Somewhere right now, intelligence agencies are almost certainly recording encrypted traffic they cannot read, and storing it. Not because they expect to crack it tomorrow, but because they're betting on being able to crack it eventually. The strategy has a name, harvest now, decrypt later, and it rests on a specific piece of math from 1994: an algorithm published by mathematician Peter Shor showing that a sufficiently powerful quantum computer could break RSA and elliptic-curve cryptography, the encryption schemes that currently protect almost everything sent over the internet, in a fraction of the time a classical computer would need.
Why waiting for the machine to exist isn't actually safe
No quantum computer capable of running Shor's algorithm at the scale needed to break real-world encryption exists yet, and nobody can say with confidence when one will. That uncertainty is exactly why harvest now, decrypt later is treated as a present-tense threat rather than a future one. An adversary doesn't need a working quantum computer today to benefit from stealing encrypted data today. They just need somewhere to store it and the patience to wait. For information with a long shelf life, classified government communications, medical records, long-term financial and diplomatic data, that stored, currently unreadable traffic is already exposed, on a timer nobody can precisely set.
The standards built to answer it
In August 2024, the US National Institute of Standards and Technology finalized its first three quantum-resistant cryptographic standards after an eight-year international competition: FIPS 203, known as ML-KEM, for establishing secure keys; FIPS 204, ML-DSA, for digital signatures; and FIPS 205, SLH-DSA, a hash-based signature scheme built as a more conservative backup option. All three replace the underlying math that made RSA and elliptic-curve cryptography vulnerable with problems believed to resist both classical and quantum attack. The National Security Agency's own guidance for national security systems sets a firm deadline behind this shift, requiring exclusive use of post-quantum algorithms for signing by 2030, with quantum-vulnerable algorithms like RSA and elliptic-curve cryptography deprecated after 2030 and disallowed entirely after 2035, regardless of whether a quantum computer capable of breaking them has actually been built by then.
The other side of the same coin: making eavesdropping visible instead of impossible
While NIST's standards focus on making the encryption itself resistant to quantum attack, China has pursued a different quantum application aimed at the same underlying problem: making any interception of a message detectable rather than just making the message harder to break. Its Micius satellite, launched in 2016 and named after an ancient Chinese philosopher, generates pairs of entangled photons and beams them to ground stations, exploiting a quantum property where measuring one particle instantly affects its entangled partner regardless of distance. Used correctly, that property means any attempt to intercept a transmitted encryption key leaves a detectable trace, because observing a quantum system changes it. In 2017, Micius was used to distribute quantum cryptographic keys between ground stations near Beijing and Vienna, enabling what was described as the first intercontinental quantum-encrypted video call, a distance of roughly 7,400 kilometers. Researchers have continued refining the system since, including a 2020 demonstration establishing a secure link between two ground stations without requiring either side to trust the satellite relaying the signal.
Two different bets on the same underlying shift
NIST's post-quantum standards and China's quantum satellite program represent two different responses to the same underlying transition. One assumes quantum computers will eventually break current encryption and tries to build replacement math resistant to that specific attack. The other tries to use quantum mechanics itself as a detection system, so that eavesdropping becomes visible the moment it happens rather than undetectable until decades later. Both point toward the same conclusion: the assumptions that have underpinned secure communication, and by extension a huge share of modern intelligence work, for the last several decades are treated by governments as having a genuine, if unpredictable, expiration date.
What this means for the actual practice of espionage
For intelligence services, the practical stakes are less about a single dramatic moment when quantum computers suddenly break everything and more about a long, uneven migration that's already underway. Agencies that captured encrypted diplomatic or military communications years ago and archived them are, by definition, sitting on a stockpile that becomes more valuable every year a cryptographically relevant quantum computer gets closer to existing. Agencies that haven't yet migrated their own communications to quantum-resistant standards are, by the same logic, generating exactly that kind of exposed archive for someone else right now. The quantum threat to espionage isn't a future event on a calendar. It's a slow-motion transition already reshaping which secrets are safe to keep and which ones were never as safe as they looked.
