Somewhere right now, a server farm is running that decrypts nothing. It just copies. Intercepted internet traffic, banking correspondence, diplomatic cables, encrypted archives — all of it lands on disk as unreadable noise, and nobody opens it. Yet. The logic is simple and cold: what can't be broken by math today can be broken by hardware tomorrow. And that hardware is already being built, openly, with multi-billion-dollar budgets, on three continents at once.

This isn't paranoia about the future. It's a description of the present.

A Lock Built on One Problem

Nearly all of the world's digital security — bank logins, HTTPS in your browser, VPNs, the signature on a crypto wallet, encrypted messaging — rests on one trick: certain math problems are trivial to solve in one direction and practically impossible in the other. Multiplying two enormous prime numbers takes a second. Factoring the result back into those primes takes a classical computer longer than the universe has existed, if the numbers are long enough. RSA is built on that asymmetry. A close cousin — the discrete logarithm problem on an elliptic curve — underpins ECC, which signs the transactions on Bitcoin and most other blockchains.

This wasn't an accident of engineering. It was a deliberate foundation: a lock that's cheap to verify and, in principle, impossible to pick within a reasonable amount of time. The entire digital world — property, private conversation, thirty years of accumulated trust — is built on the bet that this problem stays unsolvable for existing machines.

A quantum computer changes the nature of that bet. In 1994, mathematician Peter Shor showed that a sufficiently large, sufficiently stable quantum machine solves both factoring and discrete logarithms not in geological time but in hours or days. The algorithm has existed for thirty years. What's missing is only the hardware to run it at scale. Symmetric encryption — the layer that protects files once a key is already agreed on, like AES — is touched more gently: Grover's algorithm only offers a quadratic speedup, and doubling the key length is enough to stay ahead of it. But the whole system that delivers that key in the first place — RSA, ECC, the backbone of the internet — breaks qualitatively, not incrementally.

Harvest Now, Decrypt Later

This is where a strategy already has a name: harvest now, decrypt later. Intelligence agencies don't need to break a cipher today. They only need to record the encrypted traffic today and wait for a machine capable of opening it later. Data with a short shelf life — one-time passwords, a single evening's private message — isn't exposed to this threat. Data with a long shelf life — state secrets, intellectual property, medical records, the keys to a crypto wallet someone plans to hold for decades — is vulnerable right now, even if the machine that can crack it doesn't arrive for fifteen years.

The U.S. National Security Agency took this seriously enough to mandate its own next-generation cryptography suite, CNSA 2.0, requiring federal systems to migrate to post-quantum protection by the mid-2030s. That's not a gesture toward some distant future. It's an admission that the clock is already running for data being recorded today.

The Qubit Race

Estimates of how much "quantum power" is actually needed to break RSA-2048 have shifted fast and hard. Early calculations from the late 2010s put the number at several million physical qubits with full error correction. A 2023 paper from Google researchers revised that estimate downward — to roughly one million physical qubits running for about a week — thanks to more efficient compression of the underlying computation. A revision of more than half in a few years is itself a signal: this is a moving target, and it keeps moving in one direction.

The industry is answering with hardware. IBM unveiled its Condor chip in 2023, crossing a thousand qubits, and published a roadmap aiming for a system with hundreds of thousands of qubits by the late 2030s. In late 2024, Google's Willow chip demonstrated, for the first time, that error correction gets better as qubit count grows rather than worse — a threshold physicists had spent decades calling the real gate on the path to a practical machine. China is investing at the state level through a quantum lab in Hefei and photonic systems like Jiuzhang, which have claimed quantum advantage on narrow, purpose-built problems. The U.S. funds the field through its National Quantum Initiative, the EU through its Quantum Flagship program.

The honest assessment is that nobody knows the exact timeline. Some specialists put a cryptographically relevant machine ten to fifteen years out. Others say twenty to thirty. Some allow that progress could stall indefinitely if the noise and error-correction problem turns out harder than it looks today. Progress here doesn't move as a smooth curve — it moves in leaps, years of quiet followed by a sudden threshold crossed, the way Willow landed. Building a precise calendar for this threat is self-deception. Building defenses without waiting for that calendar is the only sober strategy.

What's Already Being Built in Response

Here's the genuinely good news: the world isn't sitting still. In August 2024, after nearly eight years of an open international competition, the U.S. National Institute of Standards and Technology (NIST) finalized the first official post-quantum encryption standards — ML-KEM (formerly CRYSTALS-Kyber) for key exchange and ML-DSA (formerly CRYSTALS-Dilithium) for digital signatures, alongside the more conservative SLH-DSA as a backup built on different math. These aren't lab experiments. They're deployment-ready algorithms believed, as far as anyone can currently tell, to resist both classical and quantum attacks.

Major players are already moving. Apple built its PQ3 protocol into iMessage in 2024, blending classical and post-quantum cryptography in a hybrid scheme. Google and Cloudflare have spent years testing hybrid post-quantum key exchange in Chrome. But this is a drop in an ocean of infrastructure: the overwhelming majority of internet traffic, banking systems, and — critically — every crypto wallet already in use still runs on plain ECC. The public key of any address that has ever sent a transaction is already visible on the blockchain, forever. The day a sufficiently powerful machine exists, those addresses won't need to be attacked. They'll just need to be read.

Our record: in the Maat system, Ren — the true name of a thing — isn't decoration; it's the actual source of power over it. To truly name something is to gain control of it. A private key is the Ren of your digital property: a string whose knowledge is equivalent to ownership. A quantum computer capable of deriving a private key from its public counterpart doesn't pick a lock — it speaks the true name of a thing you believed was yours alone. And the most unsettling part isn't the math. It's the silence around it: whoever builds that machine first has no obligation to announce it. Silent possession of the true names of the planet's digital property is a concentration of power with no precedent, because the victims won't even know the judgment has already been rendered.

The race for a working quantum computer isn't a race for a physicist's toy. It's a race for the right to be the first to read every secret recorded over the past thirty years, and to sign anyone's name on anything still protected by today's keys. Whoever crosses that finish line first, and chooses silence over an announcement, doesn't get a weapon — they get mute, invisible authority over everything humanity believed was locked. The answer to that isn't panic or fatalism, but sober pressure on the institutions building infrastructure in your name: ask whether the systems you rely on are migrating to post-quantum standards now, not once the threat is announced too late to matter. A lock can be changed before someone else's hand finds the key. Afterward, it can't.