Bruno Couillard: Canada must respond quickly to Trump's quantum-computing challenge

A Y2K-style upgrade is required if we want to avoid a trade nightmare.

By: Bruno Couillard

Donald Trump just did something no U.S. president has done since the Y2K era.

He ordered a whole-of-government push to secure digital infrastructure before a known threat arrives. Canadian companies that want to keep doing business south of the border need to pay attention, because this is now a fresh trade concern.

On June 22, Trump signed two executive orders that together mean Canadian companies — from banks to manufacturing — will need to upgrade their cyber security to be quantum-safe in order to do business south of the border.

The first order requires the United States to build a quantum computer at scale and multiple quantum sensor projects by 2028. The second requires every U.S. federal agency to migrate its sensitive systems to quantum-safe encryption by Dec. 31, 2030 and quantum-safe digital signature by Dec. 31, 2031. Every contractor selling technology to the U.S. government, every government they partner with, and every supplier — including Canadian companies — will also have to comply. This sets a date firmer than ever before for Y2Q (Year to Quantum).

Quantum computers already exist, and developers are getting closer to error-correcting variants at scale. Quantum computers will be exponentially faster and more powerful than classical computers, rendering the network security we use now utterly obsolete — the sheer power of quantum computers will overwhelm existing methods of encryption.

The massive global efforts that went into updating digital networks for Y2K must happen all over again. At that time, leaders took swift, concrete measures to protect their systems from an impending threat. Governments convened task forces, boards demanded readiness reports and CEOs signed off on remediation budgets. The world took it seriously and moved early. The difference this time is that quantum-safe migration is technically harder, the hardware replacement cycle is longer, the adversarial dimension is real, and the size of the effort is many orders of magnitude greater than Y2K ever was.

There is no neutral outcome where you simply miss the deadline and systems keep running. The truth is that if your security infrastructure isn’t upgraded before a sufficiently powerful quantum computer exists, your data — and your clients’ data — and the critical infrastructure that society depends on are at risk of being read or taken over by whoever got there first. Bad actors, likely state-sponsored, who get their hands on a quantum computer will have instant access to our power grids, banks, health records, insurance data, sensitive security data or anything else they want.

The procurement dimension is where this gets urgent for Canada. Within 180 days, the U.S. government will propose rule changes requiring every covered contractor to use U.S. National Institute of Standards and Technology (NIST)-approved quantum-safe cryptographic standards by 2030. Canadian defence primes, cybersecurity firms, and technology suppliers with U.S. government contracts will have to comply or be disqualified. Canada is a Five Eyes partner, a NATO member and a NORAD actor. When the U.S. government moves its cryptographic baseline, we do not get to stay behind — not if our Canadian government wants to continue to be part of these elite clubs in good standing, and not if Canadian companies want to continue to produce technologies, products and services for the American market, which is still our largest trading partner.

The Canadian government can follow suit and set hard dates for post-quantum migration of its own classified and critical systems — dates that align with or precede our allies’ targets. It can identify which domestic suppliers can support that transition and back them with procurement commitments and the resources to scale. (Disclosure: my company, Crypto4A, manufactures quantum-safe hardware, and I already have contracts with Canada’s defence and intelligence establishment).

Canada is already building quantum-safe hardware security module technology — the physical devices that generate, store, and protect critical quantum-safe roots of trust and cryptographic keys. It’s ready now, certified and has put our country at the forefront of the quantum security race. That advantage exists because of knowledge built up at the Communications Security Establishment, and because Canadian engineers committed to solving this problem before the market demanded it.

Here’s what Ottawa should do now to get ahead of this transition. The federal government should pull forward its own quantum-safe migration deadline to align with Washington’s 2030 target and signal that alignment clearly to American counterparts. It should also inventory which domestic suppliers can support that transition and move to contract them now, before the scramble begins and every implementation partner is oversubscribed. And it should make Canadian-manufactured quantum-safe hardware a condition of procurement for critical systems, both to secure supply chains and to ensure Canadian companies can compete as the global upgrade cycle begins. The companies that build the quantum-safe infrastructure for their own country will be the ones positioned to sell it to others.

The United States just set the date for Y2Q and the countdown timer is now running. The Canadian government is in a unique position to establish Canada as the world leader in that domain and even beat the Y2Q countdown. However, if we do not act soon, our trade woes will get worse.

Bruno Couillard is a veteran of the Canadian Armed Forces and the Communications Security Establishment, and the founder of Crypto4A Technologies, a Canadian manufacturer of quantum-safe Hardware Security Modules.

---

The Line is entirely reader and advertiser funded. No federal subsidies, no bailouts. If you value our work, please consider supporting us by subscribing or making a donation. Donations are not subscriptions and do not unlock paywalled content, but they help keep The Line independent

---

To contact The Line with a general inquiry or comment, please email info@readtheline.ca. For other ways to connect with us or to follow us on social media, please see our LinkTree.