Decrypt Now or Lose Forever: Why Federal Agencies Are Rushing Cold Cases Into the Codebreaking Queue Before Quantum Computing Arrives

Somewhere in a climate-controlled evidence locker — or more likely on a secured government server — sits a hard drive. It was seized years ago during a federal investigation. The suspect was convicted on ancillary charges, but the encrypted partition at the center of the case was never cracked. Investigators always assumed they would eventually get to it. Now, a new kind of deadline is forcing their hand.

The arrival of practical quantum computing, still measured in years rather than decades, is reshaping how federal agencies think about their backlogs of encrypted evidence. The question is no longer simply whether they can break a given cipher. It is whether they will still be able to do so once the cryptographic landscape shifts beneath their feet — and whether the tools they use today will survive that transition at all.

The Ticking Clock Behind the Evidence Locker

Modern encryption standards — particularly the RSA and elliptic-curve cryptography (ECC) algorithms that protect everything from financial transactions to private communications — derive their strength from mathematical problems that classical computers cannot solve in any practical timeframe. A sufficiently powerful quantum computer, however, could theoretically factor the large prime numbers underpinning RSA encryption in a matter of hours using an algorithm developed by mathematician Peter Shor in 1994.

The National Institute of Standards and Technology (NIST) has been working for years on post-quantum cryptographic standards, finalizing its first set of quantum-resistant algorithms in 2024. But the transition to those new standards will take years to propagate across government systems, commercial infrastructure, and consumer devices. In the interim, a window of vulnerability exists — and both law enforcement agencies and adversarial nation-states are acutely aware of it.

For federal investigators, this creates a peculiar urgency. Encrypted data seized years ago under court order remains legally accessible in principle, but technically inaccessible in practice. Agencies including the FBI and the Department of Homeland Security have quietly expanded their cryptanalytic capabilities, partly through partnerships with the National Security Agency and partly through contracts with private firms specializing in digital forensics. The goal, according to former federal prosecutors familiar with the process, is to prioritize the most serious cold cases for decryption attempts before quantum-enabled adversaries — or quantum-enabled defense attorneys — change the calculus entirely.

When Decryption Cracked the Case Open

The strategic importance of breaking encryption is not hypothetical. Several high-profile law enforcement operations in recent years turned decisively on the ability to access encrypted communications and files.

The 2021 takedown of the Anom encrypted phone network — a covert FBI operation that secretly operated its own supposedly secure communications platform — yielded over 27 million messages and led to more than 800 arrests across 16 countries. The operation worked precisely because investigators controlled the encryption keys from the outset. In cases where they do not hold those keys, the challenge is exponentially harder.

Similarly, the 2022 disruption of the Hive ransomware group involved FBI agents quietly infiltrating the network and obtaining decryption keys, sparing victims an estimated $130 million in ransom payments. The operation required months of covert access and was made possible in part because Hive's operational security had exploitable weaknesses. More sophisticated criminal organizations — and state-sponsored actors — have since taken note.

These successes underscore a broader truth: decryption is rarely a brute-force exercise. It typically requires a combination of legal access to infrastructure, human intelligence, operational errors by targets, and, increasingly, advanced computational tools. The quantum era threatens to raise the floor on that last category dramatically.

The Backdoor Debate Returns — Louder Than Before

The encryption arms race has reignited a policy debate that has never truly been resolved. Law enforcement agencies, led publicly by the FBI, have long argued that end-to-end encryption without any lawful access mechanism creates an irreversible "going dark" problem — a zone of digital activity that is permanently beyond judicial oversight, regardless of the severity of the crime being investigated.

Civil liberties organizations, cryptographers, and major technology companies have pushed back with equal force, arguing that any deliberately weakened encryption or government-accessible backdoor cannot be secured against exploitation by malicious actors, foreign intelligence services, or authoritarian governments. The mathematics, they argue, does not permit a backdoor that only the "right" people can use.

This tension has taken on new geopolitical dimensions. China has been aggressively harvesting encrypted Western data through a strategy intelligence analysts call "steal now, decrypt later" — collecting vast quantities of encrypted government and commercial communications today with the expectation of decrypting them once quantum capabilities mature. The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) have both issued warnings about this practice, which poses particular risks to sensitive national security communications and personally identifiable information held by federal agencies.

Europe occupies a more complicated position. The European Union's ongoing debate over client-side scanning — a proposed mechanism to detect illegal content in encrypted messages before it is sent — has drawn fierce opposition from privacy advocates and cryptographers who see it as functionally equivalent to a backdoor by another name. The United States has watched these deliberations closely, aware that any standard adopted in Europe will ripple through global technology supply chains.

What This Means for Ordinary Americans

For citizens who use encrypted messaging apps, encrypted email, or devices with full-disk encryption enabled, the immediate practical implications are limited but worth understanding clearly.

First, the "harvest now, decrypt later" threat is real, even if its impact on private individuals is unlikely to match its significance for government targets. Sensitive personal communications — medical records, financial negotiations, private correspondence — transmitted today over strong encryption could theoretically be exposed in the future if quantum decryption matures as anticipated.

Second, the push for lawful access mechanisms, if it succeeds legislatively, could weaken the encryption protecting ordinary users far more immediately than any quantum computer. Security researchers consistently warn that any mandated vulnerability in a cryptographic system is a vulnerability available to all adversaries, not merely authorized government entities.

Third, the transition to post-quantum cryptographic standards will require active participation from individuals and organizations alike. NIST's newly standardized algorithms — including CRYSTALS-Kyber for key encapsulation and CRYSTALS-Dilithium for digital signatures — will gradually replace existing standards across software platforms, browsers, and operating systems. Users who rely on legacy systems or fail to update their software will be exposed during the transition period.

The Asymmetry at the Heart of the Debate

Perhaps the most uncomfortable reality embedded in this entire discussion is one of asymmetry. Law enforcement agencies operate under judicial oversight, constitutional constraints, and democratic accountability — imperfect as those mechanisms may be. The criminal organizations and state-sponsored actors on the other side of the encryption divide operate under no such constraints.

When investigators argue that encryption is shielding genuine threats — child exploitation networks, ransomware syndicates, foreign intelligence operations — they are not manufacturing a hypothetical danger. The documented cases are substantial and serious. When privacy advocates argue that weakening encryption exposes hundreds of millions of law-abiding citizens to surveillance, identity theft, and authoritarian overreach, they are equally grounded in documented reality.

The quantum computing era will not resolve this tension. It will intensify it. The window for cracking yesterday's encrypted evidence is closing. The debate over how tomorrow's encryption should be governed is only beginning.

For Americans who care about both security and liberty, the only responsible response is to stay informed, update their software, and pay close attention to the legislative battles quietly unfolding in Washington — battles that will shape the boundaries of digital privacy for a generation.