Quantum Computing: Fund the Bipartisan Consensus, Extend the Crypto Migration Beyond Government

The strongest good-faith objection: federal agencies are a fundamentally different regulatory subject than privately-owned critical infrastructure, and a critic could argue mandating and resourcing post-quantum migration for private utilities and hospitals raises questions this issue's "just extend the same deadline" framing understates: who pays for it (a new federal spending obligation), and whether the federal government should be setting technical security mandates for private industry generally. But the federal government already sets mandatory security standards for privately-owned critical infrastructure in exactly this category — NERC reliability standards for the power grid, HIPAA security requirements for hospitals — precisely because the consequences of a critical-infrastructure breach extend far beyond the company that got breached. Post-quantum migration is the same category of mandate, not a novel expansion of federal authority, and the funding question is a design detail (cost-share, phased timelines, small-operator subsidies) to work out, not a reason to leave the underlying gap unaddressed.

Private critical-infrastructure operators bear compliance costs if a mandate is imposed without full federal funding attached. Taxpayers bear the cost if the federal government does fund this migration for private companies. If the mandate isn't extended at all, then the customers, patients, and ratepayers of vulnerable private infrastructure bear the "harvest now, decrypt later" risk that goes unaddressed. This issue's position is that this last cost is the least acceptable of the three, not that the other two are costless.