British telecommunications company Vodafone is anticipating a future in which the power of quantum technology will override existing online security controls and render most smartphone networks vulnerable to cyber attacks.
In what it believes is a proactive move, the company has announced that it is teaming up with SandboxAQ, a US startup formerly owned by Alphabet but went independent last year, to conduct a proof-of-concept test for a quantum-safe Virtual Private Network (VPN) to secure millions of workers who use their smartphones for business purposes.
SandboxAQ raised $500 million to prepare internet users for a future where cyber attackers deploy quantum computing to hack into the most cyber-tight systems through smartphone networks. Former Google CEO Eric Schmidt is the startup’s chairman.
Vodafone wants to protect its customers against cyber attacks
In a July 5 blog post, Emma Smith, Vodafone’s cyber security director, said that while quantum computing can help in solving some of the world’s ultra-complex problems, it could be used by bad actors to crack today’s cryptography. “This is why we are playing an active role in the transition to a quantum safe world,” she said. Smith said the company’s partnership with SandboxAQ will boost its efforts in “exploring and trialing new algorithms to provide protection for our customers against possible quantum-empowered attackers in the future.” Vodafone’s customer base was over 300 million last year, largely in Africa and Europe.
The two firms will use cryptography algorithms from the US National Institute of Standards and Technology (NIST), which is part of the Department of Commerce, to guard against potential risks from quantum computing, key among them being Store Now, Decrypt Later (SNDL) attacks. Luke Ibbetson, Vodafone’s head of research and development said in the blogpost that this type of cyber attack “involves adversaries stealing encrypted data now so they can decrypt it in the future with a quantum computer. Although cryptographically relevant quantum computers may remain some years off, the threat posed by quantum-empowered attackers is already here today.”
In the post, Vodafone says its engineers have been conducting a series of experiments to test several quantum vulnerability scenarios for smartphones because “threat actors may already be harvesting data in anticipation of the quantum computing revolution.”
The experiments, Ibbetson explains, involved the assessment of both synthetic traffic data and real data sessions made by internal volunteers from several countries in which the company operates. “We tested the impact of post-quantum cryptography (PQC) on activities many of us do every day,” Ibbetson says in the post. These included web browsing, social media, chat applications, video and audio streaming, and mobile gaming “using PQC-enabled mobile handsets, helping to test network performance and assess the user experience.”
Governments around the world should prepare for the quantum revolution
Vodafone is a member of the Groupe Speciale Mobile (GSM) Association’s newly established Post-Quantum Telco Network (PQTN) task force, which published a white paper in February outlining how governments and mobile network operators should prepare for quantum threats.
The processors in quantum computers run on qubits (subatomic particles such as electrons or photons) rather than the bits (zeros and ones) that power regular PCs. They could one day carry out certain calculations millions of times faster than today’s fastest super computers. While Google recently claimed to have assembled a powerful quantum computer, the technology remains years away from breaking complex encryption codes. Encryption involves encoding data in such a way that it can only be decoded by those with access. But with Microsoft announcing in a June 21 blogpost that it plans to launch a powerful quantum supercomputer in the next 10 years, the moment in which quantum technology will land in our smartphones is not far off in the horizon.
The US government already considers quantum computing a critical element of national security, and this could have informed Vodafone’s decision to work with a US startup in its security agenda.
On July 5, 2022, the US Commerce Department selected new cryptography standards that could better withstand the threat posed by quantum computers. This was after the US Cybersecurity and Infrastructure Security Agency (CISA) announced the establishment of a Post-Quantum Cryptography (PQC) Initiative three days earlier to unify and drive its efforts to address threats posed by quantum computing.