As most of you know, I covered the world’s largest consumer products show, CES, in early January for Above the Law. I offered various stories on what I thought was important from a legal standpoint, which you can find here.
One thing I didn’t mention in my coverage was quantum computing. CES offered some 3 hours of presentations on quantum computing. I didn’t write on it. It’s because a), like most of you, I don’t really understand it, and b) I’m not sure what it can and can’t do for legal that’s different than what we have now. The second question begs the question about its impact on lawyers and legal.
Recent Developments
But some recent developments have changed my mind a bit. As discussed below, quantum computing, due to its ability to solve tremendously complex problems at a greater speed than traditional computing, poses substantial cybersecurity threats. These threats may not be well known or understood. And businesses, the government, and legal may not be well prepared.
So when I saw that members of the Cyber Safety Review Board were recently dismissed, I became more concerned that we aren’t fully taking into account the quantum threat. The CSRB is responsible for investigating significant cybersecurity incidents. President Biden created it in 2021 to review and assess significant cyber incidents. The CSRB was investigating a cyber attack by China on the telecommunications industry when the dismissals occurred. The future of the CSRB is unclear.
President Biden’s Executive Order, which set standards for creating and using AI, was also recently repealed.
Quantum computing is based on physics, not math
What is Quantum Computing?
Quantum computing is a type of computing that leverages the principles of quantum mechanics, a branch of physics that deals with the behavior of particles at the atomic and subatomic levels. Unlike classical computers, which use bits (0s and 1s) to process information, quantum computers use quantum bits, or qubits, which can exist in multiple states simultaneously. Quantum computing is based on physics, not math.
So??
Quantum computing has the potential to revolutionize industries by solving problems that are currently unsolvable with traditional classical computers
I’ll be honest: I’m not sure I understand quantum computing. But I do appreciate its power. Quantum computers can perform many calculations simultaneously, providing immense computational power. It enables faster and more complex problem solving. It amplified the probabilities of correct solutions while canceling out incorrect ones. What this really means is that quantum computing has the potential to revolutionize industries by solving problems that are currently unsolvable with traditional classical computers. Applications for and potential benefits of quantum computing include:
▪ Cryptography: Breaking traditional encryption and creating new, unbreakable quantum cryptography methods.
▪ Optimization: Solving complex logistical and supply chain problems faster.
▪ Drug Discovery: Simulating molecular interactions to develop new medicines.
▪ Artificial Intelligence (AI): Accelerating machine learning algorithms.
▪ Financial Modeling: Analyzing vast datasets for better risk assessment and decision-making.
▪ Material Science: Designing new materials by understanding atomic-level interactions.
While promising, many potential applications are still theoretical or in development.
The Impact on Cybersecurity
We all have heard about the power of longer and stronger passwords. Why? Because it’s harder for today’s computers to crack those passwords using “brute force.” But that’s much less a problem for quantum computers.
Harvest now, decrypt later
As a result, quantum computing — a when, not an if — will pose significant security changes for all businesses and, for that matter, law firms (too many law firms are already too far behind on cyber security). Indeed, cybercriminals may have already infiltrated internal processes and systems. They are patiently awaiting the development of quantum computing tools that will allow them to breach security protections and take control (aka “harvest now, decrypt later” attacks.)
We need better and different types of cybersecurity protections. Yet, the consensus is that we aren’t working enough on the issues. Ironically, quantum can take away, but it can also giveth. Because of Its power, it can potentially provide solutions to cybersecurity threads, If we are working on developing them.
When, Not If?
Most of the presenters at CES believed full quantum computing capabilities are years, not decades, away. Business is already working to create quantum computing platforms by 2033. Some believe that platforms that can perform some functions will be available in the next 1-2 years. Indeed, some reliable quantum computing platforms already exist today. No one really knows for sure when quantum computing can be effectively and economically deployed to disrupt —or protect—cybersecurity.
Quantum poses a significant risk that does not yet have an agreed upon timetable to become real
That’s a problem since quantum poses a significant risk that does not yet have an agreed upon timetable to become real. That fact makes the risk easy for businesses and law firms to ignore. It’s not clear if they understand the enormity of the risk or have the ability to take action in advance. This lack of understanding and ability is particularly an issue for law firms: most operate under a partner consensus model. Getting partners to agree to invest profits in cybersecurity for risks that haven’t matured yet may be difficult.
If government decides to back away from these partnerships, it could mean trouble down the road
Recent Government Proclamations Raise Concerns
So why are the recent government proclamations a problem? Understanding and harnessing quantum computing capabilities and power is expensive. The need for government and industry cooperation can not be underestimated. Until recently, the government has been behind in much of the development. If the recent proclamations indicate that this support may be waning, we could risk becoming further behind in assessing the cybersecurity risks and determining how to avoid them. As arecent article in the Quantum Insider put it:
“As quantum computers continue to evolve, the Pentagon is actively relying on government initiatives to prepare for a future where cryptanalytically relevant quantum computers (CRQCs) could undermine today’s encryption systems, a threat to defense infrastructure and financial security alike.
Central to this vision are the partnerships between government bodies and private entities that bring together minds from academia, industry, and government to work in tandem to advance quantum research.”
If government decides to back away from these partnerships, it could mean trouble down the road.
Impact on Legal
On the one hand, it’s easy to say the potential impact of quantum computing on cybersecurity is a business and government problem, not a legal one. It’s easy to say, so what if the government backs away from quantum research? It won’t impact legal.
But, of course, cybersecurity is a significant issue for law firms. More importantly, it’s a huge issue for in-house legal. In-house counsel will have to deal with the fallout of expensive data breaches for their companies. There are liability concerns, particularly where the development of a security flaw is well-known yet has not been acted upon in advance. In-house counselare in a difficult spot: they have to convince their business to invest in protections for something that hasn’t happened yet, but for which in-house counsel will have to deal with (and be unfairly held responsible for) when it comes. Law firms face the same issue but to a lesser degree.
Conclusion
Quantum computing may be far off. But that doesn’t mean the threats and benefits aren’t real. We need partnerships across the board to protect us and still maximize what quantum computing can do.
