The Quantum Deadline Already Passed – We Just Haven’t Noticed

We keep asking the wrong question. “When will a quantum computer break modern encryption?” is a parlor game for conference keynotes. The question that should keep a Chief Architect awake is this: what data did we already lose, that we’ll only discover in 2035?

The Signal

NASCIO’s recent report, Preparing for Post-Quantum Cryptography in State Government, is blunt about the timeline: transition will take years of planning, coordination, and modernization. Google has publicly targeted PQC readiness by 2029, with work continuing into the 2030s. And NIST reminds us that new encryption standards have historically taken 10 to 20 years to fully propagate through information systems. Meanwhile, NASCIO’s 2026 survey found that only 2% of state CIOs have an enterprise-wide quantum policy in place.

The Part Most People Skip

Two threat models in that report deserve far more attention than they get. The first – harvest now, decrypt later – reframes the entire problem. It isn’t a cryptography problem at all. It’s a data retention problem. Any record with a confidentiality shelf life of ten years or more – health files, land titles, judicial records, identity data – is already sitting in someone’s archive waiting for a future decryption key. The clock didn’t start when quantum arrived. It started the day the data was stored.

The second, trust now, forge later, is worse. It attacks digital signatures – the mechanism that verifies authenticity of software updates, documents, and government transactions. A forged signature doesn’t just expose data; it retroactively corrodes trust in the record itself. For e-governance, that’s existential.

Crypto Agility Is an Architecture Problem

Here’s where I diverge from the standard “adopt PQC” narrative. The deliverable is not a new algorithm. It’s crypto agility – the architectural ability to swap algorithms without rewriting applications. That means algorithm-agnostic interfaces, centralized key management, HSM firmware upgrade paths, automated certificate lifecycle management, and an actual cryptographic bill of materials across your estate.

And that last piece explains the 2% figure. Most organizations can’t inventory where encryption lives, because encryption is invisible infrastructure buried in libraries, TLS configs, embedded firmware, and vendor black boxes. You cannot migrate what you cannot see.

There are real trade-offs too. Post-quantum keys are larger and computationally heavier – a genuine concern for high-throughput systems and constrained IoT endpoints. That argues for hybrid deployment during the transition, not a big-bang switch. It also argues for procurement discipline: “show us your PQC roadmap” should be a contract clause today, not a question asked in 2031.

The Bharat Angle

This matters acutely for India, because our Digital Public Infrastructure is cryptographic to its bones. Aadhaar eKYC, DigiLocker, UPI, e-sign – all depend on digital signatures and long-lived records. Add land registries, health archives, and judicial systems, and you have exactly the profile that harvest now, decrypt later was designed for.

For the Northeast in particular, the lesson is counterintuitive. Smaller state IT budgets and shared-services models make crypto agility more important, not less – because you cannot afford to retrofit twenty systems one at a time. Start with the cheapest, highest-yield step: build the cryptographic inventory. It costs almost nothing and tells you everything.

Takeaways

• Inventory first. A CBOM beats a strategy document.
• Abstract the algorithm. Design interfaces that treat cryptography as a replaceable service.
• Prioritize by data shelf life, not by system age.
• Bake PQC roadmaps into vendor contracts now.
• Plan for hybrid, because the migration will overlap with live operations for a decade.

Quantum computing is not a future event. It is a present liability, quietly compounding in our storage tiers.

The organizations that treat cryptographic agility as foundational architecture – rather than a compliance checkbox – will be the ones still standing when the keys change.

---

About the Author: Sanjeev Sarma is the Founder Director and Chief Software Architect at Webx Technologies. With a core focus on Generative AI integration, Cloud-Native Scalability, and Enterprise Software Architecture, he has spent over two decades driving digital transformation across Northeast India and beyond. Beyond his corporate leadership, Sanjeev is deeply invested in shaping the future of the IT industry. He serves as an Industry Expert on the Board of Studies for Assam Don Bosco University’s School of Technology, advises state technology committees, and actively mentors emerging tech startups at STPI. He brings a unique, dual perspective of high-level enterprise execution and future-ready academic curriculum development.