Bipartisan Senate bill aims to prepare energy sector for Q-Day
A new bipartisan Senate bill would require federal regulators to prepare the U.S. electric grid for cybersecurity threats from quantum computers and create a technical sandbox to study how the technology could impact both information and operational technology systems.
The Quantum Grid Utility Assurance and Resilient Defense (Quantum-GUARD) Act, introduced by Sens. Mike Rounds, R-S.D., and Chris Coons, D-Del., would direct the Federal Regulatory Energy Commission when reviewing proposed reliability regulatory standards for electricity owners and operators under the Federal Power Act.
FERC updates its reliability standards to account for emerging cybersecurity concerns, and the legislation would expand those reviews to include the future threat of hacks from quantum computers.
The legislation also directs FERC to explore potential uses of post-quantum cryptography in IT and OT systems and “take such action the Commission determines to be appropriate based on that consideration.”
In a statement, Coons said quantum computing brings “new economic opportunities” along with “tremendous cybersecurity risks.”
“As the technology races forward and our adversaries continue to seek vulnerabilities in our critical systems, we need to pass the Quantum-GUARD Act to ensure our government is using every available tool to meet this threat,” said Coons.
The federal government has been an early adopter of post-quantum cryptography for its digital systems. The National Institute for Standards and Technology has worked with cryptographers to develop new “post-quantum” encryption algorithms that will be used by most governments and the private sector.
Under the Biden administration, most federal agencies were required to migrate their systems and data to “PQC” encryption by 2035. In June, an executive order from the Trump administration pushed that timeline up to 2030.
Ali Shaikh, CEO of Graphiant, a networking infrastructure startup, told CyberScoop that the bill would represent a good start in terms of pushing greater adoption of quantum-resistant encryption, “the real work is upgrading infrastructure, not applications, ahead of the deadlines.”
Evgeny Gervis, CEO of SafeLogic, compared the energy sector’s challenges to previous efforts by FERC and industry to gain adoption at scale for other technological upgrades, like smart grid equipment. Among those challenges is prioritizing security upgrades in a sector where reliability is paramount.
“The highest priority for electric utilities will be preservation of integrity and availability, both services that are widely supported by legacy public key cryptographic controls that are quantum vulnerable,” said Gervis. “It is essential that quantum computers do not undermine the integrity and authenticity of SCADA communications or the software update process.“