Europol and UC3M's Harvest Now, Decrypt Later Report, 7 October 2026: Which Captured TLS, SSH and OpenPGP Traffic a Quantum Computer Could Read, and Why Government Communications Rate High Risk
Quentir Defense Monitor
Evidence-based insights for quantum defense and security. Published by Quentir Systems LLC · October 9, 2026.
On October 7, 2026, Europol published two reports on what quantum computing will do to today's encryption, and the one that drew the headlines concerns cryptocurrency wallets. The report a defense reader should open is the other one, a 40-page assessment of the harvest now, decrypt later tactic that Europol wrote with Universidad Carlos III de Madrid (UC3M) inside the Advisory Group on Research and Development of EC3, its cybercrime center. Its publication page, Harvest now, decrypt later, carries the PDF, ISBN 978-92-9414-153-8 and the Publications Office of the European Union as issuer. It is the first Europol publication devoted entirely to the harvest now, decrypt later tactic rather than to the broader quantum transition.
Its key findings are short. The threat is real and needs no quantum computer today, only the expectation of one later. It matters for data that keeps its value for years, with government communications, health records and intellectual property listed first. And TLS, SSH and OpenPGP are all susceptible, with exposure set by configuration and key management.
For a defense reader the capability at issue is collection. An adversary that captures encrypted traffic today and stores it converts a passive intercept into future plaintext without ever touching the target's network a second time. What a force loses is the confidentiality of its own archived traffic, measured over the lifetime of that traffic rather than over the lifetime of the session. The report's stakeholder table puts policymakers and government at HIGH risk and names the targets: diplomatic cables, intelligence reports, law enforcement case files including informant identities, and critical infrastructure data, all described as prime targets for state-sponsored actors. Companies sit at MEDIUM to HIGH and private individuals at LOW to MEDIUM.
What the four-step model and the stakeholder table establish about who collects and who loses
Europol describes the tactic as four steps. Bulk collection from intercepted communications, breaches, network traffic or online repositories. Hidden storage in throwaway cloud accounts, compromised hosts, peer-to-peer networks or physical media. Waiting, for either a cryptanalytic advance or a quantum computer running Shor's algorithm against RSA and elliptic-curve key exchange. Then decryption, which the report says may come after years or even decades.
The report is candid that there are no widely publicized cases of a completed attack of this kind and argues from adjacent behavior instead. Nation-state espionage groups already take intellectual property and communications they cannot use immediately. Ransomware crews such as REvil and Clop already run triple extortion, exfiltrating data before encrypting it and holding the copy for later resale or renewed pressure. Its conclusion draws the line carefully: no clear evidence of systematic exploitation at scale, past exfiltration incidents that suggest the prerequisites are in place, and a tactic for now mostly viable against high-value targets such as governmental communications and confidential business information.
The report's two attacker motivations, strategic accumulation and detection avoidance, explain why the shelf life of data rather than any quantum timeline is the variable to manage: passive capture triggers no alarm, no ransom note and no visible breach, so the holder may never learn that a copy exists. The same logic drove the US Treasury when it stood up its Quantum-Readiness Task Force on August 24, 2026 for the financial sector, where clearing and interbank records stay sensitive for decades.
Which captured TLS 1.2, TLS 1.3, SSH and OpenPGP sessions the UC3M analysis says a quantum adversary could open
The technical core of the report rests on a paper by the UC3M group of Javier Blanco-Romero, Florina Almenares Mendoza, Carlos García Rubio, Celeste Campo and Daniel Díaz Sánchez, On the Practical Feasibility of Harvest-Now, Decrypt-Later Attacks, posted to arXiv on March 1, 2026. That paper treats the tactic as an economic problem: storing intercepted traffic is cheap enough for a well-funded adversary, so the cost that matters is decryption, and the defender's levers are the ones that raise it, rekeying and larger key parameters above all.
Applied to TLS, the report sorts configurations by how much one broken key buys the attacker. TLS 1.2 with RSA key transport is the most exposed: compromising a single server private key decrypts every past and future session protected by that key. TLS 1.2 with ephemeral Diffie-Hellman or elliptic-curve Diffie-Hellman, and every TLS 1.3 suite, provide forward secrecy, which forces the attacker to break each captured handshake individually. Under the quantum threat model forward secrecy multiplies the attacker's cost rather than removing it, since the ephemeral public values sit in the captured handshake. The report adds three TLS 1.3 caveats: resumed sessions fall with the original handshake they derive from, 0-RTT early data has no forward secrecy, and in-session key updates derive from the original handshake secret.
For SSH the picture is the same in structure. Under default settings the key exchange is ephemeral and forward-secret, and the server host key only signs the exchange, so stealing the host key later does not open old sessions. The quantum caveat remains: the three widely used methods, diffie-hellman-group14-sha256, ecdh-sha2-nistp256 and curve25519-sha256, all rest on the discrete logarithm problem, and once an attacker solves it for one captured exchange, the single-stage key derivation yields all six session keys at once. Re-keying mid-session adds work for the attacker and no quantum resistance.
OpenPGP storage is the case with the least protection and the longest exposure. A PGP message carries its own session key, wrapped under the recipient's public key with RSA or ElGamal, so the archive contains everything an attacker needs except the private key, which a quantum computer can derive from the public key the recipient published. One broken key opens every file ever encrypted to it, with no per-session work. For a defense organization that means encrypted email archives, backups and file stores wrapped with classical public keys are the assets whose confidentiality clock is already running.
Quantum pillar: post-quantum cryptography (harvest-now-decrypt-later exposure). Use posture: defensive. Technology readiness: not applicable. This is a threat assessment with mitigation guidance for data holders rather than a system, so it has no rung on the readiness ladder, and its value lies in prioritizing which captured traffic and archives a defender must protect first.
What Europol recommends for high-risk holders: forward secrecy now, hybrid key exchange next, a national strategy, and the NIST 2030 and 2035 dates
The recommendations are tiered by the stakeholder table. For the HIGH tier, which is where a ministry, an agency or a defense prime sits, the report lists three actions. Disable TLS 1.0 and 1.1 and other outdated protocols immediately and enforce forward secrecy. Accelerate the transition to post-quantum cryptography, starting with pilot projects that include hybrid deployments. And build a national post-quantum strategy with funding, standards work and workforce training. Where TLS 1.2 must stay, it is restricted to DHE and ECDHE with static RSA key transport disabled. It notes that deprecated TLS 1.0 and 1.1 are already breakable classically, which it calls a harvest now, decrypt now risk.
On the migration path, the report leans on two public instruments. The first is NIST's draft IR 8547, Transition to Post-Quantum Cryptography Standards, which the report reads as deprecating today's common public-key configurations by 2030 and phasing out classical public-key cryptography by 2035. The second is the European Commission's Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography of June 23, 2025. Against those dates the report applies Mosca's theorem as its urgency test: if the years the data must stay secret plus the years the migration takes exceed the years until a cryptographically relevant quantum computer exists, the data is already at risk, and it puts health records, classified communications, intellectual property and law enforcement files beyond a ten-year sensitivity window.
The interim measure the report singles out is hybrid key exchange, running a classical exchange such as ECDH and a post-quantum one such as ML-KEM in parallel and deriving the session key from both, so an attacker must defeat both. It points to the IETF's hybrid design for TLS 1.3, to RFC 9370 for multiple key exchanges in IKEv2, and to OpenSSH, which switched its default to a hybrid NTRU Prime and X25519 exchange in release 9.0 in April 2022. For data at rest it cites the OpenPGP crypto-refresh adding ML-KEM and GnuPG builds with post-quantum algorithms. It lists ML-KEM, ML-DSA and SLH-DSA as standardized in FIPS 203, 204 and 205, FN-DSA in FIPS 206 as still in development, and HQC as selected in 2025 with its standard pending.
The managerial chapter is where a program office will recognize its own backlog. The report's first step is a cryptographic inventory of TLS endpoints, VPN gateways, SSH servers, backup, archive and email encryption, databases and every service that relies on certificates or keys, because without that map an upgrade plan is guesswork. The United States offers a measure of how hard that first step is: the GAO audit released on October 6, 2026 found that none of 24 federal agencies had completed the inventory, funding and testing practices it measured. Europol's remaining steps are data minimization with retention limits and secure deletion, hardware security modules for long-term private keys, and a multi-year program that puts the highest-risk systems first.
What the report does not establish and what a program office should take from it
The report establishes a threat model and a configuration-level map of exposure. It does not establish a date for a cryptographically relevant quantum computer and says a definite timeline is less important than it seems. It documents no completed attack, no measured volume of harvested traffic and no attribution. It does not assess classified-network cryptographic suites, which fall outside the internet-standard protocols it analyzes. And it offers no evidence on quantum key distribution. It mentions only that a hybrid of a post-quantum key with one from quantum nodes is being tested in sensitive environments, with no results given.
That scope sets where a defense program's exposure sits: in the unclassified-but-sensitive layer that the internet protocols protect. Contractor portals, logistics and depot systems, personnel and medical records, VPN tunnels between sites, administrative SSH sessions, and years of email archives wrapped with classical public keys. A program office reading the report should be able to answer four questions. Which key exchange modes are still live in its estate, and does any TLS 1.2 RSA key transport remain. Which archives hold session keys wrapped with RSA or ElGamal, since those fall to a single broken key. How does the confidentiality lifetime of each data class compare with the migration time, which is Mosca's test applied to a real inventory. And which vendors can already run a hybrid exchange today.
Europol's closing instruction is that each organization must run its own Quantum Threat Risk Assessment and build a phased roadmap from it. For a buyer, the report's value is the ranking it supplies for that assessment: the archive under a classical public key first, the TLS 1.2 RSA session second, the forward-secret session third, and the deprecated protocol before any of them, because that one needs no quantum computer at all.
Sources
Primary source: Europol, Harvest now, decrypt later, jointly developed with Universidad Carlos III de Madrid within the Advisory Group on Research and Development of the European Cybercrime Centre, Publications Office of the European Union, Luxembourg, 2026, ISBN 978-92-9414-153-8, DOI 10.2813/1882350, published October 7, 2026, read in full. Context: Blanco-Romero, Almenares Mendoza, Garcia Rubio, Campo and Diaz Sanchez (UC3M), arXiv:2603.01091, March 1, 2026; NIST IR 8547 (ipd); European Commission Coordinated Implementation Roadmap, June 23, 2025; OpenSSH 9.0 release notes, April 2022. Buyer questions and the exposure ranking are Quentir analysis.
- Harvest now, decrypt later
- On the Practical Feasibility of Harvest-Now, Decrypt-Later Attacks
- IR 8547, Transition to Post-Quantum Cryptography Standards
- Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography
- switched its default to a hybrid NTRU Prime and X25519 exchange in release 9.0