Quantum Computing: Risks and Reforms

The fintech market is rapidly evolving, with digital payments, digital investment, digital capital raising, digital assets, and neobanking emerging as some of the most significant trends. Digital payments have seen an unprecedented surge in popularity, with consumers increasingly relying on mobile payment solutions for their day-to-day transactions.

The growth in the fintech market is driven by several factors. Firstly, the increasing adoption of smartphones and the internet has made digital solutions more accessible to consumers, leading to a surge in demand for fintech services. Secondly, the COVID-19 pandemic has accelerated the shift towards digital payments and investments, as consumers have had to adapt to remote and contactless transactions. Thirdly, regulatory changes have enabled fintech companies to compete with traditional financial institutions on a more level playing field. Finally, advancements in technology, such as AI and blockchain, have opened up new possibilities for fintech innovation, driving further growth in the market.

The country with the largest economy in the Middle East has an ambitious Fintech strategy; a goal of 525 Fintech companies by the year 2030. Knowing the fast-paced technological advancements introduced over the course of last decade or so, on the outset the Fintech related goals set within Vision 2030’s Financial Sector Development Plan (FSDP) would be challenging but possible.

Quantum computers (QCs) are a subset of quantum information technologies that harness the unique properties of subatomic particles in their quantum-physical state for information processing and data calculation purposes. Properties of quantum mechanics allow QCs to reduce the difficulty of solving certain mathematical problems, allowing for exponentially faster cracking of the fundamentals of most of today’s encryption standards.

The advent of quantum computing and generative artificial intelligence could potentially pose new risks to the US financial system, warned the Board of Governors of the Federal Reserve System in a report issued to Congress on August 1, 2023 (the Report). These threats and others warrant unspecified “collective actions across government and strong collaboration with the private sector in advancing measures to understand and mitigate risks,” says the Report.

According to the Report, “[q]uantum computing is [an] emerging risk area, as quantum computing capabilities could render current encryption standards used by financial institutions obsolete.” Likewise, the Fed also noted that “[t]he adoption of machine learning tools [including generative AI technologies] will also introduce new risks. … Threat actors [could] use machine learning capabilities to automate cyber reconnaissance and attacks, further increasing the likelihood and impact of cyber incidents.”

The Report noted that these risks are in addition to risks prompted by geopolitical tensions (including the Russian invasion of Ukraine) that “increase the likelihood of cyberattacks with the intent of disrupting critical infrastructure” and general cyber-criminal activity, including ransomware as a service and threats that aim to exploit weaknesses in authentication mechanisms.

One of the most significant risks of quantum computing is the ability to break traditional encryption and harvest and decrypt sensitive data. The basis of quantum risk is the capture of encryption keys. Today’s encryption methods, such as RSA and ECC, rely on complex mathematical problems that are difficult for classical computers to solve. Quantum computers will use Shor’s algorithm to solve these problems faster, potentially in seconds. Any data encrypted with traditional methods will be vulnerable to attack by a quantum computer, meaning any data harvested today will be decrypted later.

Previous encryption standardization and cryptographic migration efforts, such as those led by NIST leads—including the migration from DES to the current AES algorithm for symmetric-key encryption—suggest that it takes at least a decade to replace widely deployed cryptography.

The financial services infrastructure is deemed by the US government as essential for both national and economic stability. Owing to the irreplaceable nature and significance of primary digital transaction points in the financial framework—like Fedwire and other RTGS systems—these interbank payment platforms are not only potential centers for financial disruption but also challenging to replace promptly. This makes swift recovery of the entire financial system difficult. Effective cybersecurity measures must focus on thwarting attacks, minimizing their repercussions, and ensuring a swift and dependable recovery.

Paramount to mitigating the cybersecurity risk is the overarching approach that economists Stephen Cecchetti and Kermit Schoenholtz best summarized in their 2018 essay “Cyber Instability” on the acclaimed blog Money, Banking, and Financial Markets:

Preparing for quantum-computing risks would include, but not limited to:

• Individual entities/Corporates can start with conducting an end-to-end quantum risk assessment, which will help identifying risk points and establishing a roadmap to address those risks. Agreeing on which standard(s) to adopt and clear timeline for replacement of legacy encryption systems should be the primary focus;
• Governments/Central Banks can establish a broad level quantum security taskforce that would include all players from the financial sector, and insist that the financial institutions/banks start laying out plans for becoming quantum-secure;
• Develop a national/global road-map with milestones and corresponding target dates. Periodic assessments of the roadmap would be essential with zero appetite towards retargets.

Originally published on LinkedIn, 21 September 2023.