(The Daily Signal)—On June 22, President Donald Trump signed two executive orders that, taken together, amount to one of the most consequential technology-security decisions of the decade, and almost no one outside the cybersecurity profession noticed.
Executive Order 14409, “Securing the Nation Against Advanced Cryptographic Attacks,” and Executive Order 14411, “Ushering in the Next Frontier of Quantum Innovation,” address the two halves of a single problem: We are racing to build a machine that will eventually break the encryption protecting nearly everything, while simultaneously racing to defend ourselves against it.
Here is the threat in plain English: A powerful enough quantum computer will one day be able to crack the digital locks that currently protect our bank accounts, power grid, medical records, and military communications. These are the same locks we trust today precisely because no ordinary computer could ever pick them.
That sentence should worry every American, and for a reason that is not obvious. The danger is not only in the future; it is already here.
A cryptographically relevant quantum computer does not yet exist. But our adversaries are not waiting for one. They are executing a strategy security professionals call “harvest now, decrypt later.” They are quietly vacuuming up our encrypted data today and warehousing it, betting that within a decade they will own a machine capable of unlocking it.
Beijing’s Volt Typhoon hackers have already burrowed into American communications, energy, and water systems, and Chinese operatives have penetrated our major telecom networks. The administration’s own order acknowledges bluntly that adversaries may already be collecting American data with exactly this intent.
This is what makes the quantum problem fundamentally different from the Y2K scramble it is so often compared to. Y2K had a deadline we could meet by fixing systems before the clock struck midnight. The quantum threat has no such grace period.
Once an adversary has copied our encrypted secrets, there is no taking them back. A diplomatic cable, a defense archive, or a citizen’s health record stolen today is already lost the moment a capable quantum computer comes online. For any information that must stay confidential for 10 or 20 years, the breach has, in effect, already happened.
To the administration’s credit, EO 14409 sets hard, dated obligations.
Federal civilian agencies must inventory their most valuable systems and migrate them to new, quantum-resistant encryption standards, developed and finalized by the National Institute of Standards and Technology, by the end of 2030 for key establishment and 2031 for digital signatures.
Every agency must name a migration lead. NIST must run a working pilot by 2027 to show the rest of government how it is done. And critically, federal contractors will be required to meet the same standards, impacting much of the private sector.
The companion order, EO 14411, is the offense to 14409’s defense. It commits the nation to building a quantum computer powerful enough for real scientific work at a Department of Energy facility, directs the Pentagon to field next-generation quantum sensors by 2028, hardens our domestic quantum supply chains against foreign dependence, and tasks the FBI with protecting our quantum researchers and companies from espionage.
This matters because the same regime that treats America as an enemy is pouring state resources into winning the quantum race outright.
EO 14411 initiates a serious, whole-of-government posture, and it builds on the National Quantum Initiative the president first signed into law in 2018.
But sound policy on paper is not the same as a secure homeland, and anyone serious about protecting this country should ask the harder question: Will this actually defend the critical infrastructure most Americans depend on?
Here the picture is more sobering. The federal government can order its own agencies and its contractors to comply. It cannot simply command the privately owned utilities, water systems, pipelines, hospitals, and financial institutions that make up the overwhelming majority of our critical infrastructure—the very sectors China has been actively pre-positioning inside. For them, these orders offer assistance and encouragement, not a mandate.
The gravitational pull is real, channeled through procurement rules and federal technical guidance, but the legal teeth largely stop at the government’s edge.
And the deepest challenge is not legal but physical. The new encryption is ready; the math is settled. The problem is the vast installed base of industrial equipment that runs our grid and our water: controllers and sensors built to last 20 or 30 years, with limited computing power and rare maintenance windows.
Much of this hardware cannot simply be updated with new software. It must be physically replaced. This capital-replacement cycle will take decades, meaning it does not naturally align with a 2030 federal deadline. If we are not honest about that mismatch now, we will discover it too late.
The right response is neither alarmism nor complacency. These orders are a genuine and welcome step. The federal government has finally moved quantum security from aspiration to accountability, with names, dates, and owners attached. That deserves recognition.
But Congress and the administration should now do three things.
First, treat “harvest now, decrypt later” as an active campaign already underway, and prioritize migrating our longest-lived secrets first.
Second, give critical-infrastructure operators a realistic path, clearing the regulatory and rate-recovery obstacles that keep aging equipment in service long past its security life, so that operators can fund replacement through the capital and rate structures that already exist rather than waiting on Washington.
Third, insist that every dollar spent buys genuine crypto-agility, so that we are never again locked into a single standard that an adversary’s breakthrough can render obsolete overnight.
The quantum era will arrive whether or not we are ready for it. Last week, the nation finally started the clock. The task now is to make sure we are not still standing at the starting line when it runs out.
