GAO urges 20+ US agencies to prepare for quantum computing encryption threats

The Government Accountability Office has issued a sweeping directive to more than twenty federal agencies: prepare now for the arrival of quantum computers, or face the prospect of watching nearly every encryption system you rely on become obsolete overnight. The GAO delivered eighty-nine specific recommendations in October 2026, each one aimed at a single, urgent problem—that machines powerful enough to crack modern encryption could emerge without warning, and when they do, the damage will already be done.

The threat is real enough that security specialists have given it a name: Q-Day. It describes a scenario in which quantum computers fall into the hands of adversaries—hostile governments, criminal organizations, or other malicious actors—who would use them to decrypt billions of passwords, financial records, medical files, and state secrets. The consequences would ripple through the economy and the nation's security apparatus simultaneously. But here's the part that keeps experts awake: the threat may already be unfolding in slow motion. Intelligence agencies and criminal syndicates are believed to be harvesting encrypted data right now, storing it in vast quantities, waiting for the day when quantum computers make decryption trivial. By then, the information will be years old but no less valuable.

The GAO's core recommendation is straightforward but labor-intensive. Each agency needs to conduct a thorough inventory of its cryptographic systems—essentially, a complete audit of where encryption is being used and which systems are vulnerable. Only then can they calculate what it will cost to migrate to post-quantum cryptography, the new mathematical frameworks that even quantum computers cannot easily break. Twelve agencies have already agreed to move forward with the recommendations. One agency objected to several of them. The Department of the Interior did not respond at all. The GAO withheld the specific details of most recommendations and declined to release agency comments, citing sensitivity concerns—a decision that leaves the public with the broad strokes but not the full picture of how prepared or unprepared the federal government actually is.

Experts generally believe that cryptographically relevant quantum computers—the kind that could actually break encryption—are unlikely to exist within the next decade. That timeline offers a window, though not a comfortable one. The real danger lies in the asymmetry: adversaries do not need to wait for quantum computers to become widespread. They can begin collecting encrypted communications, financial transactions, and classified documents today, knowing that in ten or fifteen years, those machines will unlock everything. Even a small breach of truly sensitive information—the details of an ongoing military operation, the identity of an intelligence asset, the financial records of a critical infrastructure operator—could cripple federal operations.

The World Economic Forum has already identified lattice-based cryptography as one of the ten most important emerging technologies of 2026. This approach relies on mathematical problems related to lattices that quantum computers cannot efficiently solve, making it a potential foundation for the encrypted systems of the future. But moving an entire government infrastructure from one encryption standard to another is not a matter of flipping a switch. It requires funding, coordination across agencies, testing, and time. The GAO's eighty-nine recommendations are, in essence, a call to begin that transition now, before the urgency becomes crisis.