By the 2030s, a quantum computer with the power to break current federal encryption could emerge, leaving sensitive government data vulnerable to malicious actors. The U.S. Government Accountability Office reports that federal agencies have not fully prepared for this looming threat, failing to fully identify vulnerable systems or test quantum-resistant algorithms. A future cryptographically relevant quantum computer could allow an attacker to compromise systems authenticating users, gaining access to sensitive information and decrypting previously acquired data. Until agencies address gaps in cryptography expertise, inventories, and planning, they will be ill-equipped to defend against these attacks.
Emergence of Cryptographically Relevant Quantum Computers (CRQC) Threatens Data
The potential for a quantum computer to compromise authenticated systems presents a serious vulnerability. Malicious actors could impersonate legitimate users and gain unauthorized access to sensitive information. Industry experts currently estimate the development of a cryptographically relevant quantum computer (CRQC) may occur as early as the 2030s, a timeframe that demands immediate attention to system upgrades and cryptographic defenses. This estimate, however, is subject to considerable variation due to uncertainties surrounding qubit growth rates and the precise number of qubits required for decryption.
The emergence of such a machine would not simply accelerate existing hacking techniques, but fundamentally alter digital security. Federal agencies have not fully prepared to transition to more secure, post-quantum cryptography, leaving critical systems exposed to future threats.
The Government Accountability Office (GAO) evaluation framework identified three key practices agencies should address, but found that none of the 24 Chief Financial Officer Act agencies had fully implemented them. These practices encompass establishing cryptography expertise, developing comprehensive inventories of cryptographic systems, and creating detailed plans for testing quantum-resistant algorithms. A lack of these foundational elements leaves agencies ill-equipped to address the vulnerabilities a CRQC would exploit, potentially allowing decryption of previously acquired and stored data.
The GAO report highlights that the incomplete implementation of these practices stems from deficiencies in three areas. First, agencies lack sufficient cryptography expertise to effectively assess and mitigate the quantum threat. Second, they have not established robust processes for creating inventories of cryptography and determining the necessary funding for transitioning to post-quantum cryptography.
Finally, agencies are missing detailed plans to guide the essential testing of new quantum-resistant cryptographic methods. “Until the selected agencies address these weaknesses, they will not be well-positioned to address the threat of CRQCs to cryptography that agencies rely on to protect sensitive information,” the report states. The threat extends beyond simply unlocking encrypted data. A CRQC could also undermine the very systems used to verify user identities.
The GAO initiated its study in response to concerns about the potential for quantum computers to break federal agency cryptography, and the findings emphasise the urgency of proactive preparation. In a sensitive report issued in September 2025, the GAO made 89 recommendations to 23 agencies, focusing on establishing and implementing processes for developing cryptography inventories and identifying funding for post-quantum cryptography.
While twelve agencies agreed with the recommendations, responses varied, with two partially agreeing, seven neither agreeing nor disagreeing, and one disagreeing with three of the four recommendations. The GAO maintains that all recommendations are warranted, despite the differing levels of acceptance. The public version of the report does not include any additional recommendations, emphasizing the immediate need for action on the previously issued guidance. The development of a CRQC is not merely a theoretical concern. It represents a tangible threat to the confidentiality, integrity and availability of federal data.
The GAO’s findings is a critical warning, urging agencies to prioritize the development of post-quantum cryptographic capabilities and address the identified weaknesses before a sufficiently powerful quantum computer becomes a reality. The timeframe for action is shrinking, and the consequences of inaction could be severe, potentially jeopardizing national security and critical infrastructure.
See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.
