August 2016 The People’s Republic of China (PRC) launched the Quantum Experiments at Space Scale (QUESS) from its Jiuquan Satellite launch center in its remote north central desert lands. The launch was highly praised by scientists the world over for taking a significant step forward in the field of quantum computing, while in mainstream tech news the launch was more characterized with awe than perhaps was warranted. Their headlines touted the tantalizing promise of 100% secure, unhackable communications as if The Future had arrived, but the reality was that QUESS was important for being a First in History, not for any game-changing technological breakthrough – and it matters that the US domestic press characterize China accurately. It matters at least because the PRC officially advocates using the psychology-shaping power of Mass media for information warfare during any military conflict. So it goes that in a hyper-connected, social-media driven information environment (where tweets can galvanize a revolution, after all), the battle to shape the court of world public opinion’s perception of a State and its military begins long before shots are fired; one at a time – one blog entry, one listicle, one YouTube post or re/tweet – the narratives of a State’s global leadership, its true strategic objectives, or its rightful place in the world order, all hinge on how the content producers of the web shape those stories. Thus, while tech articles, blogs, and forums can opt to myopically congratulate the PRC, and unwittingly bolster the narratives spun from Xi Jinping’s Chinese Dream (中国梦), US defense circles meanwhile need discern the significance of QUESS and contextualize the (non)plausibility of “100% secure, unhackable communications.”

The purpose of QUESS is conducting experiments aimed at refining Quantum Key Distribution (QKD), which uses the principles of quantum mechanics to securely distribute encryption keys; once distributed, the keys operate the same way as those currently in use today, encrypting data before it is routed over traditional, extant networks. QKD was initially demonstrated in 1995 under Lake Geneva and in the years since, scientists have pushed the distance at which cryptographic keys can be distributed. Up until QUESS, that distance was on the order of 100’s of kilometers over fiber optic cable. The QUESS launch is significant because it is the first known launch of a space-based QKD testing platform, opening up the possibility of reliable transmission distance at thousands of kilometers, and eventually to the entire globe. While there are some signs of trouble in China’s space program we must take them at their word that they intend to achieve full global coverage by launching a functional QKD satellite constellation by 2030.

“Security” in computing has always been more a goal than an actual achievable status, yet the premise behind theoretically unhackable communication’s is based on solid science. QKD is designed off of Protocol BB84, in which quantum bits, called “qubits” are sent from a Sender to a Receiver over an insecure network. The two keys are copies of each other, and due to the nature of quantum mechanics, any change to one key, regardless of its physical location, is instantaneously mirrored by the second key. As such, it is impossible for an Eavesdropper intercepting the key mid-transmission to know the state of the Sender’s copy; the Eavesdropper could measure/observe the intercepted key to try learning its contents, but in doing so would fundamentally change the physical nature of both keys. Thus, if the Sender were ever to observe a change in their key, they would know the pair had been compromised; the Sender and intended, legitimate Receiver would then cancel the operation, discard the key pair, and start over.

The problem with the BB84 protocol, the QKD scheme built on top of it, and the consumer privacy advocates’ faith in them both, isn’t the science behind the technology. The problem is in assuming that the attacker always values his concealment to such a degree that his only rational course of action is persistent non-interference in the key distribution process. There is no reason to assume that a hostile nation-state wouldn’t intentionally disrupt all quantum key distribution transactions. If observing and/or measuring an intercepted key pair renders it invalid and the system must start over again, then the military solution is find a way to consistently compromise the integrity of every key pair, rendering the system useless. The emphasis here is on the military because in the private sector, the modern assumption underlying cybercrime is that data can be worth so much money (or social leverage or political leverage) that no serious actor would get into cybercrime simply to deny, degrade, or destroy data. In the cyber battlespace however, not only is QKD not tantamount to 100% secure, unhackable communications, but is subject to the same military targeting methodology used against classical computer networks and combat systems today.

The QUESS launch doesn’t equate to the blogosphere’s touted 100% secure, unhackable communications because key distribution and encryption are just two links in a multi-link system in which there are much more attractive attack vectors requiring far less effort or risk. In the uninterrupted, frictionless battlespace, military applications are treated like one, inseparable sequence resulting in an assured, repeatable outcome. In the real world, disruptive weapon systems are neutralized exactly by attacking the sequence of interlocking technologies required to make the weapon system effective. If an adversary missile system is stealthy and has greater range than your own, you introduce as much friction into that system as possible. You attack the computer network that launches it, or the satellite that precision guides it; if the missile needs a certain size radar cross-section to target effectively, you test ways to distort or significantly reduce your radar signature. From a military point of view, QKD is no different. If consistent, total interference in the key distribution process proves infeasible, then the satellite that serves up those key pairs becomes the target. If the satellite cannot be physically targeted for destruction, then you look at ways to deprive its solar panels and starve it of electricity. There are many strategies for physically penetrating an enemy fortress – the same is true for digitally penetrating cyberspace.

Perhaps even more damning than a tactical attack on QKD is assessing it within the larger context of the vulnerabilities of the cyber domain itself. Again assuming a military always assesses a weapon system’s full chain of technologies and processes for exploits, then a PRC-dominated QKD system is still only as reliable as the operators using it. Jump forward to 2030, give them the benefit, and assume that Beijing can securely distribute quantum encryption keys that cannot be broken. Can they guarantee that by 2030 their average Soldier will be any less susceptible to phishing attacks and won’t click on links embedded in unsolicited emails? The human interface has long been the greatest vulnerability in cybersecurity, so as long as Soldiers, Scientists, and Statesman alike continue inserting infected removable media into government computers, or recycling their same passwords between multiple accounts, then just how will any system every achieve “100% secure, unhackable communications,”? Thus, just like a comprehensive plan to disrupt ever stage of a missile’s launch, a successful cyberattack may well allow the QKD scheme to operate largely intact, while focusing instead on exploiting other, more accessible vulnerabilities in the security ecosystem.

There is no doubt that QUESS is a strong step forward toward a formidable technology, nor that QKD (and for that matter, quantum computing, and quantum-resistant algorithms) will become the norm in the decades ahead; quantum computing is the future. The central problem at the heart of the Tech world’s hyperbole is that Security is a concept and a goal; it is something more nearly perfected, but never truly achieved. Suggesting an adversary is on the cusp of achieving it may be intentionally simplistic for the sake of convenience and article length, but doing so also feeds several overblown, national narratives of the coming Post-American world, that the West is irreversibly in decline, that modernity will no longer resemble Euro-American norms, or that East and South Eurasian ownership of the 21st century is already well underway. While those narratives may yet still come true, QUESS is certainly not clear-cut evidence for their veracity. Chinese QKD will assuredly challenge defense planners in isolation, but contextualized and then picked apart, it will not prove insurmountable. That is the reality behind the PRC’s QUESS launch, and it affords us all a quantum of solace.