The Quiet Quantum Race: Why the AI Spotlight Is Leaving Canada’s Most Consequential Security Risk in the Dark

Dead Code Walking, Vol. 1 No. 1

Kevin J.S. Duska Jr. | Prime Rogue Inc | October 11, 2026 |

AI is the bigger near-term transformation. Quantum is the bigger blind spot. Harvest-now-decrypt-later and quantum sensing are moving forward with almost none of the public scrutiny AI gets, and Ottawa is no exception.

TL;DR

• AI is not a “distraction.” It is the larger near-term transformation. The real problem is differential visibility: AI has been publicly securitized as the great-power contest, while quantum security risks (retroactive decryption of harvested data, and sensing that could erode submarine stealth) are legible mainly to intelligence services and draw almost no democratic scrutiny.
• The harm is already happening. Western agencies say adversaries are storing encrypted traffic today. Estimates of the hardware needed to break RSA-2048 fell from 20 million qubits (2019) to under one million (Gidney, 2025) to under 100,000 in an architecture study (Iceberg Quantum, 2026). The GAO found none of 24 major US agencies fully prepared to migrate.
• Canada has real quantum assets: Budget 2025’s $334.3M, the Quantum Champions Program, and a PQC roadmap with 2031/2035 deadlines. What it lacks is oversight. Parliament gets no public reporting on PQC migration, defence quantum programs or foreign capital flows.

The Question That’s Been Put The Wrong Way

In policy circles it has become fashionable to ask whether the fixation on artificial intelligence is crowding out attention to other strategic technologies, and to quantum security above all. The strong form of that claim, that AI is a “distraction,” is wrong. It is worth saying why before making the sharper argument.

First, timelines. AI systems are deployed at scale today, reshaping intelligence analysis, targeting, cyber operations and the information environment. Quantum computers that can break public-key cryptography do not yet exist. Second, the main quantum threat to cryptography has a known fix. NIST finalized its first post-quantum cryptography (PQC) standards, FIPS 203, 204 and 205, in August 2024, and selected HQC as an additional key-encapsulation algorithm in March 2025. Third, AI is a compounding general-purpose technology. It accelerates science broadly, quantum science included.

Fourth, and most important, the two technologies are not rivals; they converge. Google DeepMind’s AlphaQubit, published in Nature in November 2024, is a transformer-based neural decoder for quantum error correction, the same architecture family behind large language models. On Google’s Sycamore processor it made 6% fewer errors than tensor-network methods and 30% fewer than correlated matching. AI is already part of how quantum computers get built. Both rest on the same contested stack: advanced chips, cryogenics, specialty materials, energy and scarce talent.

So the problem is not that AI gets attention. The problem is how the two have been made into security issues, and what that framing leaves out.

Differential Visibility: Why Quantum Security Escapes Scrutiny

Constructivist international relations theory offers a useful lens. In the Copenhagen School’s account (Buzan, Wæver and de Wilde, 1998), an issue becomes a security issue when a securitizing actor presents it as an existential threat and an audience accepts that framing. That acceptance licenses extraordinary measures. Securitization is a social process, not an objective readout of danger, and some threats are far easier to securitize publicly than others.

AI has been securitized loudly and publicly. Since 2023 it has had a run of leader-level summits (Bletchley Park, Seoul, the Paris AI Action Summit), the EU AI Act, UN processes, sweeping US chip export controls, and a ubiquitous “arms race” narrative. The money reinforces the story: per Stanford’s 2025 AI Index, US private AI investment reached $109.1 billion in 2024, and global corporate AI investment $252.3 billion. Publics can see AI. They use chatbots, read about deepfakes and fear for their jobs.

Quantum has been securitized too, but quietly, technically and mostly within the security bureaucracy. Its markets are an order of magnitude smaller. McKinsey’s Quantum Technology Monitor 2026 counts $12.6 billion raised by quantum start-ups in 2025, a 6.3-fold jump but still roughly a twentieth of the corporate AI figure. Quantum’s most consequential effects are nearly invisible to the public. A cable recorded in 2026 and decrypted in 2036 creates no headline in 2026. A gravimeter that slightly narrows the ocean an adversary must search produces no viral demo. Those effects are, however, highly legible to the signals-intelligence agencies, navies and nuclear planners who will exploit or suffer them.

This is differential visibility. AI’s risks are publicly legible and therefore publicly governed, however imperfectly. Quantum’s strategic risks are legible mainly to intelligence services, so they are governed, where they are governed at all, behind classification, export-control lists and technical guidance few legislators read. The result is not neglect; spending is real and growing. The result is unscrutinized development: a technology with security consequences moving forward without the democratic deliberation those consequences deserve.

Harvest Now, Decrypt Later: The Damage Is Already Being Done

The clearest case is “harvest now, decrypt later” (HNDL). An adversary records encrypted traffic today, including the public-key handshakes protecting session keys, and stores it until a cryptographically relevant quantum computer (CRQC) can unlock it. Storage is cheap. Bulk collection infrastructure already exists.

This is not vendor speculation. The UK’s National Cyber Security Centre says that for long-lived, high-value data a future CRQC is a relevant threat now. A joint CISA–NSA–NIST factsheet (August 2023) warns that adversaries could target sensitive information today and break it with future quantum computers; the NSA warned of the same in 2021. The logic is Michele Mosca’s inequality: if the time your data must stay secret plus the time it takes you to migrate exceeds the time until a CRQC exists, you have already lost. Intelligence reporting, negotiating positions, source identities and health records have shelf lives measured in decades.

Established fact: no quantum computer today can break RSA or elliptic-curve cryptography.

Credible estimates have moved sharply. In 2019, Craig Gidney and Martin Ekerå estimated that factoring RSA-2048 would take about 20 million noisy physical qubits. In May 2025, Gidney cut that to under one million qubits running for under a week, a 20-fold reduction driven by algorithms and error correction rather than hardware. In February 2026, Iceberg Quantum’s “Pinnacle Architecture” preprint claimed fewer than 100,000 physical qubits in about a month, assuming a 10⁻³ physical error rate; a follow-up adapted it to fixed-connectivity superconducting hardware at roughly 120,000. In March 2026, Google Quantum AI estimated that breaking 256-bit elliptic-curve cryptography could need fewer than 500,000 physical qubits.

These are estimates under stated assumptions, not machines, and the Global Risk Institute itself cautions that the Pinnacle result may matter less than it seems. Hardware claims deserve scepticism too: Microsoft’s February 2025 “Majorana 1” topological-qubit announcement drew a formal critique published in Nature alongside Microsoft’s rebuttal. Still, the trend runs in one direction.

Expert judgment: the Global Risk Institute and evolutionQ’s Quantum Threat Timeline Report 2025 surveyed 26 experts. They judged a CRQC “quite possible” (28–49%) within 10 years and “likely” (51–70%) within 15, and believe the timeline has accelerated.

One more development should trouble anyone who cares about transparency. Google disclosed its improved elliptic-curve circuit through a zero-knowledge proof rather than publishing it. Scott Aaronson had predicted researchers would stop publishing such estimates for fear of helping adversaries. That point appears to have arrived. Future progress toward Q-Day may come without a press release, exactly the condition under which democratic oversight matters most and works worst.

Industry is reading the signals faster than governments. In April 2026, Cloudflare moved its target for full post-quantum security, authentication included, to 2029, reporting that more than 65% of human traffic to its network was already post-quantum encrypted. Google set the same 2029 target. Governments are moving, but unevenly:

Jurisdiction	Key instrument	Deadlines
United States (civilian)	EO 14412 (June 22, 2026); OMB M-26-15	Migration plans within 120 days; PQC key establishment for high-value systems by end-2030; signatures by end-2031
United States (national security systems)	NSA CNSA 2.0 / NSM-10	New acquisitions compliant from Jan 1, 2027; legacy phase-out by 2030; full quantum resistance by 2035
United Kingdom	NCSC roadmap	Discovery by 2028; priority migration 2028–31; completion by 2035
European Union	Coordinated roadmap	High-risk use cases by end-2030; full transition by 2035
Canada	Cyber Centre ITSM.40.001 (June 2025)	Departmental plans April 2026, annual reporting; high-priority systems by end-2031; remaining non-classified systems by end-2035

On paper, orderly. In practice, lagging. On October 6, 2026, the US Government Accountability Office released GAO-27-108740. It found that none of the 24 major federal agencies had fully implemented three basic preparatory practices: inventorying vulnerable cryptography, estimating migration funding and testing PQC. Only one had a complete prioritized inventory, 23 of 24 had done no operational PQC testing, and 18 reported shortages of cryptographic expertise. An earlier OMB report put the cost of migrating priority federal systems between 2025 and 2035 at $7.1 billion, with what OMB called high but expected uncertainty.

Note the asymmetry. The country with the most detailed public deadlines also has a public audit showing it is not ready. Canada has the deadlines but, as far as I can determine, nothing comparable to the audit.

Quantum Sensing: The Sleeper Threat To Strategic Stability

If HNDL is the quantum risk already happening, quantum sensing is the one most likely to change the strategic balance, and it gets even less public scrutiny. Quantum sensors use atoms and photons to measure gravity, magnetic fields, acceleration and time with extraordinary precision. Two military applications matter most.

Navigation without GPS. This is the most mature and least hyped application. In airborne trials in Australia in February 2025, Q-CTRL’s “Ironstone Opal” quantum magnetic navigation system outperformed a strategic-grade inertial navigation system by up to 50 times, and in later reporting up to 111 times, with accuracy down to about 4 metres on flights of up to 700 km. In July 2025, Q-CTRL ran a 144-hour maritime trial of a quantum dual gravimeter aboard the Royal Australian Navy’s MV Sycamore. The UK Royal Navy has tested Imperial College London’s cold-atom quantum inertial sensors in the Arctic (December 2025). DARPA and the US Defense Innovation Unit have contracted Q-CTRL for navigation work. These are field trials, not fielded fleets, but they are approaching operational relevance as GPS jamming and spoofing spread. For submarines, which cannot surface for a GPS fix without exposing themselves, unjammable navigation strengthens stealth.

Detection. This is where the stability risk lies. Quantum magnetometers and gravimeters could, in principle, detect the faint magnetic and gravitational anomalies of a submerged hull. Ballistic-missile submarines (SSBNs) are the backbone of the survivable second strike underpinning deterrence for the United States, the UK, France, Russia and, increasingly, China. Their value rests on the oceans staying opaque.

The evidence calls for restraint. The European Leadership Network’s 2020 assessment judged the near-term potential of quantum sensing to make submarines vulnerable to be relatively low: detection ranges are short, ocean noise is enormous, and submarines can reduce their signatures. Chinese claims, including a reported drone-mounted quantum magnetometer and an August 2025 simulation study claiming an AI anti-submarine system could cut a submarine’s escape probability to 5%, should be treated as aspirational until independently verified. The same goes for periodic Chinese “quantum radar” claims against stealth aircraft.

Over-reading the technology is not the main risk. Perception is. A 2026 RealClearDefense analysis argues that if survivability becomes a matter of degree rather than assumption, second-strike credibility becomes conditional, and adversaries may act on perceived rather than confirmed detection gains. A state that believes its SSBNs are becoming findable faces pressure to build more warheads, adopt more aggressive bastions or move toward launch-on-warning. That is a classic security dilemma, and quantum sensing is developing almost entirely inside classified defence programs, with no confidence-building measures, no transparency norms and no arms-control forum addressing it. A 2025 CSIS analysis urged the Pentagon to establish clear ownership of quantum sensing development to stay competitive. Nobody of comparable weight is publicly asking how to keep it from destabilizing deterrence.

China: Big, Opaque and Accelerating

China’s program is frequently invoked and poorly measured. The ubiquitous figure of $15.3 billion in Chinese public quantum funding comes from McKinsey’s 2022 tally of announced investments and cannot be independently verified. MERICS could not verify a larger $150 billion figure attributed to a non-public plan, and some analysts consider announced Chinese funding only partly realized. Treat any single number as a rough indicator, not an audited fact.

What is verifiable is direction and capability. The University of Science and Technology of China’s 105-qubit Zuchongzhi 3.0, published in Physical Review Letters in 2025, posted a random-circuit-sampling result competitive with Google’s Willow; a system based on it entered commercial cloud service in October 2025. China pioneered satellite quantum communication with the Micius satellite and built a long-distance quantum key distribution backbone. Its 15th Five-Year Plan, adopted in March 2026, names quantum a “future industry,” and MERICS reports CNY 3.2 billion in Chinese quantum investment in Q1 2026 alone, more than in all of 2025. Under military-civil fusion, the line between civilian quantum research and PLA applications is thin by design.

Washington’s response has been export controls. In May 2024, the Commerce Department added 37 Chinese entities to the Entity List, 22 of them quantum-related, including the Hefei National Laboratory and Origin Quantum. March 2025 additions targeted the quantum supply chain. As with semiconductors, these controls appear to spur Chinese self-sufficiency as much as they slow it, and they are set by agencies, not legislatures, through list additions few citizens ever see.

Canada: Strong Assets, Weak Oversight

Canada has an outsized stake in this story. It was a quantum pioneer: Waterloo’s Institute for Quantum Computing and Perimeter Institute, D-Wave’s origins in British Columbia, and a cluster of hardware firms including Xanadu, Photonic, Nord Quantique and Anyon Systems.

Ottawa’s investment has grown. The National Quantum Strategy, launched in January 2023, committed $360 million over seven years. Budget 2025 added $334.3 million over five years and tied quantum to the forthcoming Defence Industrial Strategy. In December 2025, Phase 1 of the Canadian Quantum Champions Program offered up to $92 million, $23 million each, to Anyon, Nord Quantique, Photonic and Xanadu, counted toward the 2%-of-GDP defence commitment.

On defence, DND/CAF’s Quantum 2030 implementation plan (March 2023) sets four missions to reach field-testable prototypes by 2030: quantum-enhanced radar, quantum LiDAR, defence quantum algorithms and long-range quantum networking, with GPS-denied navigation and Arctic defence as priorities. IDEaS has funded quantum radar and fieldable sensor challenges. A separate Innovative Solutions Canada challenge seeks quantum magnetometers to detect underwater objects from the air and underwater, a capability with obvious anti-submarine implications.

On security policy, Canada has done more than many realize. The Sensitive Technology List (February 2025) names quantum as a cross-cutting field. Investment Canada Act national-security guidelines were revised in March 2025, and Bill C-34 created pre-closing filing for sensitive sectors. A research-security policy covers quantum communications, computing, materials, sensing and software.

The gaps are in sovereignty and scrutiny.

Capital and control are drifting. Xanadu went public through a US SPAC merger, trading on the Nasdaq and TSX from March 2026 at a market capitalization of roughly US$3.6 billion, while keeping its headquarters in Toronto. D-Wave’s parent became a US corporation in 2022 and announced in January 2026 a move to Boca Raton, Florida. Photonic is a counterexample: it raised more than US$200 million in 2026, and says Canadians own over half the company. DND’s own Quantum 2030 warns that without defence support, firms may move to countries whose militaries will invest. I found no public national-security review decision under the Investment Canada Act involving a quantum firm. That could mean the screen works, or that no one is watching. The public cannot tell.

Alliance positioning is uncertain. AUKUS Pillar II, whose quantum arrangement prioritizes positioning, navigation and timing, consulted Canada from 2024. In March 2026, Defence Minister David McGuinty indicated Canada was unlikely to join. That may be sound strategy, but it means Canada’s access to allied quantum-sensing work runs through Five Eyes, NATO and TTCP channels even less visible to Parliament.

PQC migration is unreported. The Cyber Centre’s roadmap required departmental migration plans by April 2026 and annual progress reports thereafter. To my knowledge none have been made public, and there is no Canadian equivalent of the GAO audit. The roadmap also covers only non-classified systems; classified systems are handled privately with the Cyber Centre. Canadians have no way to know whether their government is on track, behind, or, like the 24 US agencies, unprepared.

Ottawa treats quantum as a sovereign economic asset. It has not yet treated quantum security as a matter for democratic oversight.

What Should Be Done

Transparency is not the enemy of security here. Systems that are never audited tend to fall behind, and in a technology this consequential, falling behind invites miscalculation. Concretely:

1. Publish a PQC migration scorecard. Treasury Board and the Cyber Centre should report annually, at the aggregate level, how many departments have filed plans, the share of high-priority systems inventoried and migrated, and the funding identified. The Auditor General should conduct a GAO-style PQC audit before 2028. Critical-infrastructure regulators, including OSFI, the CER and the CRTC, should require similar reporting from banks, telecoms and energy operators.
2. Create standing parliamentary scrutiny of quantum. NSICOP should review quantum’s implications for signals intelligence, cryptographic security and deterrence, with an unclassified summary. The Commons defence committee should hold annual hearings on Quantum 2030 progress.
3. Make foreign-investment screening of quantum legible. Ottawa should report at least annually how many quantum-sector transactions underwent national-security review and with what outcomes. Quantum Champions funding should carry published conditions on headquarters, IP and control.
4. Put quantum sensing on the arms-control agenda. As a non-nuclear, Arctic, middle-power ally, Canada has credibility to champion quantum sensing in NATO deterrence discussions, the NPT review cycle and Track 1.5 strategic-stability dialogues with China. Start with confidence-building measures, such as transparency about large-area sensing arrays, and a shared understanding that SSBN survivability is a collective stabilizing good.
5. Stop treating AI and quantum governance as separate silos. AI summitry and the emerging UN AI governance architecture should add a quantum track. The underlying stack is shared, and the convergence is real.

Conclusion

AI deserves the attention it gets. It is the larger near-term transformation, and it is accelerating quantum progress itself. But attention is not oversight, and the public securitization of AI has drawn the democratic spotlight away from a technology whose most consequential effects are designed to stay invisible. Encrypted secrets are being stored today for decryption tomorrow. Sensors that could one day thin the fog over the oceans are being tested now. Estimates of when the cryptographic walls fall keep shrinking, and some may no longer be published.

None of this calls for alarm. It calls for scrutiny. Canada, with real quantum assets and a tradition of middle-power arms-control diplomacy, is well placed to show what democratic oversight of quantum security looks like. The first step is to stop letting it develop only where publics cannot see.

Caveats

• Estimates versus facts: all RSA/ECC resource figures (Gidney, Pinnacle, Google) are theoretical estimates under stated hardware assumptions. No CRQC exists, and the GRI survey probabilities reflect expert opinion.
• Contested claims: Microsoft’s topological-qubit claims remain disputed. Chinese quantum radar and submarine-detection claims are largely unverified. Chinese funding figures, including the widely cited $15.3 billion, cannot be independently confirmed.
• Gaps in the public record: I found no public reporting on Canadian departments’ April 2026 PQC plans and no public ICA national-security decision involving a quantum firm. Absence of public evidence is not evidence that nothing happened; that absence is the core of this argument.
• Comparisons: AI and quantum investment figures come from different trackers (Stanford AI Index, McKinsey) with different methods, so the roughly 20:1 ratio is indicative only.

About the Author

Kevin Duska is a lifelong intelligence professional who completed undergraduate studies in Political Science and Sociology at McGill University, and graduate studies at Ohio State University. Deeply informed by constructivist International Relations theory, Duska is a veteran of both the public and private sectors. Kevin Duska is a specialist in OSINT, information warfare, AI safety, and

Sources

• Learning high-accuracy error decoding for quantum processors (AlphaQubit), Nature
• The 2025 AI Index Report: Economy, Stanford HAI
• McKinsey Quantum Monitor 2026, PostQuantum
• What is Harvest Now, Decrypt Later? PostQuantum
• Quantum Threat Timeline Report 2025, Global Risk Institute
• How many qubits could it take to break RSA-2048? Irish Quantum
• The Pinnacle Architecture (Iceberg Quantum), alphaXiv
• Pinnacle Architecture with fixed connectivity, arXiv
• Pinnacle Architecture: 100,000 qubits, but at what cost? PostQuantum
• Google’s quantum white paper on ECC, Safeheron
• Quantum Briefing, Global Risk Institute
• Nature publishes formal challenge to Microsoft Majorana 1 claims, Gadget Hacks
• On quantum timelines: what does 2029 mean? PQShield
• Cloudflare post-quantum roadmap
• OMB M-26-15 sets 2030 PQC deadlines, GovConFeed
• PQC roadmaps and transition guidance, PQShield
• CNSA 2.0 and the quantum-safe deadline, AKMSecure
• Canada: CCCS sets government PQC roadmap, QPF
• ITSM.40.001 Migration to PQC for the Government of Canada, Cyber Centre
• GAO finds federal agencies not prepared for quantum threat, ExecutiveGov
• GAO audit finds agencies unprepared for PQC, Mallory
• Q-CTRL overcomes GPS denial with quantum sensing, The Quantum Insider
• Q-CTRL maritime quantum navigation sea trials, The Quantum Insider
• Royal Navy Arctic trial of GPS-free navigation
• Quantum technology and submarine near-invulnerability, European Leadership Network
• Quantum sensing and the fragility of second-strike deterrence, RealClearDefense
• Quantum sensing and the future of warfare, CSIS
• The $15.3 billion number nobody can verify, PostQuantum
• Quantum, MERICS China Tech Observatory
• China opens its superconducting quantum computer for commercial use, The Quantum Insider
• China’s quantum sector sees investment surge, The Quantum Insider
• Chinese physicists on US trade restrictions, The Quantum Insider
• DND/CAF Quantum S&T Strategy Implementation Plan, Canada.ca
• Canadian government backs four quantum companies, The Quantum Insider
• Canada launches Quantum Champions Program, HPCwire
• Beyond GPS IDEaS challenge, Canada.ca
• Quantum sensing challenge, Innovative Solutions Canada
• Sensitive Technology List, Canada.ca
• Guidelines on the national security review of investments, ISED
• Securing Canadian quantum R&D, National Quantum Strategy
• Xanadu business combination filing, SEC
• D-Wave headquarters relocation filing, SEC
• Photonic raises $200 million, The Globe and Mail
• AUKUS Pillar 2, House of Commons Library
• Canada unlikely to join AUKUS, ABC News