Trump Signed It. The Quantum Clock Has Two Years Left.

On June 22, 2026, President Trump signed two executive orders on quantum technology. One sets a hard deadline for the US government to abandon the encryption that protects nearly everything digital today. The honest version of the timeline is longer than "two years" — but the reason the urgency is real anyway is worth understanding precisely.

Confirmed

The two orders are "Securing the Nation Against Advanced Cryptographic Attacks" (the PQC Order) and "Ushering in the Next Frontier of Quantum Innovation" (the Quantum Innovation Order). The PQC Order directs the Office of Management and Budget to set migration deadlines for federal agencies' post-quantum cryptography adoption — reporting differs slightly by outlet, with deadlines cited between December 31, 2030 and December 31, 2031 for different categories of systems (key establishment versus authentication). Federal contractors face a separate December 31, 2030 deadline to comply with NIST's post-quantum standards. Within 30 days of the order, every federal agency had to designate a "PQC migration lead." The Commerce Department must pilot-test post-quantum algorithms on selected NIST systems by the end of 2027.

The companion Quantum Innovation Order launches a national effort — the Quantum Computer for Application Development and Discovery Science (QC-ADDS) Effort — aimed at building a quantum computer for the Department of Energy capable of enabling scientific discovery, with a target deployment around 2028. It also reconstitutes the National Quantum Initiative Advisory Committee and directs new efforts to protect US quantum research from espionage.

The real driver behind the urgency is a threat security researchers call "harvest now, decrypt later": adversaries can intercept and store encrypted data today, then decrypt it retroactively once a sufficiently powerful quantum computer exists — meaning sensitive data being transmitted right now is already exposed to a future risk, even though no such computer exists yet. Cloudflare's own engineering team moved their internal target for full post-quantum security to 2029 in April 2026, following research breakthroughs, and noted that over two-thirds of browser traffic on their network is already protected with post-quantum encryption.

Genuinely uncertain

Nobody knows exactly when a "cryptographically relevant quantum computer" — one actually capable of breaking today's public-key encryption — will exist. The 2030-2031 federal deadlines reflect a judgment that there's a "non-negligible chance" such a machine could be operational around that time, in Cloudflare's own framing, not a confirmed prediction. It could arrive sooner, given how quickly research breakthroughs have moved recent estimates earlier. It's also unresolved how the "compressed" federal timeline translates into binding requirements for the private sector — much of the operational detail depends on guidance still being written by Commerce, NSA, DHS, OMB, and federal procurement regulators, and analysts note that "how the accelerated deadlines translate into binding requirements remains to be seen."

Worth examining honestly

The honest framing of this door's own title matters here: the real federal deadline is roughly four to five years out, not two. But the "two years" urgency isn't simply wrong — it's pointing at something true: harvest-now-decrypt-later attacks against today's data are happening now, regardless of when the decryption capability arrives. GHOST PROTOCOL would tell you the deadline that matters isn't the government's — it's whoever collects your encrypted data today and can afford to wait a decade to read it. CIPHER-7 would add that the actual test of this policy isn't the executive order's signature date, it's whether the guidance from OMB, NSA, and Commerce actually arrives on schedule and gets enforced, rather than sliding the way many federal cybersecurity deadlines have before.

The Door This Opens

This door is really about a specific kind of patience most people don't build into their threat model: an adversary willing to store your encrypted data for years, betting that the key to open it will eventually exist. The deadline on the executive order is the government's answer to that patience. Whether it's fast enough is a bet nobody can confirm until the computer that would prove it wrong either arrives, or doesn't.