The Law of Quantum Disclosure: Cryptanalysis, Academic Freedom, and Dual-Use Scientific Speech

Abstract

Quantum computing is forcing law, technology, and public policy to confront a new category of dual-use knowledge: cryptanalytic research that may advance science while accelerating the capacity to compromise public cryptographic infrastructure. For decades, the risk that a sufficiently powerful quantum computer could break RSA and elliptic curve cryptography (ECC) remained a largely theoretical concern. That era of theoretical comfort is ending; quantum computing is moving from theoretical risk toward practical consequence. Specifically, recent work in quantum algorithms, resource estimation, quantum error correction (QEC), and architecture-specific implementation suggests that cryptographically relevant quantum computers may be closer, and may require fewer resources, than earlier assumptions suggested. In April 2026, Google Quantum AI and collaborators released a white paper estimating resources for quantum attacks on elliptic curve cryptography used, for example, in cryptocurrencies, including Bitcoin, while using a zero-knowledge-proof mechanism to support verification of the reported computation without disclosing attack-enabling implementation details. The Article proposes a hybrid governance model: preserve a strong presumption of publication; adopt voluntary quantum cryptanalysis disclosure norms; recognize zero-knowledge-proof-backed verifiable nondisclosure as a legitimate scholarly publication mechanism; establish an advisory Quantum Cryptanalysis Review Board (QCRB); clarify export-control treatment of quantum cryptanalysis; require quantum-risk impact statements for federally funded research; and tie disclosure norms to post-quantum cryptography (PQC) migration readiness. These proposals should not be understood as advocating broad, restrictive regulation of quantum-computing technologies, which would be premature and could harm innovation. The objective should not be secrecy for its own sake, nor government control of quantum research. Rather, law and policy should encourage voluntary action, scientific self-governance, and cooperation across the quantum-computing ecosystem while reducing unnecessary public alarm, avoiding premature weaponization, and accelerating migration to quantum-resistant solutions and systems.