Harvest Now, Decrypt Later: What It Means for Records With Fifty-Year Lifetimes
Most security programs are built around an implicit assumption: that an attacker who steals encrypted data and cannot read it has failed. For financially motivated intrusions, that assumption mostly holds. Ransomware operators want leverage now. Credential thieves want accounts now. The economics of cybercrime reward speed. State intelligence services operate on a different clock.
Collection is cheap, storage is cheaper, and patience is free. An adversary who intercepts encrypted traffic in 2026 and archives it has spent almost nothing. If cryptanalytic capability arrives in 2040, that archive becomes readable, and the collection decision made fourteen years earlier pays off. This is harvest now, decrypt later. It is not a hypothesis about the future. It is a description of a collection posture that is reasonably assumed to be operating today.
Why Long-Lifetime Data Is the Whole Problem
The threat is not uniform. It is concentrated entirely in data whose sensitivity outlives its cryptographic protection. A password hash stolen today is worthless in 2040. The account will have been rotated, the user will have left, the system will have been decommissioned. Most stolen data decays. Some data does not:
Infrastructure engineering records. Water treatment plant schematics, pump station control logic, electrical single-line diagrams, SCADA network topology, valve and interlock configurations. A treatment facility built in 2018 will be operating in 2050 with substantially the same physical layout. A diagram decrypted in 2041 remains an accurate map.
Source and informant identities. Law enforcement case files, public integrity investigations, immigration proceedings, protected witness records. Exposure risk to the individual does not expire.
Genetic and biometric data. A fingerprint template or genomic sequence cannot be rotated. Compromise is permanent by definition, and it extends to biological relatives who never consented to collection.
Sealed legal records. Juvenile proceedings, adoption records, grand jury material, sealed settlements. Many carry statutory confidentiality periods measured in decades.
Ballot secrecy artifacts. This one deserves particular attention because it is structurally different from the others.
The Ballot Secrecy Case
Ballot secrecy in the United States is not a policy preference. It is a constitutional or statutory requirement in every state, and in most of them it is unqualified and permanent. There is no expiration date after which it becomes acceptable to reveal how a specific person voted.
Any system that transmits ballot data alongside voter identity, or that maintains a linkage between the two even transiently, creates an artifact whose required confidentiality lifetime is effectively infinite. Electronic ballot delivery systems, remote accessible vote-by-mail platforms, and some ballot-on-demand architectures all produce data of this shape. Set X to infinity in Mosca's inequality and it resolves immediately regardless of what you assume about Y and Z.
This is not an argument that these systems are indefensible. It is an argument that they belong in a different risk category than the systems they are usually procured alongside, and that the current procurement environment does not distinguish between them.
What Actually Reduces Exposure
Classify by confidentiality horizon, not by sensitivity label. Most classification schemes sort data by how bad disclosure would be. Add a second axis: how long does it need to stay secret. The intersection of high sensitivity and long horizon is a small set in most organizations, usually under five percent of holdings. That set is where every subsequent decision should be concentrated.
Attack duplication before you attack encryption.Long-lifetime data tends to accumulate copies. The original in the records system, an export in a shared drive, an attachment in an email archive, a snapshot in a backup, a copy on a consultant's laptop, a version in a decommissioned system nobody removed from the network. Each copy is an independent collection opportunity. Reducing copies from six to two is a larger risk reduction than any algorithm change, and it can be done this quarter.
Treat archives and backups as primary targets. Backup systems concentrate exactly what an adversary running a long collection program wants: everything, in one place, often with weaker access controls and older cryptography than production. Backup encryption is frequently the oldest cryptography in the environment because nobody wants to break restore compatibility.
Segment long-horizon data away from internet-adjacent systems. If sealed records live on the same file server as the public-facing document portal, the compromise path is short. Segmentation is unglamorous, cheap, and effective.
Instrument for exfiltration volume, not just intrusion. A harvest-oriented adversary is quiet on entry and heavy on egress. Alerting on outbound data volume from repositories holding long-horizon records catches a collection operation that credential monitoring will miss entirely.
The Framing That Gets Budget
Executives and elected officials tend to hear post-quantum discussion as speculative, because the harm is remote and the technology is unfamiliar. The framing that lands is simpler. The confidentiality obligation attached to some of your records is longer than the useful life of the cryptography currently protecting them. That is a compliance gap that exists today, not a threat that arrives later. The remediation is mostly inventory, deduplication, and segmentation, and it is work you would want done regardless of what happens with quantum computing.
That last point is the strongest one available. Every recommended action in this piece has independent value. None of it is a bet on a timeline.