Unraveling the Pentagon’s quantum problem

HONOLULU—Preparing for a quantum computer attack means two things: knowing exactly which systems will need to be upgraded and making sure everyone understands how serious the risk is to sensitive data protected by standard encryption.

“Our adversaries are using quantum. How advanced are their capabilities? We don't totally know. But the reality is that that presents some threats, and the challenge with, you know, post-quantum cryptography is this idea of ‘harvest now, decrypt later,’” said Matt McFadden, vice president of cyber for GDIT, during a panel discussion at the TechNet Info-Pacific conference here. “The reality is, with ‘harvest now, decrypt later,’ our adversaries can be harvesting data for a really, really long time,” and eventually a quantum computer will be able to break the standard encryption used today. 

Post-quantum cryptography, or the mathematical algorithms needed to secure networks and systems from attacks using quantum computers, is a challenge each military service must tackle. But the White House put a timeline on it for federal agencies—by Dec. 31, 2030—for high value assets and high-impact systems “to use PQC for key establishment” in an executive order issued June 22. The deadline “to use PQC for digital signatures” is 2031.

“It’s just this one more threat vector that we have to be concerned about as we develop our resilient architecture,” said Col. Tassika Davis, Pacific Air Forces Command’s director of cyber operations and warfighter communications. “Now, we need to make sure that our architectures are cryptographically agile, so that we can shift and move and continue, and not degrade mission capability, while we are also providing the most current defense capabilities.”

To do that takes mapping the whole IT ecosystem as it is, “looking at it from the entire threat picture, and then planning against that,” she said. 

It sounds simple but just knowing what exactly needs to be protected is a key, yet challenging first step, GDIT’s McFadden said during the panel. 

“It's hard to migrate when you don't know what you have. So, really, the first step in this process is really having a comprehensive inventory,” he said, including certifications for apps, devices, and networks. “One of the things you realize pretty fast is like you're very reliant on third-party providers…you’ve got to really work together with the system owners, the third-party suppliers, your supply chains, and basically build that governance team to help drive” compliance and crypto agility, or the ability to combat quantum cyber threats. 

Securing systems for a post-quantum threat becomes more complicated when the platforms that need to be upgraded don’t stay in one place for long. 

“Ships are being extended more than they have been. There are crises that are popping up everywhere. And we used to be in a period of [maintenance] availabilities, which means we had about nine months to a year to do modernization. Now you’ve got 45 days,” said Capt. Victor Taylor, Pacific Fleet’s director of communications and information systems, during the panel. “So, how do I break up these big pieces of modernization into modular…shorter windows? How do I execute the configuration management? How do I have the teams to do it at scale at multiple locations? And then how do I schedule it with all the dynamic changes that are occurring? And so, if we think we're going to do that with our old processes, that's not the case.”

And part of the Pentagon and military services upgrading their high-value systems to withstand a quantum attack will be making sure individuals are aware of the quantum threat. 

“The first thing is to acknowledge that it's a real problem. Like Q-Day isn't a thing that's going to be beyond our retirement. Q-Day is going to be a thing that happens…definitely within the next five years,” Peter O’Donoghue, Quantum Sky’s chief technology officer, told Defense One after the panel. “So, then you need to plan for it. You need to actually fund it.”

The Pentagon released a post-quantum cryptography strategy earlier this year. And its implementation “could be added to the Pentagon’s existing network modernization,” O’Donoghue said.

But how organizations upgrade their systems will vary—and take awareness, he said.

“There's no one-size-fits-all [solution], but I think each department, each agency needs to actually understand what the risk is and start buying it down and taking action. Like sitting on your hands and going into a kind of analysis paralysis is not the answer. Denying it is definitely not the answer either,” O’Donoghue said.