Across the Atlantic: How do quantum cyber readiness efforts in the US and EU compare?

Itan Barmes (Deloitte Risk Advisory B.V.) & Casper Stap (Deloitte & Touche LLP)

Introduction

Quantum technologies are maturing and offer significant opportunities to transform how organizations operate. Countries are bullish on the potential that quantum computers will have, especially in the long run, and many have set up significant industrial bases¹ to research and develop quantum technologies. But quantum computers can be a double-edged sword, as they may have the potential to break some cryptographic systems used to protect our digital society. Mitigating this risk will require organizations to implement a new type of cryptography. In light of the immense nature of the task, governments around the world are collaborating and exploring if and how to stimulate organizations to do so sooner rather than later. There are differences in how this is tackled, as a comparison between the United States’ (US) and Europe’s approaches shows.

How quantum computers threaten cryptography

The security of data traffic related to governments, businesses, and private citizens alike depends, to a large extent, on cryptography. Cryptography leverages mathematical problems that current computers cannot realistically solve, which makes it safe to use. Quantum computers will be much better at solving some of those mathematical problems, rendering some cryptographic systems unsafe. This is a serious development that organizations should confront head-on as it threatens their ability to securely operate. Luckily, quantum computing technology has yet to mature on several fronts, leaving “Q-Day” — the day when quantum computers can break our cryptography — still many years away. This, however, does not mean organizations should wait. To mitigate the risk of quantum computers, today’s vulnerable cryptographic algorithms need to be updated with new cryptographic algorithms that quantum computers can’t break. These Post-Quantum Cryptography (PQC) algorithms are being standardized by the United States’ National Institute for Standards and Technology (NIST), which is collaborating with a global community of experts and companies, and will likely be published for adoption later this year. Though other countries around the world have some other initiatives set up around the development of quantum-secure algorithms, most are expected to adopt the NIST standardized algorithms.

Why action on quantum risk is essential now

Although the solution might sound relatively simple, implementing this new set of cryptographic algorithms in a complex, modern organization will take many years. Similar cryptographic transitions in the past took more than a decade to complete. This changes the equation as organizations face a serious risk if they have not completed their transition by the time quantum computers have matured sufficiently to break their cryptography – by a so-called cryptographically relevant quantum computer. The time for organizations to start understanding the risk quantum computers may pose to them is here, and they should subsequently be laying the groundwork for the transition to quantum-secure technologies.

But while some forward-leaning organizations, or those that have very sensitive information to protect such as banks and government agencies, are already well-underway with their quantum-security programs, many others have been slower. Companies often struggle to understand how to begin mitigating quantum risk, in part because they typically already struggle to manage the cryptographic risks of today. The threat also feels distant, and some chief information security officers may feel there are more urgent issues on their plates. This viewpoint could be an issue as quantum risk is a systemic problem for society: in our high extent of interconnectivity and interdependency, it is insufficient for just a few organizations to adequately protect their data if others don’t. This requires a broad, coordinated change, in which governments have a role to play. So, how have they shaped it?

Important steps in the United States

The US has clearly defined a post-quantum future as a strategic interest, such as in its 2023 National Cyber Security Strategy. And already before that, President Biden in 2022 signed two National Security Memoranda (NSMs), which are presidential directives on national security matters. Among others, NSM 8 and 10 reflect how the United States acknowledges quantum security as a strategic national security interest. In addition, they define requirements for governmental agencies to start preparing to mitigate quantum risk. Several deadlines within these NSMs are already driving predominantly government agencies and their contractors to act on mitigating quantum risk.

Beyond these two NSMs, a major regulatory requirement that was also rolled out in 2022 came from the White House’s Office of Management and Budget (OMB). The OMB sets the president’s budget and defines standards that many federal agencies should adhere to in their operations. The OMB in 2022 issued Memorandum 23-02, which requires federal agencies to create so-called ‘cryptographic inventories’; basically, overviews of where cryptography is used in an organization, and to what extent it is vulnerable to quantum or classical attacks. This Memorandum is also slowly leading US government agencies to prepare for quantum risk.

In addition, the US National Security Agency (NSA) establishes specific requirements for US National Security Systems (NSS), which are often even more sensitive such as military and intelligence platforms and approve how such systems may use commercial cryptographic algorithms. In 2022, the NSA updated its Commercial National Security Algorithm Suite 2.0 list to include quantum-secure algorithms and to advise agencies on cryptographic transitions for NSS. Notably, NSA provided anticipated requirements and timelines for implementing algorithms targeted for specific system components, namely: software and firmware signing, web browsers/services and cloud services, traditional networking equipment, operating systems, niche equipment (including large public-key infrastructure systems), and custom applications and legacy equipment. The NSA expects new algorithms to be implemented across NSS by 2033.

Other initiatives may focus less on hard, enforceable requirements, but can still nudge and guide organizations to act. For example, the Cybersecurity and Infrastructure Security Agency (CISA), within the US Department of Homeland Security (DHS), operationally leads federal cyber security efforts and coordinates critical infrastructure security, by collaborating and coordinating with local and commercial critical infrastructure operators in the US. In addition, it runs a Post-Quantum Cryptography Initiative to unify and drive agency efforts to mitigate quantum risk, such as by promoting risk assessments that can help agencies plan and coordinate adoption and implementation of policies and standards. This leading role from the CISA is significant, as it involves facilitating quantum security efforts across the 55 National Critical Functions (NCFs) defined by the US government that should transition to Post-Quantum Cryptography. Several of these NCFs — such as internet providers — are critical enablers of other functions to become quantum-secure, thus making it vital that they act soon.

Slower action in Europe

In Europe, governments are less directive in mitigating quantum risk. On the European Union (EU) level, integrating cybersecurity into key technologies such as quantum computing is mentioned in the Cybersecurity Strategy for the Digital Decade. Though the EU has not defined specific plans that countries should adopt, the EU has recently taken other noticeable steps toward influencing the quantum readiness journeys of its member states. In April 2024, it published a recommendation in which it advised — but not required — Member States to start drafting quantum security strategies in coordination with each other.

While no specific regulations have been set up by the EU as a whole, quantum readiness has found its ways into strategic development of individual countries. In 2021, France rolled out the Quantum Plan allocating €150 million in research toward PQC and lists developing and disseminating PQC as one of its main five strategic objectives. But although quantum ranks high on European strategic agendas, it’s positive potential is articulated more elaborately than its risks. The Netherlands’ National Technology Strategy elaborately covers quantum technologies as a top priority, but only very briefly mentions its security risks.

That is not to say that it is not on their radar. Many governments have had agencies responsible for national security assess the risk and discern a perspective on how to mitigate it. For example, German, British and Dutch cyber security agencies have drafted recommendations on how organizations can become quantum-secure, and are referring to the NIST standardization process for PQC algorithms. Despite publishing these overlaying guidelines, concrete requirements or mandates for organizations to adhere to are yet to follow.

In the end, government action in Europe is focused more on writing position papers, providing voluntary guidance and recommendations, and investing in quantum (security) technologies. Governments are taking a more collaborative, ’soft’ approach. And although European participation in research on PQC is significant — both the European Telecommunications Standards Institute (ETSI) and EU Agency for Cybersecurity (ENISA) have working groups on researching PQC — NIST and the United States are moving forward more quickly.

Broad, orchestrated action

For the world to confidently welcome the dawn of quantum technologies, it is essential that the necessary guardrails are put in place to achieve this securely. But the rise of cryptographically-relevant quantum computers likely still being several years could lull organizations into a false sense of timing around assessing vulnerabilities and implementing PQC. This could be a significant oversight that may have far reaching consequences across industries. And the use of quantum-vulnerable cryptography is so widespread that it can be risky to depend on the considerations and strategies of individual organizations. Governments can help shape this, with strategies ranging from soft nudging and providing advice to setting enforceable baselines and deadlines. Although on each side of the Atlantic governments shape their role differently, it is important that all clearly see a role for themselves in guiding the broader ecosystem to move to a quantum-secure future.

Disclaimer by the authors: This article contains general information only and Deloitte is not, by means of this article, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This article is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor. Deloitte shall not be responsible for any loss sustained by any person who relies on this article.

As used in this article, “Deloitte” means Deloitte & Touche LLP, a subsidiary of Deloitte LLP. Please see www.deloitte.com/us/about for a detailed description of our legal structure. Certain services may not be available to attest clients under the rules and regulations of public accounting.

Copyright © 2024 Deloitte Development LLC. All rights reserved.

Header photo: Wikimedia Commons / FMNLab