The facts
The Government Accountability Office's public report on quantum cybersecurity, GAO-27-108740, released in October 2026, warns that a future "cryptographically relevant quantum computer (CRQC)" could undermine the encryption federal agencies use to secure their systems. Quantum computers leverage qubits to solve specific problems significantly faster than classical computers, and while today's machines cannot yet break federal cryptography, most industry experts believe a CRQC will be developed, possibly as soon as the 2030s.
The stakes are the systems the report says the government runs on: technology that collects and disseminates funds, transfers benefits, enables tax filings, collects revenue, generates and transmits electricity, and manufactures weapons. According to the report, a malicious actor with a CRQC could use it to compromise systems that ensure the authenticity of system users, and to decrypt data that the actor acquires and stores prior to the development of such a computer. In other words, adversaries can grab the encrypted goods now and crack them later.
To prepare, GAO built an evaluation framework, from Office of Management and Budget guidance, of three practices agencies should address: develop and annually update a prioritized inventory of agency systems with vulnerable cryptography; identify and annually update the funding needed to transition vulnerable cryptography on priority systems to post-quantum cryptography; and test post-quantum cryptography in agency environments to help ensure the algorithms will work in practice. The finding: "none of the 24 selected agencies fully addressed these practices"
Why not? The report says the incomplete implementation is due in part to a lack of (1) cryptography expertise, (2) processes for developing cryptography inventories and identifying funding needed to transition to post-quantum cryptography, and (3) plans to guide post-quantum cryptography testing. "Until the selected agencies address these weaknesses, they will not be well-positioned to address the threat of CRQCs to cryptography that agencies rely on to protect sensitive information."
The public version follows a sensitive report in which GAO made 89 recommendations to 23 agencies. Twelve agencies agreed with the recommendations, two partially agreed, seven neither agreed nor disagreed, and one disagreed with three of its four recommendations. "GAO maintains that all recommendations are warranted." We are not making any additional recommendations in this public version.
Our take
Read that list of failures one more time. The agencies in charge of protecting America's encryption do not have cryptography expertise. That is not an insult we invented. That is the government's own auditor, in a published federal report, telling Congress that the people guarding the locks cannot find the locksmith, because they are not locksmiths. Your tax filings, your benefits, the power grid, and the weapons plants are defended by institutions whose official position is that they lack the expertise to defend them.
And step one was not hard. Step one was making a fucking list. Develop and annually update a prioritized inventory. A spreadsheet. The federal government can itemize every dollar you earned, every benefit it sent you, and every bolt on a weapons line, but ask it to count its own computers and twenty-four agencies come back empty-handed. None. Zero out of twenty-four. If a teenager turned in this little homework, you would take the phone away. These people get a budget.
Then there is the response to being told. Twelve agencies agreed. Two sort of agreed. Seven neither agreed nor disagreed, the bureaucratic equivalent of reading a report about your own failure and declining to have an opinion. And one agency looked at four recommendations for not getting hacked by the future and disagreed with three of them. Imagine flunking a test this badly and then arguing with the grading.
Meanwhile, the report names the countries that pose the greatest cyber threats, China, Russia, Iran, and North Korea, and explains that a future machine lets an attacker unlock data stolen today. So every rival intelligence service on earth gets to vacuum up encrypted American secrets right now and store them like fine wine until the 2030s, when a quantum computer pops the cork. The only thing standing between your data and that future is a to-do list that nobody started, written by people who admit they don't know how, reviewed by seven agencies with no opinion.
