Ontario securities watchdog flags need to prepare for quantum computing threats

Ontario’s securities watchdog is warning firms to be on the lookout for cybercriminals stealing encrypted data that they anticipate quantum computers will one day be capable of decrypting.

The emerging threat, which is referred to in the cybersecurity industry as “harvest now, decrypt later,” is highlighted in a report published Tuesday by the Ontario Securities Commission, or OSC.

In its first report about the technology, the regulator is urging firms in the capital markets sector to assess both the risks and opportunities associated with rapidly advancing quantum computing, and to prepare by taking steps such as creating inventories of their cryptographic assets.

The warning adds to mounting concerns about the cybersecurity threats posed by artificial intelligence, which could amplify the risks associated with quantum computing, the report notes.

“Quantum computing has the potential to drive significant innovation across the economy, including financial services,” Grant Vingoe, the OSC’s chief executive, said in a statement.

“At the same time, firms need to be thinking today about how future advances could affect cybersecurity, data protection and operational resilience,” he added.

Industry proponents have long promised that quantum computers, which derive their power by tapping into the peculiar properties of matter and light at microscopic scales, will some day solve tasks that remain out of reach of existing computers, opening up new applications in financial forecasting, drug and material discovery and machine learning.

Quantum technology also has applications in sensing, communications and cybersecurity. Yet, advances the technology could bring are twinned with dread. That’s because quantum computers, once they reach commercial scale, could enable bad actors to pick the locks on cryptographic algorithms that secure the world’s digital economy.

Canada’s intelligence and defence agencies have recognized the threat for years, and governments and financial-sector players have been put on notice to quantum-proof their critical infrastructure.

There is no consensus as to when quantum computers will become powerful enough to break today’s widely used public-key cryptography.

Although that milestone, which is known as Q-Day, could be years or even decades away, some data that is encrypted today could remain valuable for a long time, according to the report. In the capital markets, such data could include trade secrets, client data, proprietary trading strategies, correspondence with regulators or communication relating to mergers and acquisitions.

The OSC is the latest in an expanding list of global financial and government players weighing in on the potential risks of quantum computing.

In June, the G7 Central Bank Quantum Technologies Working Group, which included the Bank of Canada, published a report tiled Preparing for Quantum Technologies: Key Considerations for Financial Sector Participants.

The working group report aimed to establish a shared analytical framework to understand the potential implications of quantum technologies for central banking activities and for the overall financial ecosystem.

“In particular, the risk of ‘harvest now, decrypt later,’ whereby encrypted data collected today could be decrypted in the future, highlights the need to consider long-term data confidentiality,” the group said in a release at the time.

RBC, meanwhile, announced in September that it had hired its first director of quantum strategy, Dr. Elizabeth Iwasawa.

Canada was an early leader in the development of quantum computers, and the Carney government has stressed that supporting its homegrown industry is of national importance.

Three domestic companies – Xanadu Quantum Technologies Ltd., Nord Quantique and Photonic Inc. – have advanced to the second stage of a U.S. Defense Advanced Research Projects Agency, or DARPA, competition challenging developers to show they can build a commercial-grade quantum computer by 2033.

Last December, Ottawa committed up to $23-million apiece to those three companies (plus a fourth company that isn’t in the competition) to match what DARPA has offered those that complete the first two stages, as part of its Canadian Quantum Champions Program.

Companies that make it through a third and final leg of the DARPA process could qualify for another US$300-million each in U.S. government funding. The Canadian government announced in the budget last week the second stage of its champions program, which it said “will help ensure that Canada retains its quantum firms.”

Several U.S. states including Illinois, Colorado and Maryland have been aggressively courting quantum companies from Canada and elsewhere with incentives to locate in their jurisdictions.

The Canadian government has also provided additional funding to domestic quantum companies, including a repayable $195-million commitment announced in August to help Xanadu build a 158,000-square-foot advanced research development and manufacturing facility in Toronto.