Harvest Now, Decrypt Later: The Quantum Era's Encryption Challenge

[MUSIC] Hi, it's John here. I don't want to be a scare monger, but right now as you're listening to this, odds are pretty good that adversaries somewhere may be trying to collect your data, even your encrypted data. If you're running a company, a hospital, a public institution, or just sharing data, basically, if you rely on encryption to create digital trust or rely on digital trust for anything, this episode is for you. Now, these sorts of challenges have been with us for decades, but there's one word that is really sharpening the challenge in the 2020s, and that word is quantum. Today, we're going to talk to two of Canada's leading quantum pioneers to not only understand what's at stake in this new global battle that's taking place in machines all around us, but to get a true sense of how Canada has become a true global leader in both the science of quantum and the art of trust. We'll be joined by Dr. Stephanie Simmons. She's the founder and chief quantum officer at Photonic. It's a remarkable company that I've had the chance to visit in Burnaby, BC, and we'll also be joined by Christian Weebbrook, the founder and CEO of Xanadu, and we'll visit his quantum lab in downtown Toronto. You may know both of their names from previous episodes of Disruptors. They joined us in 2023 when most of us probably still filed quantum under the label someday. Now these systems are moving from research labs into production infrastructure and will be critical to Canada's competitiveness and sovereignty in a high stakes global digital economy. Here's a bit of background for those of you who may not have your high school physics textbook, quite at hand. Quantum computers use qubits. Those are units that can exist in multiple states simultaneously. And when qubits become entangled, they behave as one coordinated system, solving certain problems exponentially faster than any classical computer could. But as powerful as quantum states can be, they are also incredibly fragile. The real engineering challenge is correcting errors in real time before all those calculations collapse. Once a system reaches so-called fault tolerance where they can fix errors faster than they can occur, today's encryption becomes obsolete. Imagine the threats that can go with that and, guess what, they're already active. Harvest now decrypt later means actors, usually bad ones, are collecting encrypted data today to decrypt tomorrow. And if that protection breaks, we just don't lose privacy, we may lose trust in every institution that holds our information. So today's episode is about protecting that trust layer of the economy before it's too late, and the breakthroughs that come with it. Let's get into it. I'm here at the Toronto headquarters of Xanadu, which is really in some ways ground zero of quantum technology. Certainly here in Canada, I'm with Christian Weedbrock, the founder and CEO of Xanadu. And behind me is Aurora, a creation of Xanadu, and the world's first networked quantum computer. Tell us what we're looking at. So the first thing to notice is this is a quantum computer. It's the most advanced quantum computer anywhere in the world in terms of its networking capability. So what we see here is four server acts that are roughly about seven feet tall. They wouldn't look out of place in a normal data center. And this is setting the vision for what quantum computing will become. But the challenge here is how to connect them together. Quantum mechanics makes it typically very difficult to connect server acts together, unless you're using photons or light, which is our approach. Okay, take us deeper into that because certainly to the lay eye, it looks like server acts as you say. So what's going on here that makes this quantum? For any quantum computer, you need to be able to access things like the superposition principle in tanglement and interference. So all those properties are occurring here. So we're using photons or light. Cubots are creating up here. And as they propagate downwards, gates are acting on them. And so it's very much, you know, typical of a normal computer, you have inputs, the bits normally, you have gates, and then you have the readout. We have a quantum mechanical version of this where you actually have qubits, gates, and then measurements at the bottom. The key point here is that you actually have a light starting at the top, getting creative qubits and going all the way down. And that's happening individually and all these server acts. But the really cool thing is they're actually talking to each other. You can see down here the yellow cables are fiber optics being connected to their nearest neighbor. And that's really the revolutionary aspect of this Aurora computer when it relates to scalability. And speaking of scale, how much bigger does this gap or is this the size and it's just the intensity that needs to be focused on? This can scale up to arbitrary number of server acts now. So that's been solved. So how do you improve the performance? Essentially, let's take a laser pointer. Whenever you shine a laser pointer at a wall, you can see the laser on the wall. But if you imagine the wall getting taken kilometers away, the imprint of laser starts diluting. It becomes faint. And that means photons have been lost. Loss here actually causes the errors in our computation. And as mentioned before, that's why we use error correction codes. So that will protect us against the loss of information. But the other one is working more and more with foundry. So we actually have photonic integrated chips. And we design them here in Toronto and send them off to different foundries around the world. They made or fabricated these chips and sent them back to us. What we need to do is improve the performance of those chips. And that's how we reduce loss from a physical point of view. Christian isn't giving us a scoreboard today. He's actually showing us a path to scale. And here's the uncomfortable part. Once systems like this truly scale and they will, the encryption that protects identity and transactions today becomes obsolete. Harvest now decrypt later is the storm on the horizon. Encrypted data is being collected and stored now to be open later. But if that promise of protection breaks, we just don't lose privacy. We may lose trust in those who hold our information. Implementing post-quantum cryptography is like replacing your roof before the storm hits. If you wait until water is coming through the ceiling, well, it's already too late. So what does that actually mean for the trust layer of our economy? Stephanie is going to break down the risk and what leaders need to do next. Stephanie, welcome back to disruptors. Thank you so much for having me. I'm excited to be here. It was great to have you as a repeat guest. What do you think about most when you think about this idea of Harvest now to crypt later and what's at stake? Yeah. What I like about quantum is that we know it's coming and we have the opportunity to prepare. When chat GPD happened, it kind of took everybody by surprise, but we know this is coming. So we have the opportunity to just take a deep breath and move. Harvest now to crypt later. Data is a lot cheaper to hold onto today. We know that there's quite a bit of tracking being done and holding on to communications today so that one could decrypt it in the future. Now what's needed for the cryptographically relevant quantum computer has come down considerably. So just for reference, I'm a founder of a company called Photonic and one of the things that we brought into the market about a year ago now was efficient QLDPC codes, much more efficient codes. What it does is it's meant that the requirements to build these big quantum systems that can break into all these codes came in by an order of magnitude or more. So a lot of these things are moving really quickly and we know that what it can do is it asks us to think about coming up with a new cryptographic solution for the way that we communicate. Now that's just the cryptography side. Well let's talk about some of the challenges in commerce and what could break down. Is it going to be identity, authentication, signing? Where do you think the vulnerabilities are? It can do the math that we rely upon for what we'll call the asymmetric layer of our cryptographic systems and that's kind of every exchange. So it's not just authentication, although for sure. It is every step along the way where you could take a look what we use today is we use a for the asymmetric part of the encryption. We kind of have this handshake, right? So two different teams over the internet or whatever network they have this agreement. We're like, okay, hey, you are who you say you are and I'm going to rely that this math problem is really hard to solve. But if you have the solution, it's really easy to check. So that's why it's called asymmetric. And what you have is that math is kind of what we're trusting is unbreakable for all the coms. And so when you're logging into your account, when you're logging into anything, when you're forming any communication, that math is what you're trusting. And so I think that in the early instances, if an adversarial organization were to use that, it would get access to basically any communication we use online. Now, okay, what I want to say is that there are new cryptographic standards that people are really excited about and they hope they will withstand all future quantum algorithms. We don't know all the future quantum algorithms, but there is reason to hope that these ones will be resilient. And so we have the opportunity now to change our software and hope that those new cryptographic standards hold. So there are solutions. here and people have been working on this as you can imagine quite a bit. What I'm glad to hear in this conversation here is the interest in actually taking that step and shift and it's not easy. It's not easy because a lot of teams use third-party suppliers that themselves are using vulnerable cryptography, right? So I think we have that awareness moment. The community knows that this is in, you know, five years plus or minus and we can take the time to go in and just put that additional layer of security to know that we're going to be quantum safe through the coming years. So that's the threat. Harvest now, decrypt later, isn't science fiction. It's a trust crisis on a timer. We've seen the threat. We've seen the defense architecture, but there's another side to this story. Back to Christian Weebruck. What can quantum computing actually do for us today and what will enterprises use first? If you're doing a lot around drug discovery, which is one of the big opportunities with quantum, tell us more about what you've done and where you're hoping that will go. Once you have a large enough quantum computer, as mentioned, once you have hundreds of these server acts performance, our world will look very different. So if you look at pharmaceuticals, it starts off with classical simulation of quantum systems. You go through then synthesizing candidates for drug discovery, same with materials and then you do clinical trials. So many, you go from simulations all the way through and then ultimately what happens is 90% of the candidates after all these trials fail and you've wasted 10 years, one to two billions of dollars and you only have its 10% success rate. So quantum computing will flip that. So if it were to its drug discovery materials, the simulation of complex systems, as the starting point, which traditional computers are doing, one of computing will do significantly better. And the hope is, instead of taking 10 years, you can actually do it in significantly less time, say a year or even a few months. And so that's why our world will look very different. Stephanie, walk us through some of the opportunities that you're most excited about. Quantum mechanics is hard to simulate classically, but classically I mean using light switch zeroes and ones. And because of that, we are okay at simulating small chemicals, like some of the small elements that we use for like drug design and the rest. But once we get to heavy atoms or complicated molecules, even as complicated as caffeine, we can't simulate it fully. So having a tool fit for purpose for the material world opens up the opportunity to produce not just a large language model, but a large chemistry model or a large physical model to really understand how the physical world works, which would be a whole other layer of capability that we can then bring to whatever industry we want, right? That can help with corrosion, it can help with metabolism, it can help with more complicated drug design, photosynthesis or redesigning of the energy landscape with having new catalysts to help with all kinds of energy efficiencies. Like that's a big one. In the financial world, there's a lot of people that are looking at how to use these tools to better help with some of those applications, whether or not it be optimization or detection of anomalies or whatnot. There's a way to leverage not just AI and classical computing, high performance computing, but then bring in quantum into the mix to have all of the computational tools available to sort out our most challenging problems computationally. I've had the privilege of getting to see your computer up close. Most people will not get to see a quantum computer, but they'll discover quantum through the cloud and through quantum as a service. Tell us a bit more about QAS, quantum as a service and how different enterprises but also individuals should be thinking about accessing quantum through the cloud. We should all have roadmaps internally by we, I mean the broader community. How does it impact your business and understanding those applications and doing the application engineering and development to know what kind of quantum resources you're willing to pay for? If you were to put like a hypercapable quantum computer into the cloud, most wouldn't know what to do with it. So having that roadmap for like, hey, what would you pay for? I think that's really important because if you don't do it, your competitors will and then they'll be able to use it to their advantage in a first mover sense. Quantum as a service is the way to get quantum capabilities into the hands of everybody who needs them but can't afford a single system. But this is similar to how we're using cloud compute today. Most teams don't want to build their own data centers but they do want to have access to that capability. And I think what's going to happen over time is the field will progress and the quantum part of it will be kind of under the hood and you'll only see the application layer. And that is again how people are using a lot of the tools today, right? AI or high performance computing. The really really high performance teams will go all the way in and understand how to do it themselves but there will still be a lot of appetite for the high level access that only is providing solutions to problems not compute cycles themselves. As that evolves, we can't help but think about sovereignty and security. The more that quantum is distributed, if you have your own computer as you do, I imagine that is more secure. But as quantum gets distributed through the cloud, there's more vulnerabilities. How should we be thinking about both sovereignty as a country but also security for organizations and individuals as that distribution starts to accelerate? It's a wonderful question because the last thing you want to do is have a quantum computer that can hack anything just be freely available online, right? That one might be a bit messy. That's a scary thought. Well, I mean, okay, let's just be clear. If we get through the cybersecurity transition, which will be a transition, there'll be some number of years and then we're done with it, then we should have those tools available for everybody to use for whatever they need. So there will be a place where we think about, yes, sovereignty and security through this transition and that's where again, especially because Canada invested in quantum so early, we have a little bit more cultural awareness here than most other countries. We should take that step and be in front of it because then we could be one of the first to actually from a security perspective, leverage the full benefits. Now, this comes back to the value side. Perhaps all you're asking for is an optimization to a problem and you could submit that job rather than have access to the computer, then you could make sure that the actual requests are secure, right? Because asking for an optimization is different than asking to hack a communication, right? And so that could be managed from a security perspective by the providers and done so in a way where it's not limiting the providers to actually provide value to the world. Now, I would share that Canada's way ahead of many, many nations on quantum and there's maybe a top 10 list of teams around the world that are on this race to deliver these big commercial scale systems with all these applications. And so from a sovereignty perspective, we have the opportunity to not make the mistakes that we did before and actually double click on a commercialization frontier for this technology, not just invention. I think it's our time to learn lessons of commercialization from a sovereignty perspective because if you take a look at how a lot of new technologies have been developed, like you take a look at the iPhone, for example, most of the components for the iPhone were developed through DARPA contracts, US government agency that fueled defense aspects, but also then were used in the commercial market. And I think that we can learn lessons like that because those programs, they're absolutely part of the mix, especially if it's important from a sovereignty perspective to be first and have an actual commercial landing. Some of the other incentives that come along are all kinds of matching programs or incentive programs, like these are really part of the game and teams want to succeed in stable, lovely places like Canada, but the money talks to. So yeah, we do have to think about that structure and make sure that the plans and structures are in place because people want to win here and we absolutely can. Companies, universities, public sector organizations, and individuals need to come to grips with this incredible opportunity. What's the key to get going with and focus on in the year ahead? Yeah, I would suggest get a quantum transition plan in place. There's a lot of work that now exists that you can leverage. You don't need to start from scratch. Part of that is going to be putting some of the suppliers on notice that you as an org need them to be quantum secure. And also think about internally how you want to benefit from the applications that are known already and then think about developing them further because I would tell you that those applications are coming in thick and fast now because people are really seeing how close it is. I think back to Avro Arrow and Bambar, D.A. and Norteil and Blackberry. I mean, like we can do it and we can keep it if we learn from what structurally seems to be working elsewhere. Just like honestly pattern matching and hitting that market. So one of the things that the US government is doing, for example, is putting in $300 million per quantum company that they think has a shot on goal and Canada very healthfully is playing again with that market force. And so that's an awareness thing that I think is really positive progress. From a regulation perspective, I think it's important to not get too fearful and walk it down because because that could be a market force that's a disissensive to actually build. But let's just be smart about it, right? Let's get the cybersecurity in place across the country. We already have a date now, a 2030 is our date with the five eyes in general are kind of thinking about this date plus or minus. I think we need to bring it in a little bit personally, but that's because I know some things that maybe others don't. And we can do it. There's nothing wrong with it. And then we can really benefit. I think it's gonna be a wonderful wave of capability that we can use on all kinds of hard problems. It's no coincidence that in pretty much every national strategy, we now see whether it's defense in space or autos. And of course, AI, quantum is a key element. And a lot of that is due to your leadership Stephanie. So thank you for that. And thank you for being on Disruptors. Oh, absolutely. Thanks for having me on. It's a great conversation. Really appreciate it. Here's one thing that's really important to remember. Quantum computing isn't someday. It's now. The systems are real. The threat is active. The clock is ticking. But this isn't a story about inevitable disaster. It's a story of choice. You can treat quantum as both a capability bet and a security retrofit. You can start now, inventoring where you rely on cryptography, prioritizing what must stay secure and migrating to post-quantum strategies before today's protected data becomes tomorrow's breach. Or I guess you can wait for the headline moment. But by then, too late. If you want to know more about quantum, check out rbc.com/thought-leadership. You'll find lots of great content there, including a new quantum primer from our Research Associate, Sabrina Schuchel. You've been listening to Disruptors, an RBC podcast. Please rate, review, and follow us on Apple or Spotify or wherever you get your podcasts. It helps more people find conversations like the one you've heard today. I'm John Stackhouse. Thanks for listening.