A new bipartisan Senate bill aims to fortify the U.S. electric grid against potential cybersecurity threats posed by quantum computers. The Quantum Grid Utility Assurance and Resilient Defense (Quantum-GUARD) Act, introduced by Senators Mike Rounds (R-S.D.) and Chris Coons (D-Del.), would mandate that the Federal Energy Regulatory Commission (FERC) consider quantum computing risks and the application of post-quantum cryptography (PQC) when establishing reliability standards for electricity owners and operators.
The proposed legislation directs FERC to expand its reviews of reliability regulatory standards under the Federal Power Act to specifically include the future threat of quantum computer-enabled attacks. Beyond identifying threats, the bill also requires FERC to investigate the potential uses of post-quantum cryptography within both information technology (IT) and operational technology (OT) systems in the energy sector and to implement appropriate actions based on these considerations.
Senator Coons emphasized that while quantum computing presents significant economic opportunities, it also introduces substantial cybersecurity risks. He stated that as the technology advances and adversaries continue to seek vulnerabilities in critical systems, the Quantum-GUARD Act is necessary to ensure the government utilizes all available tools to address this emerging threat.
The federal government has been actively pursuing the adoption of post-quantum cryptography for its digital infrastructure. The National Institute of Standards and Technology (NIST) has collaborated with cryptographers to develop new PQC algorithms intended for widespread use across government and the private sector. Under the Biden administration, federal agencies were initially given a 2035 deadline to migrate their systems and data to PQC encryption. This timeline was subsequently accelerated to 2030 by an executive order from the Trump administration.
Industry experts have weighed in on the challenges and implications of such a mandate. One networking infrastructure startup CEO noted that while the bill is a positive step toward promoting quantum-resistant encryption, the primary effort will involve upgrading existing infrastructure rather than just applications to meet the deadlines.
Another CEO, whose company specializes in security, drew parallels between the energy sector's current challenges and previous efforts by FERC and the industry to implement other large-scale technological upgrades, such as smart grid equipment. A key challenge highlighted is the need to prioritize security enhancements in a sector where maintaining reliability is paramount. The highest priority for electric utilities is preserving integrity and availability, services that are currently supported by legacy public key cryptographic controls vulnerable to quantum attacks. It is considered essential that quantum computers do not compromise the integrity and authenticity of SCADA communications or the software update process within the energy grid.
