Government Agencies race ahead of private sector on quantum preparedness
We are living through an era of profound transformation, driven by rapid technological advances and shifting geopolitical alliances. It's an uncomfortable, yet exciting period. Three technological drivers are central to this transformation: artificial intelligence (AI), renewable energy generation, and the escalating arms race between quantum computing and encryption technologies.
Quantum computing rarely gets a mention alongside the two other familiar technologies I listed above. But it should. It's a dual-impact technology, carrying enormous promise, such as drug discovery, new materials innovation, and climate change solutions. Just like AI, both private and government quantum initiatives are receiving massive funding and making steady progress. Yet each step closer amplifies cybersecurity risks.
The primary quantum threat lies in its capability to break existing cryptographic systems, undermining the very foundations of the digital economy. Although this threat will not materialise overnight, it could erode trust gradually and covertly, necessitating urgent and proactive preparedness. Even slight disruptions to the flow of information and money can have outsized consequences for economies, and what we are discussing here is no "slight" disruption.
Historically, governments have reacted passively to innovation, setting policy only after new technologies emerge. With quantum computing, however, passive reaction is inadequate. Pleasingly, governments around the world have recognised this. The United States' Quantum Computing Cybersecurity Preparedness Act, and the UK's National Cyber Security Centre (NCSC) guidelines on quantum encryption, are two examples amongst many of governments advocating (and enforcing) post-quantum cryptography adoption across government and critical infrastructure in the next few years.
The concern is that the private sector at large is not receiving the same signal. Given the predictability of quantum computing's impacts, it is clear that governments must set clear regulations, guidelines, and standards to proactively manage these risks in private sector organisations before they fully materialise.
To accelerate private sector preparedness, a coordinated approach across multiple regulatory and advisory bodies is essential. While cybersecurity standards primarily fall under the purview of the Australian Cyber Security Centre (ACSC) and the Department of Home Affairs, financial regulators like the Australian Securities & Investment Commission (ASIC) could play a complementary role in reinforcing these messages.
Given ASIC's existing mandate to ensure corporate boards fulfill their risk management duties, the regulator could enhance awareness by highlighting quantum computing risks within its broader guidance on director obligations to ensure boards understand that quantum threats fall within their duty of care.
Such an approach would leverage ASIC's influence over corporate governance while respecting the technical expertise of specialized agencies.
Just like AI, once the quantum genie is out of the bottle, it will quickly affect almost every aspect of the way we do business. Unlike AI, we can see this one coming, but we have to put effort into getting the nation prepared. It does no good for the Australian government, and a few select private organisations being quantum resilient, only to have the rest of the supply chain exposed. We have seen what happens when supply chains break down
As we navigate these transformative times, clearer, actionable guidance and proactive education can significantly improve corporate readiness for quantum threats, aligning commercial preparedness with government mandates. This is a national security issue, and at Senetas, we see this first-hand through increased demand from our customers for tailored sovereign encryption solutions across Asia, the Middle East, and Eastern Europe.
Governments around the world are getting ready. Australia's national security, resilience, productivity, and prosperity rely on immediate and coordinated action from the private sector.
