On 7 October 2026, Europol published its report, Harvest now, decrypt later. Its central premise is unsettling precisely because it is not about an attack that has to succeed today: an adversary can collect encrypted information now, retain it, and attempt to read it later if sufficiently capable quantum computers emerge.

For professional security teams, this is not a reason to declare cameras, alarms or access-control systems “broken”. Cryptographically relevant quantum computers do not yet exist, and their arrival date remains uncertain. But Europol’s intervention changes a useful part of the conversation. Encryption is no longer solely an IT concern around a live network session. It is also a question of whether data created by a security system in 2026 must still be confidential in 2031, 2036 or beyond.

That distinction matters. A routine clip overwritten after a few days has a different exposure profile from footage retained as evidence, a VIP movement record, an access-history export from a sensitive site, or an investigation file containing identities, floor plans and incident timelines. The security value of this material may expire slowly; the encryption protecting it may not.

Europol’s October signal: prepare before the threat is fully mature

Europol developed the report with Universidad Carlos III de Madrid (UC3M), through its Advisory Group on Research and Development. It examines the technical feasibility and criminal implications of collecting encrypted data for future decryption, as well as the types of data and stakeholders most exposed. In a related 7 October news release, Europol urged early action on quantum-related risks affecting sensitive information and cryptocurrencies.

The important message for a facilities-security director, integrator or compliance lead is not “replace every endpoint”. It is more practical: identify which information has a long confidentiality lifetime, where it travels, and whether the systems handling it can change their cryptography without an operational rebuild.

That framing aligns with the direction already set by standards bodies and public authorities. In August 2024, NIST released its first three finalised post-quantum cryptography standards and said they were ready for immediate use, while encouraging administrators to start transitioning because full integration takes time. In June 2025, EU Member States adopted a coordinated roadmap calling for the transition to begin by the end of 2026, with high-risk use cases moved as soon as possible and no later than the end of 2030.

Security data is not all equal—and that is the point

Professional security produces a mixture of fleeting operational telemetry and enduring sensitive records. Treating both categories identically makes neither security nor budgetary sense. “Harvest now, decrypt later” is most relevant where captured data could remain useful to an adversary well after it was first transmitted or archived.

Data with a long shelf life deserves a different review

Examples include investigation footage and related exports; biometric templates; employee, contractor and visitor identity records; long-term badge histories; executive-protection schedules; site layouts; alarm-response procedures; critical-infrastructure incident reports; and evidence shared with legal, insurance or public authorities. In many environments, the sensitivity of these records may outlive the expected service life of the camera, controller or software version that generated them.

This does not mean every retained video file requires the same technical controls. It means retention policies should not be discussed only in terms of storage capacity, evidential need and privacy minimisation. They should also include a confidentiality horizon: if this file were exposed years from now, would that still create harm?

For teams responsible for video surveillance, the question reaches beyond cameras themselves. It covers the video-management server, archive encryption, operator workstations, mobile viewing applications, cloud storage, exported clips and the remote-support route used to maintain the estate. A secure lens is not meaningful if the associated records, credentials or management traffic are not managed through the same lifecycle lens.

The hidden dependency: public-key cryptography across physical security

Connected physical-security systems rely on cryptography more often than their physical appearance suggests. A web console may use TLS. A remote-maintenance channel may use a VPN or SSH. A cloud service may depend on certificates and public-key key exchange. Firmware authenticity, software updates and device identity can depend on digital signatures.

That is why a simple product label such as “encrypted” is no longer enough for a procurement file. Buyers need to understand where encryption is being used and, crucially, whether the supplier has a credible route to replace vulnerable algorithms and certificates over time.

The issue applies to cloud-managed cameras, access-control servers, visitor-management platforms, intercoms, alarm-monitoring links and supervisor applications. It is also relevant to connected field equipment operating over cellular links. For instance, a GPS tracker can create a sensitive location history, while the device, portal, user account and communications path each form part of the confidentiality picture.

Legacy estate makes the task harder. Physical-security devices are often installed for long cycles; they may use embedded firmware, proprietary protocols, limited processing power or supplier-controlled cloud connections. A migration that is relatively straightforward in mainstream IT can therefore become a multi-year programme involving equipment inventories, maintenance windows, firmware support and contractual commitments.

From cyber checklist to security-design decision

In 2023, CISA, NSA and NIST jointly urged organisations—particularly critical-infrastructure operators—to start quantum-readiness planning. Their early actions included building a cryptographic inventory, engaging vendors and assessing supply-chain dependencies on quantum-vulnerable cryptography. Those are directly applicable to professional security infrastructure.

Start with visibility, not a “quantum-safe” shopping list

A useful first step is to add a small number of questions to the existing asset and supplier review:

• Which systems transmit, process or retain security information that must remain confidential for years?
• Where do those systems use TLS, VPNs, SSH, certificates, public-key key exchange or digital signatures?
• Which elements are owned and operated locally, and which depend on cloud or third-party support services?
• Can the supplier update cryptographic components through supported firmware, software and certificate-management processes?
• What is the supplier’s stated post-quantum migration roadmap, including for deployed—not only newly sold—products?

This is an inventory exercise before it is a purchasing exercise. A security department may need help from IT, network, privacy, procurement and legal colleagues to answer it properly. That collaboration is a strength: the same system may be an operational security tool, a personal-data processor, a network endpoint and a source of potential legal evidence at once.

Crypto-agility is the practical procurement criterion

NIST describes crypto-agility as the ability to replace or adapt cryptographic algorithms in protocols, software, hardware and infrastructure without disrupting operations. For professional security, this is more useful than demanding a vague “quantum-proof” claim.

A crypto-agile system should have maintainable firmware, documented update paths, support for managed certificates, a clear account of cryptographic dependencies and an architecture that can evolve. It should not require a site-wide hardware replacement simply because a certificate mechanism or key-exchange algorithm needs to change. Evidence systems, in particular, need carefully controlled upgrades that preserve availability, auditability and chain-of-custody requirements.

This is also relevant when assessing intrusion alarm infrastructure. Panels, communicators, monitoring links and installer-access channels may have different upgrade capabilities. One modern cloud portal does not automatically make the whole operational chain agile.

TLS 1.3 is a timely, concrete checkpoint

While post-quantum migration will take time, some current hygiene questions are already clear. The UK National Cyber Security Centre states that TLS 1.3 is the current TLS version and the only current version expected to support post-quantum cryptography. It advises disabling TLS 1.0 and 1.1, and planning migration from TLS 1.2 to TLS 1.3 where necessary.

For connected security estates, that gives teams a visible review point: web administration interfaces, VMS dashboards, APIs, cloud-management portals and remote-maintenance services should be checked for their TLS posture. This is not a claim that TLS 1.3 alone solves the quantum challenge. It is a sensible indicator of whether an environment is being maintained with future cryptographic transition in mind.

The same disciplined thinking belongs in authorised counter-surveillance equipment programmes. Technical sweeps and physical controls may reveal unauthorised devices or transmissions, but long-term protection also depends on how legitimate security data is stored, transmitted and accessed. Physical and digital exposure should not be governed as separate universes.

What not to conclude from the quantum discussion

First, quantum computing has not made today’s CCTV archives readable overnight. NIST is explicit that cryptographically relevant quantum computers do not yet exist. The appropriate response is planned risk reduction, not fear-based purchasing.

Second, post-quantum cryptography is not the same as quantum cryptography. PQC refers to new cryptographic algorithms designed to run on conventional systems and withstand future quantum attacks; it is not a requirement to deploy exotic quantum hardware at every site.

Third, security managers should not trade proven operational controls for fashionable language. Access governance, patching, supported firmware, secure remote access, sound retention rules and clear incident procedures remain essential. PQC readiness adds a longer-term dimension to these disciplines; it does not replace them.

The 2026 decision is about optionality

Europol’s October report is best read as a prompt to preserve options. Systems procured and installed today may still be gathering sensitive information when cryptographic expectations have materially changed. Organisations that know their dependencies, classify data by confidentiality lifetime and obtain meaningful supplier commitments will be able to migrate methodically. Those that cannot identify where their cryptography lives may face rushed, costly choices later.

Before replacing equipment, establish which security systems transmit or retain sensitive data, how long that material must remain confidential, and whether each supplier can support future cryptographic migration. In the age of “harvest now, decrypt later,” that is becoming a core part of responsible physical-security design.

Sources

• Europol — Harvest now, decrypt later (7 October 2026)
• Europol — Early action on quantum threats (7 October 2026)
• NIST — First finalised PQC standards (13 August 2024)
• European Commission — Post-quantum cryptography policy and roadmap
• CISA, NSA and NIST — Quantum-readiness planning guidance
• UK NCSC — Using TLS to protect data