Harvest Now, Decrypt Later
Harvest now, decrypt later (HNDL) is the reason post-quantum cryptography is urgent today, not in 2030 when quantum computers arrive. The concept is straightforward: an adversary intercepts and stores encrypted network traffic now, then decrypts it later when quantum computers become powerful enough to break the encryption.
The data being stolen is not future data. It is today’s data. And if that data will still be sensitive in 5-10 years (trade secrets, state intelligence, medical records, financial data, long-lived credentials), the encryption protecting it today is already insufficient.
This is not theoretical. The NSA publicly acknowledged the threat in 2021. Executive Order 14412 (June 2026) references it as a present danger. A 2026 survey found that 84% of organizations believe some of their encrypted data is already vulnerable to HNDL. Federal News Network in August 2026 stated plainly: “The harvest-now, decrypt-later threat is active now.”
How it works
The attack has three phases:
Phase 1: Collection (happening now)
- Adversary passively intercepts encrypted network traffic
- Storage is cheap ($20/TB), collection is passive and undetectable
- Targets: undersea cables, ISP taps, BGP hijacking, compromised routers, cloud provider network access
- No decryption needed at this stage, just bulk storage
Phase 2: Waiting (current phase)
- Encrypted data sits in storage
- Quantum computers are not yet powerful enough to break RSA/ECC
- Most credible estimates: cryptanalytically relevant quantum computers arrive 2030-2035
- Some estimates are more aggressive: Google moved its deadline to 2029
Phase 3: Decryption (future)
- Quantum computer runs Shor’s algorithm against stored RSA/ECDH keys
- Session keys recovered, stored traffic decrypted
- All historical data from Phase 1 becomes readable
The critical insight: the attack succeeds if the data is still valuable when Phase 3 arrives. A 10-year-old trade secret may still be worth billions. A 10-year-old diplomatic cable may still be politically explosive. A 10-year-old medical record is still a HIPAA violation if exposed.
Evidence this is happening
NSA (August 2021): “Adversaries may be collecting encrypted data now, waiting for the day when quantum computers can decrypt it.” This is the US government’s intelligence community publicly stating the threat is real.
Executive Order 14412 (June 22, 2026): The executive order signed by the President explicitly references the HNDL threat as justification for accelerated PQC migration deadlines. It pulls federal contractors into scope, meaning the government believes the threat is serious enough to mandate action across the entire supply chain.
84% of organizations believe they are at risk: A 2026 industry survey (cited by lamarrlabs.substack.com) found that 84% of respondents think at least some of their encrypted data is already being harvested and stored for future decryption.
Federal News Network (August 2026): “The harvest-now, decrypt-later threat is active now. The CRQC [Cryptanalytically Relevant Quantum Computer] timeline moved. The quantum imperative is not a warning, it is an accounting of present dangers.”
Can you prove it is happening to your specific organization? No. That is the point. The collection is passive, bulk, and undetectable. You cannot prove an adversary is NOT storing your traffic. The absence of evidence is not evidence of absence when the attack is designed to be invisible.
Who is at risk
High risk (migrate now):
- Government agencies and defense contractors (state-level adversaries have motivation and resources)
- Financial institutions (transaction data, M&A communications, trading strategies)
- Healthcare organizations (patient data protected by HIPAA for decades)
- Law firms (attorney-client privilege has no expiration)
- Pharmaceutical companies (drug research data valuable for 15-20+ years)
- Critical infrastructure operators (SCADA/ICS credentials may not rotate for decades)
Medium risk (migrate within 2 years):
- Technology companies (source code, architecture documents, API keys)
- Research institutions (unpublished findings, patent-pending work)
- Any organization with long-lived trade secrets
Lower risk (migrate by 2029-2030):
- Consumer-facing services where data sensitivity is short-lived
- Session-based communications (chat, ephemeral messaging)
- Publicly available data that happens to be encrypted in transit
The timeline math
The decision framework is simple arithmetic:
Risk = (Years until quantum computers) - (Years your data remains sensitive)
If Risk < 0: you are already in trouble
If Risk = 0-5: migrate now
If Risk > 5: you have time, but planning should startExample: if quantum computers arrive in 2032 (6 years from now) and your trade secrets remain valuable for 10 years, then data encrypted today is at risk because:
- Data from today: valuable until 2036
- Quantum computer available: 2032
- Gap: 4 years of quantum-decryptable, still-sensitive data
This is why organizations cannot wait for quantum computers to arrive before migrating. The data being transmitted RIGHT NOW is the data at risk.
What HNDL means for different protocols
| Protocol | What is harvested | Impact if decrypted |
|---|---|---|
| TLS (HTTPS) | Web traffic, API calls, email | Business communications, credentials, data transfers exposed |
| VPN (IPsec, WireGuard) | All tunneled traffic | Corporate network traffic, remote work data exposed |
| SSH | Terminal sessions | Server access patterns, credentials, command history exposed |
| S/MIME, PGP | Encrypted email content | Years of confidential communications exposed |
| Encrypted file storage | Stored files with RSA-wrapped keys | Archive contents exposed |
Key exchange is the vulnerability. Symmetric encryption (AES-256) is quantum-safe. The risk is in the asymmetric key exchange (RSA, ECDH) that establishes the symmetric session key. If an adversary stores the key exchange messages, they can later recover the session key and decrypt all traffic from that session.
What to do about it
The protection is straightforward: use post-quantum key exchange for any traffic that carries data sensitive beyond 5-10 years.
Immediate actions (days to weeks):
- Enable hybrid PQ key exchange (X25519MLKEM768) on your public-facing TLS endpoints
- Enable PQ VPN for sensitive internal traffic (Cloudflare WARP or Mullvad with quantum-resistant tunnel)
- Verify your cloud provider connections use PQ TLS (AWS KMS, Secrets Manager support this today)
Medium-term actions (months): 4. Audit which data paths carry long-lived sensitive data 5. Prioritize PQ migration for those specific paths 6. Plan for certificate signature migration (longer timeline, 2027-2028)
What you cannot retroactively fix: Traffic that was already transmitted without PQ protection cannot be re-encrypted. If an adversary already captured it, the damage is done for that specific data. This is why urgency matters: every day of delay is another day of harvestable traffic.
Common objections (and why they are wrong)
“Quantum computers are still far away.” Irrelevant. The threat is not when quantum computers arrive. The threat is that data transmitted today can be decrypted later. If your data stays sensitive for 10 years and quantum computers arrive in 8 years, you needed PQ protection 2 years ago.
“Nobody would bother storing my traffic.” At $20/TB, bulk collection is trivial. Nation-state programs collect broadly, not specifically. They do not need to target you individually, they can capture entire ISP links and sort later. The cost of storage is negligible compared to the value of the data.
“We can re-encrypt everything when quantum computers get closer.” You cannot re-encrypt traffic that has already been transmitted and captured. You can only protect future traffic. Past traffic is permanently exposed if it was captured.
“Our data is not that sensitive.” Are you sure? Consider: employee credentials (used for years), customer data (GDPR/HIPAA obligations last decades), strategic communications (M&A discussions, pricing strategies), and source code (competitive advantage for years). Most organizations underestimate how much long-lived sensitive data they transmit daily.
FAQ
Is HNDL actually happening or is it theoretical?
The NSA, multiple executive orders, and the broader intelligence community treat it as a present threat. No specific intercept operation has been publicly attributed (that is the nature of classified intelligence), but the consensus among government agencies is that bulk collection for future decryption is actively occurring.
How much data are adversaries storing?
Unknown publicly. At current storage costs, a nation-state could store petabytes of intercepted encrypted traffic for under $1 million per year. The limiting factor is not cost but collection infrastructure (tap points on major network links).
Does forward secrecy (ECDHE) protect against HNDL?
Partially. Forward secrecy means each session uses a unique ephemeral key, so compromising one session does not compromise others. But Shor’s algorithm can break the ephemeral ECDH exchange for any individual session. Forward secrecy protects against classical key compromise, not quantum attacks on the key exchange itself.
If I enable PQ TLS today, am I safe from HNDL?
For future traffic, yes. Hybrid X25519MLKEM768 key exchange defeats HNDL for new sessions. For traffic already transmitted without PQ protection (before today), no. That data is permanently at risk if captured.
What about encrypted data at rest?
Data encrypted with AES-256 at rest (with the key stored separately from the ciphertext) is quantum-safe. The risk is when the AES key was wrapped/encrypted with RSA or delivered via ECDH key exchange. If an adversary captured the RSA-encrypted key transport, they can later recover the AES key and decrypt the stored data.
Sources
- NSA (Nov 2021). “Quantum Computing and Post-Quantum Cryptography FAQ.” Announced via quantum.gov
- The White House (Jun 22, 2026). Executive Order 14412, “Securing the Nation Against Advanced Cryptographic Attacks.” whitehouse.gov
- Federal News Network (Aug 2026). “The quantum imperative: Why federal cybersecurity cannot wait for tomorrow’s threat.” federalnewsnetwork.com
- Google Security Blog (Mar 2026). “Google’s timeline for PQC migration.” blog.google
- Thales (2026). “2026 Data Threat Report: HNDL top-cited quantum risk (61% of respondents).” cpl.thalesgroup.com
- DigiCert / Propeller Insights (Jul 2026). “Quantum Readiness Outlook: 85% believe quantum will break existing standards within a decade.” techtimes.com
- Global Risk Institute / Postquantum.com (2025). “Quantum Threat Timeline Report 2025: 28–49% expert probability of CRQC within 10 years.” postquantum.com
- Cloudflare (Jul 2026). “The White House’s post-quantum executive order — EO 14412 sets Dec 31, 2030 deadline.” blog.cloudflare.com