, and best practices.”Other states also admit they have not begun preparing.New Hampshire’s Department of Information Technology said by email that it has “not begun any research or planning related to post‑quantum cryptography.”Louisiana’s Division of Administration said it has no plan but noted that the state’s Information Security Policy shows it’s open to moving in that direction by listing “a post-quantum encryption algorithm as an allowed algorithm.”In response to the Howard Center’s records request, the Indiana Office of Technology provided a copy of the state’s publicly available encryption standard, which does not mention post-quantum cryptography.The technology is developing faster than many developers expected, pushing the timeline for quantum security up significantly. In June, Microsoft announced the Majorana 2 chip and is now expecting to achieve a scalable and commercially relevant quantum computer by 2029, “cutting its original timeline in half,” according to the company. Photo by Emily Mosier / Howard Center for Investigative Journalism At QuEra’s Boston laboratory, this quantum computer is powered by atoms, which are separated by lasers. In June, QuEra and Amazon Web Services announced they would roll out a quantum computer for AWS cloud computing customers in 2028. These companies, alongside IBM and Google, have had quantum partnerships with the U.S. government through research contracts and defense initiatives. The advancements do not necessarily signal how soon an advanced computer will be capable of defeating 128-bit or 256-bit public-key encryption, but that day is coming closer. Many of the largest private companies are making moves to make their systems more quantum-resistant. Communication services like Signal and Apple’s iMessage are adding quantum protection. TikTok began deploying post-quantum cryptographic protection last year, based on NIST guidance. Google plans to implement post-quantum security on Chrome and Google Cloud by 2029.Some in the private sector developing quantum computers acknowledge the weight of that responsibility and are looking to the federal government for guidance.“I think this is one of the key roles that the federal government can play, is to help us understand how to advance this technology, but how to do it safely and how to maximize the public good and minimize the risk factors,” said Ory, the CEO of QuEra, which has over $260 million in private and federal funding to develop a quantum computer. “I'm personally uneasy about all of this technology and how it's being used at a societal level.”State chief information security officers are becoming less confident in their ability to protect public data from cyber threats, according to a nationwide study released in April by the National Association of State Chief Information Officers. Only 22% of CISOs said they were “extremely” or “very confident” in being able to protect public data – half as many as in 2022. While the survey does not mention quantum computing, more than half of respondents reported budgets for cybersecurity that were flat or growing by no more than 5%. Eight states reported budget cuts even as AI-enhanced attacks are on the rise.“By not migrating to post-quantum, you open yourself up to a new class of cyber attacks that we haven't fathomed yet,” said Saunders, the Maryland official. “Especially if you think about artificial intelligence and how that's evolving. I do expect to see some novel cyber attacks in the future. So if you have the capability, the finances and the foresight to try to solve this particular threat area, I would say it's best to proceed and do so as quickly as possible.”Wascalus, St. Paul’s CIO, is urging the federal government to help cities prepare because they “represent the humans in America.”“There are big cities, there are capital cities that likely have more resources to prepare for these types of things, but we should really be thinking about it collectively and what impacts the county could spread into a larger attack or a larger breach,” she said. “We want to help protect our entire state, our entire nation, right?”