Adversaries do not need a quantum computer to break today's encryption. They need storage and patience. Data harvested from a drone feed or a coalition link today can be decrypted once a cryptographically relevant quantum computer arrives. With CNSA 2.0 acquisition requirements taking effect January 1, 2027, the policy clock is running too. Execution lags, especially at the forward-deployed edge, where devices are small, links are intermittent, and nothing gets patched on schedule. That gap framed at the latest GIST 360 Breakfast Briefing When the Adversary Waits: Post-Quantum Cryptography and the Race to Secure the Forward Deployed Edge. Swish CTO Sean Applegate hosted Dr. Ed Mays, Deputy Assistant Commissioner for Infrastructure and Support Services and Chief Enterprise Infrastructure Officer at U.S. Customs and Border Protection, and Jeremy Corey, a Customer Solutions Engineer at Cloudflare. Together they traced a path from one blunt assumption to the hard work of executing at the edge.
ASSUME THE DATA IS GONE, THEN RANK IT
The panel's starting point was simple. Agencies should assume adversaries are already copying their encrypted data and storing it for later. What matters is how long each type of data needs to stay secret. Corey explained the math with Mosca’s theorem. Take how long the data must stay protected and add how long it will take to move its systems to post-quantum encryption. If that total runs longer than the time until a quantum computer can break today's encryption, the data is effectively exposed already. Intelligence that must stay secret for decades falls squarely in that category.
Not all data has that shelf life, so Mays treats segmentation as the first step of migrating to PQC. Intelligence, logistics, and human capital data should not move on the same schedule. At CBP, intelligence ranks first. Logistics data comes next, because resupply chains reveal where forces are and what they need, as does any data showing where agents operate. The deciding question is which data a cartel or nation state would value most, and that ranking sets the order for everything that follows.
TWO MIGRATIONS RUN ON TWO CLOCKS
Once agencies know what to protect first, they have to decide what they are protecting it against. Corey described two separate migrations. The first upgrades encryption so that stolen traffic stays unreadable. That work is well underway, and Cloudflare has run post-quantum encryption by default across its network since 2022.
The second migration covers authentication, and it is moving more slowly. Digital certificates prove that a website or system is what it claims to be. Once a quantum computer can break the cryptography behind them, an adversary can impersonate a trusted system rather than simply read stolen data. Post-quantum certificates are also far larger than today's, which strains sensors and fielded radios. Corey urged agencies to apply the same ranking here by asking what an adversary could forge and which high-value systems would suffer most.
TESTING CORRECTED THE ASSUMPTIONS
Knowing the problem is not the same as knowing how the fix will behave, and CBP learned that through testing. The agency started early, engaging NIST and running a proof of concept. Mays expected the new algorithms to bring heavy overhead and network congestion. The first tests showed neither. They did reveal how little anyone understood about the effects on applications and the machine-to-machine connections between them.
CBP is now adding post-quantum protection to two production applications and has installed PQC-capable firewalls. The week before the briefing, the agency delivered its OMB-mandated migration plan to DHS. The aim is a repeatable model applied across the enterprise, built on what CBP calls ruthless standardization, retiring legacy systems, and proving products before buying. "Defense in depth must be alive," Mays said.
ONE GOVERNMENT, DIFFERENT PARAMETER SETS
That model also has to work across agency lines. Civilian agencies follow NIST's FIPS 203 and FIPS 204, while the Department of War follows CNSA 2.0. Both use the same algorithms, ML-KEM and ML-DSA, but call for different key sizes. When CBP and a joint task force on the southern border need to exchange data, those mismatched settings get in the way.
Corey's answer starts with people. Get leaders from each organization in a room to agree on which settings to use, and bring in industry to supply gateways that translate between the two. CBP will not wait for every partner to align. Mays is designing for crypto agility, the ability to switch algorithms and settings as standards evolve, so partners can connect on their own timelines. "We are one federal government," he said.
THE EDGE STRAINS OWNERSHIP AND OVERSIGHT
While it may be one government, coordination gets harder at the edge. For Mays, PQC at the edge is a computing problem, and no one has all the answers yet. CBP fields many variants of drones, wearables, and unmanned vehicles, and he is still asking how to do basic patching on them. Program offices buy much of that equipment, yet it connects to the network, so the CIO's office ends up authorizing systems it does not own. "It's not mine, but I'm the guy saying it's good to go," Mays said. His answer is to write PQC into requirements and contracts from the start, and to plan for the sustainment bill that outlasts any funding surge.
That sprawl also widens the attack surface, and AI is making it easier to exploit. With more attack paths than any human team can watch, defenders will need AI of their own, aimed at real weaknesses. Adversaries do not care about compliance, Mays said. They look for gaps.
SHARE IT. ACT ON IT.
The adversary is already collecting, and the panel’s message comes down to a few clear steps. Start by assuming the data is already in hostile hands, then rank it by how long it must stay secret ,so the most sensitive data moves onto PQC systems first. Plan for two migrations, encryption and authentication, on two different timelines. Test early, starting where failure is safe, and treat the PQC plan as a living document rather than a one-time deliverable. Build crypto agility so partners can connect as they catch up, and write PQC into contracts before new hardware reaches the edge.
Agencies that start now will set the pace for everyone else. Explore more sessions and the GIST of Govt IT podcast and reach out to the team at Swish to build a cryptographic inventory or map a migration against CNSA 2.0 and OMB timelines. Thanks to the Cloudflare Public Sector team for sponsoring the discussion.