Bureaucracy Times

All the news fit to be declassified.

The Quantum Homework Nobody Turned In

Flat, dry editorial illustration. A government filing cabinet overflowing with quantum physics symbols — wave functions, qubits, circuit diagrams — mixed with mundane bureaucratic paperwork and rubber stamps marked "INCOMPLETE." A large wall clock shows a deadline long past. Muted institutional palette: navy, beige, gray, burgundy. Deadpan newspaper editorial style, no people, flat color.

Twenty-four federal agencies were handed three assignments to prepare for the day a quantum computer can read their secrets. None finished all three. On the testing assignment, twenty-three did nothing whatsoever, and the twenty-fourth did some market research and declared itself busy. That is the headline finding of GAO-27-108740, released October 6, and it arrives with an asterisk the size of a filing cabinet.

A Report Seasoned in the Dark

GAO finished its audit in September 2025 and issued a sensitive version that month. The public version is dated October 6, 2026, thirteen months later, because ten agencies in the review decided parts of the original had to stay secret. The result is a scoreboard without names. We learn that twenty-one agencies produced funding assessments they admit are shaky and three produced none, but not which three. Only the Department of Homeland Security and the Social Security Administration have their comment letters reprinted.

The calendar is stranger still. GAO says it spent September 2025 to January 2026 preparing the public version with the 24 agencies, the Office of Management and Budget, the intelligence director and the science policy office. It worked with the Office of the National Cyber Director (ONCD) through September 2026, nine months longer. The report does not say why.

Here is an inference, and only that. ONCD coordinates national cyber policy, and GAO’s November 2024 report on the quantum strategy recommended it take the lead in fixing a strategy GAO found only partly complete. This new report says ONCD had not acted on that recommendation as of March 2025. Nothing in the document says ONCD slowed anything down. But the office GAO has been nudging was also the last hand on the redaction pen, and a reader is entitled to wonder whether that is a coincidence.

Three Assignments, Zero Passes

The assignments came from OMB memo M-23-02, issued in November 2022. Agencies were to inventory their quantum-vulnerable cryptography by May 4, 2023, and annually after that, then estimate the cost of replacing it, then test the replacements.

On inventories, one agency fully delivered, one built none, and twenty-two turned in partial work. Most missed high-impact systems and high-value assets, which are precisely the systems an adversary would want first. Several flagged symmetric encryption as vulnerable, which suggests the authors had not finished the reading. On funding, all twenty-one agencies with assessments told GAO their numbers were not fully accurate, and only one had a documented process for making them. Yet OMB used those assessments to hand Congress a governmentwide estimate of roughly $7.1 billion, a significant portion of which, GAO notes, reflects legacy systems.

The excuses are a tidy taxonomy of institutional shrugging. Eighteen agencies reported no cryptography expertise and no plan to get any. Twenty-three had no documented inventory process. Nineteen used no automated tools, and officials from fifteen said it was too early or that they were waiting for CISA. One department with more than four million endpoints built no inventory and had no plan to build one. GAO does not name it.

The threat is not abstract, and not distant in the way that matters. Adversaries can copy encrypted traffic today and decrypt it once a capable quantum computer exists, which GAO calls “harvest now, decrypt later.” Most of the 32 experts surveyed in a report GAO cites put the odds of such a machine by 2040 above fifty percent, and a small minority think it could come sooner.

Voluntary, Except When It Isn’t

The testing failure produced the report’s best argument. ONCD told GAO that testing post-quantum cryptography was voluntary, since most agencies lack the money and expertise. GAO replied that OMB’s guidance never says so, and noted that OMB did not respond to its preliminary results.

Both sides can point to the text. Section V of M-23-02 says agencies are “encouraged” to work with vendors on testing, which is ONCD’s hook. But the memo’s own benchmark table, Appendix A, lists “report testing of pre-standardized PQC” as an ongoing action for all agencies. That is my reading, offered as an inference from the memo’s two sections, and it suggests GAO’s position is at least defensible, while “voluntary” is a generous gloss on a table that assigns the task to everybody.

Then there is the gap between the pep talk and the audit. In 2023, OMB’s Nick Polk told an industry event that “we have a comprehensive inventory of our asymmetric cryptography across all the agencies,” as FedScoop reported. GAO found one complete inventory in twenty-four. The two statements measure different moments and different things, so I will not call it a contradiction. I will call it a reason to ask OMB for the baseline it was celebrating.

The Social Security Administration deserves its own paragraph. Its letter to GAO says a review of its FISMA systems found that none currently use vulnerable algorithms, and that it will build transition plans once resistant algorithms become widely available. NIST finalized its first standards in August 2024. And the same GAO report explains that public-key cryptography underpins the certificates that authenticate federal websites, with RSA and elliptic curve algorithms sitting on M-23-02’s own vulnerable list. My inference is that SSA’s statement must be scoped very narrowly to be true. The reasoning rests on those two documents, and SSA can correct me.

The Syllabus Changed Mid-Semester

GAO’s audit measured agencies against M-23-02, and the rulebook has since been rewritten. According to HSToday, President Trump signed Executive Order 14412 on June 22, 2026, and OMB issued M-26-15 two days later, setting a five-phase schedule through 2035. Reporting by GovConFeed says high-value and high-impact systems must move to post-quantum key establishment by the end of 2030. Every civilian agency must file a migration plan roughly 120 days after the memo, which lands around October 22, 2026. I could not retrieve the memo text itself, so the details come from that coverage.

That date falls sixteen days after GAO’s report landed. The plans are supposed to rest on, in the new regime’s words as reported, automated and continuously updated inventories. If GAO is right, most agencies are about to submit plans built on incomplete inventories, with no testing behind them.

The deadline slippage is not confined to the agencies. The June 2025 executive order told CISA to publish a list of product categories with post-quantum support by December 1, 2025, per the note in GAO’s appendix. CISA released it in January 2026. GAO also said CISA expected to publish its assessment of automated inventory tools by December 2025, and I could not confirm that it did.

So the question for October 22 is simple. Will the plans be public, will they name the agencies, and will anyone own the failures? On the evidence so far, the timing of the threat is anybody’s guess, and the paperwork is the part reliably running late.

Sources