Internet Lawyer Blog
Quantum computing is becoming a serious legal, cybersecurity, and business risk-management issue. Although practical quantum computers capable of defeating widely used cryptographic systems are not known to exist today, businesses should not wait until the risk becomes immediate before planning for it. The migration from existing cryptographic systems to quantum-resistant systems may take years, and in some cases the risk already exists because sensitive encrypted data can be collected now and decrypted later when stronger quantum capabilities become available.
For companies that store confidential information, process personal information, use cloud services, rely on digital signatures, operate e-commerce platforms, manage intellectual property, or maintain regulated data, quantum computing should be part of the cybersecurity and legal compliance conversation. This includes businesses subject to privacy laws, cybersecurity requirements, vendor-management obligations, data retention duties, contractual security commitments, and regulatory oversight.
What Is Quantum Computing?
Traditional computers process information using bits that generally represent either zero or one. Quantum computers use quantum bits, or qubits, which can rely on quantum-mechanical principles such as superposition and entanglement. These properties may allow quantum computers to perform certain calculations much more efficiently than classical computers.
Quantum computing is not simply “faster computing.” It is a different computational model that may be especially powerful for certain categories of problems, including simulation, optimization, chemistry, materials science, and cryptanalysis. The cybersecurity concern is that a sufficiently powerful quantum computer could undermine many public-key cryptographic systems that currently protect internet communications, digital signatures, financial transactions, authentication systems, software updates, virtual private networks, and other critical infrastructure.
Why Quantum Computing Is a Legal Issue
Quantum computing becomes a legal issue because modern business depends on encryption. Encryption protects personal information, trade secrets, privileged communications, financial records, health data, authentication credentials, source code, payment systems, and confidential business information. If the encryption systems used to protect that data become vulnerable, companies may face legal exposure based on privacy laws, cybersecurity laws, contract obligations, negligence theories, consumer protection statutes, regulatory standards, and representations made to customers or vendors.
The legal issue is not limited to whether a company is attacked today. It also includes whether the company reasonably prepared for foreseeable cybersecurity risks, whether it maintained reasonable security procedures, whether it properly supervised vendors, whether it retained data longer than necessary, and whether it accurately represented its security practices.
Post-Quantum Cryptography and NIST Standards
Post-quantum cryptography, often called PQC, refers to cryptographic algorithms designed to resist attacks by both classical computers and future quantum computers. It is different from quantum cryptography or quantum key distribution. PQC generally involves software-based algorithms that can be implemented in existing technology systems, while quantum key distribution involves specialized quantum-physics-based communication systems.
The National Institute of Standards and Technology has finalized three principal post-quantum cryptography standards. These include one key-encapsulation mechanism standard for key establishment and two digital-signature standards. In practical terms, businesses should understand that PQC migration will affect both confidentiality and authentication. Encryption protects information from disclosure, while digital signatures help prove identity, authenticity, integrity, and nonrepudiation.
Businesses should avoid assuming that “quantum-safe” migration is a single software update. It may require reviewing websites, mobile applications, APIs, authentication systems, digital certificates, TLS configurations, VPNs, email encryption, code-signing systems, payment systems, document-signing systems, blockchain tools, cloud services, and embedded devices.
The “Harvest Now, Decrypt Later” Risk
One of the most important risks is commonly described as “harvest now, decrypt later.” In this scenario, a bad actor copies or intercepts encrypted information today and stores it until quantum computing becomes powerful enough to decrypt it in the future. This is especially concerning for data that must remain confidential for many years.
Examples include trade secrets, legal communications, health records, financial records, government records, biometric data, source code, private keys, sensitive customer information, and merger or acquisition records. A company may believe its data is safe today because it is encrypted, but if that data has a long confidentiality life, the company should consider whether its current cryptography is suitable for future threats.
This risk also affects data retention. The longer a business keeps sensitive information, the greater the burden to protect it. Privacy and cybersecurity programs should therefore evaluate whether long-term data storage is necessary and whether retention schedules should be revised.
Privacy Law and Reasonable Security
Privacy laws increasingly require businesses to use reasonable security procedures and practices appropriate to the nature of the personal information being protected. In California, businesses subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act, must consider data collection, use, retention, sharing, vendor relationships, and reasonable security practices.
Quantum-related risk does not mean every business must immediately replace every system. However, it does mean businesses should begin incorporating quantum-readiness into their broader privacy and cybersecurity governance. A company that collects sensitive personal information should know where that information is stored, how it is encrypted, who has access to it, how long it is retained, whether vendors process it, and whether it is protected by cryptographic systems that may eventually become obsolete.
For companies in regulated sectors, such as finance, healthcare, insurance, education, government contracting, and critical infrastructure, the need for a documented migration strategy may become increasingly important.
Vendor Contracts and Cloud Services
Most businesses rely on third-party service providers. These may include cloud platforms, SaaS vendors, managed service providers, cybersecurity vendors, payment processors, analytics tools, customer relationship management platforms, hosting companies, email providers, and software developers. If these vendors store, process, transmit, or secure sensitive information, their quantum-readiness may directly affect the business.
Vendor contracts should be reviewed for provisions addressing encryption standards, key management, cybersecurity controls, breach notification, audit rights, data deletion, subprocessor controls, incident response cooperation, regulatory compliance, indemnification, and migration to updated security standards. Businesses should also consider asking vendors whether they maintain a cryptographic inventory and whether they have a roadmap for post-quantum cryptography.
Companies should be careful about vague vendor promises. A statement that a system is “secure” or “encrypted” may not answer whether the system is prepared for post-quantum migration.
Digital Signatures, Blockchain, and Authentication
Quantum computing may also affect digital signatures, blockchain systems, identity platforms, and authentication infrastructure. Digital signatures are used to verify software updates, contracts, certificates, financial transactions, blockchain wallets, and secure communications. If a signature system becomes vulnerable, attackers may be able to impersonate trusted parties, forge transactions, or compromise the integrity of software and documents.
Blockchain and digital asset systems may also face quantum-related risks depending on how private keys, signatures, and wallet infrastructure are implemented. This does not mean blockchain technology is obsolete, but businesses using blockchain, smart contracts, tokenized assets, or digital wallets should understand the cryptographic assumptions behind those systems.
Similarly, businesses using electronic signatures, identity verification, single sign-on, public key infrastructure, multifactor authentication, and device certificates should review whether those systems can transition to new cryptographic standards without major disruption.
Corporate Governance and Board Oversight
Quantum cybersecurity should be treated as an enterprise risk issue, not merely an information technology issue. Officers, directors, and senior management should understand whether the company depends on quantum-vulnerable cryptography, whether sensitive data requires long-term confidentiality, and whether the company has a reasonable plan for migration.
A practical quantum-readiness program may include a cryptographic inventory, data classification, vendor assessment, contract review, privacy-policy review, incident-response updates, cyber-insurance review, and documented risk prioritization. The organization should identify high-value systems first, including systems that protect sensitive personal information, trade secrets, financial data, authentication credentials, software-signing keys, and regulated records.
Litigation and Regulatory Risk
Future lawsuits may ask whether a business used reasonable cybersecurity practices in light of known quantum risks. Potential claims may include negligence, breach of contract, breach of implied covenant, unfair business practices, privacy violations, consumer protection claims, securities-related disclosure claims, or regulatory enforcement actions.
The legal questions may include whether the company ignored known risks, failed to supervise vendors, misrepresented encryption practices, failed to update cybersecurity policies, retained sensitive data unnecessarily, or failed to implement available safeguards. Companies should also avoid overstating their readiness. Marketing statements such as “quantum-proof,” “unbreakable,” or “future-proof” may create risk if they are not technically accurate and legally supportable.
Practical Steps for Businesses
Businesses should begin with a practical and documented approach. First, identify where cryptography is used. Second, classify the data and systems that require long-term confidentiality or strong authentication. Third, evaluate which vendors control or process that information. Fourth, review contracts, policies, and cybersecurity documentation. Fifth, prioritize high-risk systems and develop a migration roadmap.
The goal is not panic. The goal is reasonable preparation. Companies do not need to solve every post-quantum issue immediately, but they should begin planning now because migration may be complex, expensive, and dependent on vendors, software providers, hardware manufacturers, standards organizations, and regulatory expectations.
Conclusion
Quantum computing presents extraordinary opportunities, but it also creates major cybersecurity and legal challenges. Businesses should understand how quantum computing may affect encryption, digital signatures, authentication, privacy compliance, vendor contracts, cloud computing, data retention, and litigation risk. Companies that begin preparing now will be better positioned to demonstrate reasonable security, manage vendor risk, protect sensitive information, and respond to future regulatory expectations. Quantum-readiness should be part of a broader cybersecurity and privacy compliance strategy.
Our law firm assists clients with internet law, technology law, cybersecurity, data privacy, artificial intelligence, electronic discovery, digital evidence, online business disputes, and related compliance matters. As quantum computing and post-quantum cryptography continue to develop, businesses should seek qualified legal guidance to evaluate their rights, obligations, and risk-management strategies.