The Pentagon's quantum problem is no longer a forecast problem. It is a calendar problem. An executive order issued June 22 gives federal agencies until Dec. 31, 2030 to use post-quantum cryptography (PQC) — mathematical algorithms built to resist attacks by quantum computers — for key establishment on high-value assets and high-impact systems, and until 2031 for digital signatures, per Defense One. The deadline is fixed. The department's ability to meet it, according to officials speaking at a Honolulu conference this month, depends on work that has barely started: counting what needs protecting.
The threat the deadline answers is not a future quantum computer in isolation. It is the practice known as "harvest now, decrypt later" — adversaries collecting encrypted data today on the expectation that a quantum machine will eventually break today's standard encryption. "The reality is, with 'harvest now, decrypt later,' our adversaries can be harvesting data for a really, really long time," said Matt McFadden, vice president of cyber for GDIT, at the TechNet Info-Pacific conference in Honolulu, per Defense One. Data with a long shelf life — classified programs, personnel records, sourcing chains — is already exposed, regardless of when the decryption capability arrives.
How advanced adversary quantum capabilities actually are is, by the department's own account, unknown. "Our adversaries are using quantum. How advanced are their capabilities? We don't totally know," McFadden said, per Defense One. That uncertainty cuts both ways: it makes the risk hard to price, and it makes the fixed federal deadline one of the few hard numbers in the entire discussion. The policy response, in other words, is running ahead of the intelligence picture — deliberately, on the theory that waiting for certainty means migrating too late.
Why the inventory, not the algorithms, is the bottleneck
The White House order sets dates. The services must supply the map. "It's hard to migrate when you don't know what you have," McFadden said, per Defense One. His first step is a comprehensive inventory covering certifications for applications, devices and networks. The obstacle is not only scale but dependence: the military's systems run on third-party providers, and compliance requires working with system owners, suppliers and supply chains to build what he called a governance team to drive compliance and crypto agility — the ability to swap cryptographic defenses as threats change.
Col. Tassika Davis, Pacific Air Forces Command's director of cyber operations and warfighter communications, framed the same requirement from the operator's side. "We need to make sure that our architectures are cryptographically agile, so that we can shift and move and continue, and not degrade mission capability," she said, per Defense One. That means mapping the entire IT ecosystem as it stands, against the full threat picture, before planning the migration. This is the same structural weakness that runs through broader federal IT modernization efforts, where agencies struggle to modernize systems they cannot fully enumerate — a problem Federal IT Modernization Faces Aging Systems, Flat Funding and Transfer Authority examined in a different funding context. We covered a connected angle in Federal IT Modernization Faces Aging Systems, Flat Funding and Transfer Authority.
The maintenance-window squeeze on ships
For the Navy, the deadline collides with a shrinking calendar. Capt. Victor Taylor, Pacific Fleet's director of communications and information systems, told the panel that ships are being kept in service longer and maintenance availabilities have compressed: "We used to be in a period of [maintenance] availabilities, which means we had about nine months to a year to do modernization. Now you've got 45 days," per Defense One.
His questions describe the real shape of the compliance problem. How to break large modernization packages into modular, shorter windows; how to manage configurations across them; how to field teams at scale in multiple locations; how to schedule any of it around dynamic operational changes. "If we think we're going to do that with our old processes, that's not the case," Taylor said, per Defense One. An 80 percent reduction in available modernization time — from nine-to-twelve months to 45 days — is the kind of constraint that no cryptographic standard can solve. It has to be solved by process redesign, and the evidence so far describes the question, not the answer.
Funding the timeline: awareness, then money
The Pentagon released a post-quantum cryptography strategy earlier this year, per Defense One, and its implementation could ride on existing network modernization efforts, according to Peter O'Donoghue, chief technology officer of Quantum Sky. But he argued the binding constraint is organizational, not technical. "The first thing is to acknowledge that it's a real problem. Like Q-Day isn't a thing that's going to be beyond our retirement. Q-Day is going to be a thing that happens…definitely within the next five years," O'Donoghue told Defense One after the panel. "So, then you need to plan for it. You need to actually fund it."
His warning against inaction — "sitting on your hands and going into a kind of analysis paralysis is not the answer. Denying it is definitely not the answer either" — points to the governance risk the deadlines create. A 2030 mandate without funded migration plans produces either rushed, uneven compliance or quiet slippage. Whether the strategy's implementation draws dedicated money or is absorbed into existing network budgets is not stated in the available record; that funding question remains open. How Congress handles the department's broader spending picture, currently running under a stopgap as Defense Appropriations Enter Fall 2026 on a Stopgap: What Happens Next detailed, will shape what new money, if any, is available for this work. Readers following this should also see Defense Appropriations Enter Fall 2026 on a Stopgap: What Happens Next.
What the June 22 order actually changes
The executive order converts a threat that agencies could defer into one with a dated compliance line: PQC for key establishment on high-value assets by Dec. 31, 2030, and for digital signatures by 2031. That matters because the "harvest now, decrypt later" exposure does not wait for the deadline — data collected before migration is data at risk indefinitely. The dates also give auditors and Congress a fixed yardstick: an agency either meets the 2030 line or does not, and the gap becomes measurable. What the order does not do is supply the inventory, the governance structures or the maintenance windows the services say they need. Those remain the department's work to complete, on a clock it did not set for itself but now must keep.
