Cities urged to prepare for quantum cyber risks

City technology leaders should begin preparing for post-quantum cybersecurity threats through supplier audits, workforce training and long-term technology planning, according to Chris Lucero, Technology and Design Director at The Connective, Greater Phoenix’s smart city consortium.

Lucero told Cities Today that the security of municipal systems depends partly on the readiness of the technology companies supplying them. Cities therefore need to consider post-quantum security across their entire supply chains.

“Every city needs to understand this threat from the entire supply chain, from womb to tomb,” he said. “You’re only as strong as your weakest links. If your vendors are not ready for this, you’re going to introduce vulnerabilities.”

Cryptographically relevant quantum computers, with the number of qubits and level of error correction required for substantial computing, are not yet available, Lucero said. Existing systems can perform simulations but are not ready to conduct the type of large-scale attacks that concern cybersecurity specialists.

Nevertheless, he argued that cities should prepare before more capable quantum computers emerge.

Cybersecurity is also becoming a broader organisational issue rather than something confined to municipal IT departments, Lucero said. He expects it to become a core element of government and business strategy, requiring corresponding attention and investment.

One emerging risk is known as “harvest now, decrypt later”. Under this approach, hackers collect encrypted data today in anticipation of gaining access to quantum computers capable of decoding it in the future.

Asked to rate the current threat on a scale of one to ten, Lucero put it at “at least an eight”.

He noted that cities make considerable amounts of information publicly available in the interests of transparency. This can include building information, city council meeting records and future calendars, while municipal application programming interfaces can make it possible to connect with public datasets.

“People smart enough can connect to those and do malicious attacks,” he said.

Lucero recommended that cities pursue “cryptographic agility”, a strategy for introducing post-quantum protections alongside existing infrastructure and encryption techniques.

He outlined a five-stage approach. Cities should first discover where cryptography is used and create a cryptographic bill of materials, effectively conducting an audit of their systems.

They should then assess risks and the expected lifespan of their data, including whether systems are outdated or contain vulnerabilities. The next steps are to audit suppliers, phase in post-quantum cryptography alongside existing protections and, eventually, retire older systems as quantum technology becomes mainstream.

The Connective has been working to improve understanding of the technology among municipal leaders. It began publishing introductory videos last year explaining quantum computing, quantum cryptography and potential vulnerabilities.

The organisation is also developing a strategy called Quantum Arizona, which brings together regional partners, including cities and state-level organisations, to build momentum around quantum technology.

Its approach divides the field into three areas: quantum computing, quantum sensing and quantum infrastructure. The latter includes networking, communications and manufacturing.

Lucero said Arizona should concentrate on its existing strengths in sensing and infrastructure. He cited expertise in optics and photonics at the University of Arizona and the presence of semiconductor manufacturers Intel and TSMC.

For the next 12 months, Lucero recommended that city leaders educate themselves about quantum technology, begin seeking budgets for research and pilot projects, participate in regional discussions and train employees.

“Everybody thinks they know a little bit about quantum, but the funny trap is, the more you know, the more you know you don’t know,” he said.

Training should also address vulnerabilities associated with artificial intelligence tools being introduced under commercial licences within cities.

“A lot of people think quantum is 2030 and beyond, and while that might be true for mainstream, the beginnings start now,” Lucero said. “It’s already a game of catch-up to become aware of the capabilities and vulnerabilities.”

Image: The Connective