Harvest now, decrypt later: why data lifetime matters

What the scenario involves

In this scenario, collection happens before the attacker has the means to read the material. A future cryptographically relevant quantum computer could defeat vulnerable public-key protection and enable access to some previously collected information. The CISA, NSA, and NIST readiness resource identifies this as a reason to prepare before such a computer is available. [1]

The details of the system matter. An encrypted file, a recorded network session, and an encrypted backup do not necessarily have identical exposure. Ask an appropriately qualified professional how keys are established, stored, wrapped, and retired in the specific service. Avoid concluding that every encrypted item will automatically become readable.

Start with information that retains its value

NIST highlights the connection between long-lived secrets and future decryption risk. [2] Our suggested starting exercise is to select five information categories and ask the people responsible for them how the consequences of disclosure would change over time. Examples could include sensitive customer records, proprietary designs, confidential agreements, personnel information, and research results.

Keep this discussion about categories rather than copies of the records. A planning register might state that a service processes confidential product designs without containing the designs themselves. If the team cannot agree on a confidentiality lifetime, write down the uncertainty and assign a person to resolve it. An explicit unknown is more useful than an unsupported ten-year estimate.

A hypothetical example

Imagine a small engineering firm exchanging drawings with a manufacturing partner. Some drawings describe products with a short commercial life; others reveal a process expected to remain valuable for years. Those two information groups could justify different migration priorities even though both travel through the same file-sharing service.

The firm could ask its provider to document the protection on the transfer path, check how downloaded copies are handled, and identify any replacement project already planned. This example illustrates a way to organize decisions. It is not a finding that a particular provider or engineering business has been compromised.

What a useful provider answer contains

Ask for a dated explanation of the service you actually use. A company-wide announcement may describe only a limited feature, selected customers, or a future release. NIST encourages organizations to begin transitioning to its post-quantum standards; the existence of standards does not identify the configuration of your account. [3]

• Which parts of this service use quantum-vulnerable public-key mechanisms?
• Is post-quantum protection available for our current product and subscription?
• Does the answer cover data transfer, stored information, key management, and authentication separately?
• What action, test, or contract change is required from us?

Make a decision record

For each important data category, record the business reason for confidentiality, the systems involved, evidence received from suppliers, remaining uncertainties, and a decision owner. Set the next review around a meaningful event such as a contract renewal, major software release, or planned infrastructure change.

If you suspect actual unauthorized collection or access, use your incident-response process and obtain appropriate assistance. Do not postpone incident handling while debating future quantum capability. For insurance planning, ask how the relevant policy treats the timing of an event, its discovery, and notification. Those answers require the actual policy wording and facts; a general description of harvest-now-decrypt-later cannot settle them.