uva.nl

Quantum Impact on Societal Security

Research

This research has four main objectives:

(1)    To investigate the requirements for innovation policies to incentivize a responsible transition to QSC technology. The requirements should secure that the transition is technically feasible and acceptable from ethical, socio-political, and legal standpoints (i.e. ELSA-acceptable). 

(2)    To create a favourable Dutch research and innovation ecosystem in which responsible QSC can thrive. The ecosystem should contain representatives from the quadruple helix: governments, businesses, knowledge institutes, and societal partners.

(3)    To develop innovation policies, both for businesses and for governments, that satisfy the above requirements. The proposed policies will focus on the financial, IT-audit, and government sectors, and should anticipate for future innovations in QSC and respond to unforeseen developments. 

(4)    To analyse the stakeholder dynamics and the (geo)politics of protocols and standardsfor online communication: which dynamics inform stakeholders’ response to the implementation of protocols or standards for quantum-safe interoperable online communication? What regulatory requirements are there with respect to the adoption of protocols and standards?How does the tension between interoperability and security of online communication influence stakeholders’ decisions to adopt QSC for mainstream messaging services?
  

To answer these questions, we will take a use case approach to the innovation policy in the sector of security and in the (economic) sectors of financial services, IT audit and government. 
The first use case focusses on institutions in the sectors of financial services, IT audit, and government. It will carry out a comparative study of the transition to QSC technology for specific institutions in these three sectors, which requires an interdisciplinary approach. This will allow the development of adaptable policies that transcend a single sector and can be applied transversally to other potentially affected sectors (e.g. health care).
The second use case focusses on citizens and democracy, studying the societal desirability requirements for a responsible QSC-transition (responsible innovation). It will also analyse the stakeholder dynamics prompted by the introduction of QSC-standards, and the (geo)political implications of this dynamics. 

 

Use Case 1: Institutions

  • Analysis of the sociotechnical system of QSC in the Netherlands (Work Package 1, WP1): What are the organisational roles and responsibilities in the Netherlands in the transition to quantum-safe cryptography (QSC)? What are the system-wide responsibilities and challenges in QSC adoption? Which stakeholders are ultimately responsible for these responsibilities? How might these challenges be navigated?
  • Oversight and regulation in financial, IT-audit, and governmental sectors (WP3):What regulation is desirable for the implementation of QSC for the financial, IT-audit, and governmental sectors? What is the time-frame for the introduction of regulation? What is the legal basis of the obligations and how strict are these obligations? Do the current regulations suffice, or is new regulation required? What should be regulated by government, and what by financial and IT-audit institutions?

 

Use Case 2: Citizens and Democracy

  • A societal and ethical perspective on the transition to quantum-safe cryptography (QSC) is developed in WP2. It approaches this shift not merely as a technical upgrade, but as a socio-technical transformation with significant implications for society and democratic governance. Central to this perspective is the role of understanding as a precondition for meaningful societal and democratic engagement. In addition, because quantum computing remains an early-stage technology, the migration to QSC must be shaped under conditions of deep uncertainty. Expectations, risk narratives, and technological visions influence present policy and investment decisions. WP2 therefore examines how these visions steer innovation pathways and how precautionary reasoning can be ethically justified in responding to potentially systemic threats. The outcome is an ethical framework for guiding responsible innovation in the early-stage context of quantum computing. 
  • Understanding the societal and (geo)political implications of QSC protocols and standards for online messaging services can be achieved through empirical research among the actors involved. These empirical data allow us to analyse the dynamics between stakeholders that result from the introduction of QSC standards. What are the (geo)political implications of the QSC transition in online communication, and in particular with regards to the introduction of QSC protocols for secure interoperable messaging services? Does the stakeholders dynamics suggest that a few central players will dominate the market, effectively acquiring a monopoly position comparable to that of Big Tech companies? What policies can incentivize the implementation of societal feedback on the standards? 

 

Scientific impact

The scientific impact of this project is directly related to the project’s objectives. These aims are achieved and amplified through the use cases and through scientific and stakeholder interactions, specific outputs, and strategic planning of activities and interventions. Therefore, the scientific impact lies in the four main areas: responsible innovation; knowledge, ethics and technology; policy and governance; and the impact of stakeholder dynamics on geopolitics.

(1)    Insight into responsible innovation in real time. Disruptive technologies have often been allowed to grow unregulated in the background, until the negative consequences became visible. QSC technology gives us an opportunity to incorporate principles of responsible innovation, such as co-design and co-creation, at a very early stage. In this way, we can monitor responsible innovation while it develops. We can also test and further develop recent proposals about responsible innovation, such as TNO’s framework for strategic innovation assets and Rathenau Institute’s societal incubator interventions (Rerimassie et al. 2018, see also Section 2.7). Also, because the effects of the technology will only become visible in the next one to two decades, we can test policies that include uncertainties and feedback loops, and make allowance for unforeseen events to take place.

(2)    Knowledge, ethics and research and innovation ecosystems. The project gives an ecosystems perspective on knowledge and understanding that will provide new insights into how understanding changes when it is shared between different communities within the ecosystem. A notion of cognition distributed over agents might be needed to understand key parts of such ecosystems (see Giere, 2002 and Hutchins, 2000). As the focus moves from single actors to communication within an ecosystem, the dynamics change. Knowledge evolves when moved by mechanisms that produce variations, namely the quadruple helix of market/industry, government, research, and society (see Leyesdorff, 2021). Also, the civic input on the moral dilemma about QSC will give us understanding of the ways in which QSC technology is morally laden, and the more general implications of this for the relation between ethics and technology.

(3)    Policy and governance, from fundamental research to society-wide implications. One characteristic of the threats of breaking of ordinary cryptography by quantum computers is that it will affect both businesses and citizens (Section 2.1.1). QSC affects the financial and governmental sectors in their core, since their security is threatened by attackers equipped with quantum computers. Thus the resulting models of (adaptive) policy and governance are of particular interest and importance, since they involve technologies that stem from fundamental physics and computer science, have wide societal implications and can incorporate co-design and co-creation by stakeholders and citizens. This will provide a model for similar future interactions between fundamental and applied science, economic sectors, and government. For example, the reflection on such fundamental principles could help create effective models of policy, and of the interaction within the quadruple innovation helix (describing the relations between academia, industry, government, and civil society), applicable to other equally complex and difficult-to-understand scientific and technological problems such as pandemics, their modelling, and the deployment of various solutions such as vaccines or social distancing measures. The research will also give new insights into the legal basis of the obligations of businesses, professional groups, and governments to adopt QSC technologies. This will extend the EU human rights framework currently underpinning the treatment of privacy by the GDPR, to a significant new technology (Hoofnagle et al. 2021, 437). 

(4)    We will gain insight into how the stakeholder dynamics resulting from the implementation of QSC technology and standards affects geopolitical relations and the circulation of knowledge. If Big Tech has been said to have a ‘the winner takes it all 2.0’ effect, security breaches by large-scale quantum computers will have a similar effect, with superpowers in a main role. Countries need to deploy QSC technology to be quantum-ready, and access to QSC will likely impact geopolitical relations, as this innovation obviously opens up the possibility of new hegemonic relations.