up:: For Press
Every figure and where it comes from
Every number this resource uses, with 3 things attached to each one: a wording that states it accurately, the document it came from, and a note wherever the figure carries a qualifier that gets dropped in retelling.
The third column is where most errors originate. A projection restated as a measurement, a draft schedule restated as law, and an expert survey restated as a forecast are the 3 most common, and each has a correct version that’s just as strong.
The short version:
- Three figures carry qualifiers that get dropped: the retirement dates are a draft, the $7.1 billion is a projection with stated uncertainty, and the probability ranges are a survey of opinion.
- One figure should never be pinned, because post-quantum adoption across internet traffic changes continuously.
- The strongest number in the whole subject is a comparison, from 20 million qubits to under 1 million across 6 years, with the runtime moving the other way, from 8 hours to less than a week.
- The most misused number is a qubit count, because a headline figure counts noisy physical qubits and the threshold is stated in error-corrected logical ones.
- Almost every figure below is freely checkable. Three are not: the Science paper on familial matching sits behind a journal paywall, and the Fox-IT DigiNotar report and the New Jersey appellate opinion in the Merck case are both marked in the table as documents this resource has not been able to obtain.
How far away is the machine?
| The figure | How to state it accurately | Source | What gets dropped |
|---|---|---|---|
| 20 million noisy qubits | The 2019 estimate of the resources needed to factor RSA-2048 in 8 hours, from a peer-reviewed analysis | Gidney and Ekerå, Quantum 5, 433, 2021, arxiv.org | It’s an estimate of a hypothetical machine rather than a specification of a real one |
| Under 1 million noisy qubits | The 2025 revision of that same estimate, roughly a 20-fold reduction in qubits over 6 years | Gidney, 2025, arxiv.org | The runtime went the other way, from 8 hours to “less than a week,” and the corpus quotes the qubit half far more often than the runtime half. Gidney makes “the same assumptions as in 2019” about the hardware, so the reduction comes from method changes rather than from better machines |
| 28% to 49% | The range of expert opinion on the chance of a cryptographically relevant quantum computer within 10 years | Global Risk Institute, Quantum Threat Timeline Report 2025, 26 specialists, globalriskinstitute.org | It’s a survey of expert judgment rather than a calculated probability, and its 2 authors work for evolutionQ Inc., a commercial post-quantum vendor |
| 51% to 70% | The same survey’s range for within 15 years | Same | Same |
| 1994 | The year Shor presented the method that breaks today’s public-key cryptography | Shor, presented 1994, journal version SIAM J. Computing 26(5), 1997, arxiv.org | The journal version is dated 1997, so both years are correct for different things |
| Faster than 1 µs per cycle | Real-time decoding on commercial accelerators, for the surface code to distance 11 and the color code to distance 9, the first real-time color-code decoding | Senior et al. (Google DeepMind and Google Quantum AI), submitted 8 December 2025, revised 11 March 2026, arxiv.org | Per-cycle decoding is not an end-to-end loop from qubits through the decoder and back. The distance carries the weight, since real-time decoding at distance 11 and at the distances a cryptographic machine needs are separated by most of the engineering that remains |
| 0.0104 against 0.0097 | Two error thresholds, a Mamba state-space decoder against a Transformer decoder, in simulated real-time scenarios that add error in proportion to assumed inference cost | Lee, Hur and Park, submitted 26 October 2025, arxiv.org | The comparison is against the paper’s own baseline rather than against a deployed model, and the pair comes from a simulated noise model rather than from hardware. On real Sycamore memory data the Mamba decoder matched the authors’ own Transformer. The durable idea underneath is that a slow decoder is itself a source of error |
| Low thousands of physical qubits | The scale of the largest machines actually built | Compare against the resource estimates above | A published qubit count is noisy physical qubits, and the threshold is stated in error-corrected logical qubits, which take many physical qubits each |
What is encryption protecting?
| The figure | How to state it accurately | Source | What gets dropped |
|---|---|---|---|
| Almost three-quarters of the world’s population | Online in 2025, in ITU’s own words: “almost three-quarters of the world’s population are now online” | ITU Facts and Figures 2025, itu.int | ITU describes the series as “annual global, regional and income-group estimates,” so this is modeled rather than counted. The report page carries the share and no population count, so a headcount needs the publication itself |
| 2.2 billion people | Still offline, “most of them in low and middle income countries” | Same | ITU adds that “progress is slowing,” which is the half that gets dropped when the connectivity figure is used to argue the world is coming online quickly |
| 28.9% of sampled configurations | The share of Nginx TLS configurations published on GitHub specifying an RSA key exchange with no forward secrecy | Balaji et al., 2026, arxiv.org | Four qualifiers, and the figure is misleading without them: the corpus is 8,443 configuration files scraped from public repositories rather than a scan of live servers; the 28.9% is a share of the 5,982 TLS-enabled server-block contexts that “form the core dataset for all subsequent analysis,” so “28.9% of 8,443” is wrong; 42.6% of those contexts use what the paper calls “likely non-production hostnames” and 2,919 files come from archived repositories; and the authors include a commercial post-quantum vendor and the bank that funded the study |
Which figures cover personal data?
| The figure | How to state it accurately | Source | What gets dropped |
|---|---|---|---|
| ~60% familial match | The share of genealogy-database searches for a person of European descent in the U.S. that the authors project will return a third cousin or closer | Erlich, Shor, Pe’er, and Carmi, Science 362(6415), November 2018, science.org | Two qualifiers, and both are load-bearing. It’s a projection rather than a measured rate, so “already turns up” is the wrong verb and this resource used it for months. And the population qualifier decides the rest, so stating the figure for everyone makes it wrong |
| 6.9 million people | Exposed in the 23andMe incident | Texas Attorney General, texasattorneygeneral.gov | The California Attorney General now sues the company as “Chrome Holding Co., formerly known as 23andMe” |
| 14,000 accounts | The number of accounts the attacker got into first, through credential stuffing | California Attorney General, oag.ca.gov | The Texas release carries the 6.9 million and not this number. California’s complaint says the threat actor accessed “about 14,000 customers’ 23andMe accounts” using “credential stuffing,” meaning credentials stolen in earlier breaches elsewhere and reused here. The gap between 14,000 and 6.9 million is the point, and dropping the smaller number loses it |
| 26 million+ people | Had contributed DNA to the 4 leading commercial databases by the start of 2019 | MIT Technology Review, technologyreview.com | The same analysis projected past 100 million within 24 months, which is a projection rather than a count |
| 147 million people | Exposed in the 2017 Equifax breach | Federal Trade Commission, ftc.gov | The FTC says “approximately 147 million,” and describes the stolen data as taken “mostly from consumers who had purchased products from Equifax such as credit scores, credit monitoring, or identity theft prevention services” |
| Nearly 90% of homebuyers | The share of U.S. homebuyers choosing a 30-year fixed-rate mortgage | Freddie Mac, myhome.freddiemac.com | Freddie Mac calls it “the product of choice for nearly 90% of homebuyers,” which is the share choosing at origination rather than the share currently holding one, and the “fixed-rate” qualifier is load-bearing |
| 6 years | The HIPAA Security Rule’s retention floor for compliance documentation | 45 CFR § 164.316, govinfo.gov | HIPAA sets no retention period for medical records themselves. § 164.316 is titled “Policies and procedures and documentation requirements,” and the 6 years runs on that compliance documentation. State medical-record retention is set separately and often runs longer, and the clinical facts stay true for a lifetime |
| Over 4 million BTC | Bitcoin sitting in addresses with exposed public keys, about 25% of all supply at the time of Deloitte’s analysis | Deloitte, deloitte.com | Deloitte writes “over 4 million,” so rounding it down to “~4 million” understates it: its components are circa 2M in p2pk plus 2.5M in reused p2pkh. The 25% is a snapshot rather than a current figure, and exposure here means the public key is visible rather than that the coins are currently at risk |
Which figures cover money?
| The figure | How to state it accurately | Source | What gets dropped |
|---|---|---|---|
| $7.1 billion | The projected cost of migrating priority U.S. federal civilian systems between 2025 and 2035, in 2024 dollars | ONCD, in OMB’s July 2024 report to Congress, OMB report | Four qualifiers: the projection is ONCD’s and OMB published it, it excludes national security systems, the report calls it an initial projection reflecting “a high, but expected, level of uncertainty,” and it can’t be scaled down to a single company |
| ~$100 billion | Estimated U.S. spending on Y2K assessment and remediation | U.S. Senate Special Committee, S. Prt. 106-42, govinfo.gov | An estimate rather than an audited total. The Committee relays the Commerce Department’s figure and prints competing U.S. totals of 150 to $225 billion from Gartner, and says the worldwide cost “may never be known” |
| ~$8.5 billion | The federal government’s share of that Y2K spending | Same | The Committee’s summary sentence says 8.34 billion, and the report does not reconcile the two |
| At least $575 million | The Equifax settlement with the FTC, CFPB, and states | Federal Trade Commission, ftc.gov | The settlement was structured to reach higher, and “at least” is the FTC’s own framing |
| ~$1.4 billion | Merck’s claimed NotPetya losses | Merck & Co., Inc. v. ACE American Insurance Co. (N.J. Super. Ct. App. Div., approved for publication May 1, 2023), opinion | A claimed loss in litigation that settled on undisclosed terms rather than an awarded amount. This Guide has not been able to obtain a readable copy of the opinion, so the figure stands unchecked here. The Insurance Journal report on the January 2024 settlement, which the corpus previously cited for the 1.75 billion in total limits above a 700 million in coverage” disputed by the 8 insurers still in the case |
| ~$9.14 billion | U.S. cyber insurance direct written premium in 2024, down about 7% | NAIC 2025 report on 2024 data, naic.org | The first annual contraction on record, which is the notable part |
| 850 billion | Projected global economic value created by quantum computing by 2040 | Boston Consulting Group, July 18, 2024, bcg.com | A consultancy projection to 2040, not a measurement. The same analysis projects a 170 billion market for hardware and software providers |
Which dates are the real deadlines?
| The date | How to state it accurately | Source | What gets dropped |
|---|---|---|---|
| After 2030 deprecated, after 2035 disallowed | The U.S. schedule for retiring today’s public-key cryptography | NIST IR 8547, initial public draft, csrc.nist.gov | It’s a draft, so the years are NIST’s stated intent and could change in the final. The 2030 deprecation applies only at 112 bits of security strength; at 128 bits and above the tables carry a single step, “Disallowed after 2035” |
| 2035 | The whole-of-government goal of mitigating quantum risk “as is feasible” | NSM-10, May 4, 2022, bidenwhitehouse.archives.gov | The hedge sits inside the operative sentence, which makes this the softest date in the field and the most quoted |
| January 1, 2027 | Post-quantum required in new U.S. national security system acquisitions under CNSSP 15 | NSA CNSA 2.0 FAQ, media.defense.gov | It reaches commercial vendors through procurement rather than only government systems |
| December 31, 2030 and December 31, 2031 | U.S. federal civilian key establishment, then digital signatures, for High Value Assets and high impact systems | Executive Order 14412, June 22, 2026, whitehouse.gov | Excludes national security systems |
| December 11, 2027 | Full EU Cyber Resilience Act obligations | Reg (EU) 2024/2847, eur-lex.europa.eu | It binds manufacturers worldwide, and it names no algorithm and sets no post-quantum date |
| End of 2030 | Australia’s exit from traditional public-key cryptography | ASD Information Security Manual, cyber.gov.au | Scoped to Australian government, defense, and suppliers handling protected data |
| 2028 | UK expectation for completed discovery and a migration plan | NCSC, March 20, 2025, ncsc.gov.uk | Advisory rather than statutory, and used by UK buyers as a vendor expectation anyway |
| 10, 25, 50, and 75 years | U.S. classification horizons | Executive Order 13526, archives.gov | The default is the number that gets dropped. §1.5(b) marks information for declassification “10 years from the date of the original decision, unless the original classification authority otherwise determines that the sensitivity of the information requires that it be marked for declassification for up to 25 years from the date of the original decision.” The 50 and 75 in §3.3 are automatic-declassification exemption paths for defined categories, and 75 needs a proposal “formally approved by the Panel,” the Interagency Security Classification Appeals Panel |
| August 13, 2024 | The date NIST finalized the first 3 post-quantum standards | NIST, nist.gov | Nothing. The single most useful date in the subject |
What does the precedent record show?
| The figure | How to state it accurately | Source | What gets dropped |
|---|---|---|---|
| 141 organizations across 20 industries | Intellectual property exfiltrated in a single documented campaign | Mandiant APT1, February 19, 2013, services.google.com | Each intrusion had to be worked by hand, which is what capped the number |
| 531 fraudulent certificates | Minted by the attacker in the 2011 DigiNotar breach | Fox-IT, “Black Tulip: Report of the investigation into the DigiNotar Certificate Authority breach,” 2012 | The figure rests on a document this Guide has not been able to obtain. The link the corpus has carried for it, enisa.europa.eu, goes to a different document: ENISA’s own 5-page position paper “Operation Black Tulip: Certificate authorities lose authority,” which writes about the Fox-IT investigation in the third person and contains no count. What ENISA does state is that “false certificates were created for hundreds of websites, including Google and Skype” |
| ~300,000 OCSP requests | Certificate-status requests from IP addresses in Iran in DigiNotar’s logs, which ENISA says “suggests that around 300.000 Iranian users were victims of MITM attacks” | ENISA, “Operation Black Tulip: Certificate authorities lose authority,” enisa.europa.eu | It’s a request count rather than a victim count, and ENISA says so in the same footnote: “the OCSP requests are only an indication, because not all browsers or clients make OSCP requests, and because OSCP requests could have been blocked or faked by attackers.” ENISA’s wording for the interception is plural throughout, reporting that Fox-IT “suggests in their investigation report that the cyber-attack had already started in mid-June and that for almost two months false certificates were used to eavesdrop,” so “using 1 of them” is not supported |
| 1943 to 1980 | The span of the Venona project, from the intercepts to the project’s close | NSA, nsa.gov | Reading began around 1946, so the gap between collection and decryption is the point |
Which figures keep moving?
Two values in this subject change continuously, and pinning either one dates a piece within months.
| The figure | Why it moves | What to do |
|---|---|---|
| Post-quantum adoption across internet traffic | It rises as browsers, servers, and networks deploy | Link the live dashboard rather than quoting a percentage: Cloudflare Radar |
| Qubit records | Manufacturers announce new machines regularly | The resource estimates are the stable comparison, and a raw qubit count says little without error rates and whether the result was independently reproduced |
Which figures belong to whoever said them?
A separate class: numbers that circulate in this field attached to a speaker or a vendor rather than to a study. Each is quotable with its owner named, and none is a finding.
| The figure | Whose it is | How to handle it |
|---|---|---|
| A Q-Day window of 2029 to 2030 | A vendor chief technology officer, stated at Quantum USA 2026 | A vendor estimate from a company selling post-quantum products. Attribute it, and set it against the published expert survey range rather than presenting it as a forecast |
| Migration taking 10 to 15 years, completing 2030 to 2035 | The same vendor speaker | A vendor’s projection of customer timelines. Attribute it |
| Post-quantum degrading network performance by up to about 1% | The same vendor speaker | A vendor performance claim. Attribute it, or source it to independent measurement |
| A Fortune-2000 enterprise running 68 to 75 security products | Ponemon Institute data, cited by a vendor at the same event | Secondhand citation of a research figure. Go to the Ponemon source before using it |
| Roughly half of a DOE supercomputer workload being acceleratable by a quantum computer | A DOE user-facility poll, cited by a named federal speaker | A poll cited secondhand. Attribute to the speaker and the poll |
| A 99.5% two-qubit gate fidelity | Rigetti, in 2 different senses | The same figure means 2 different things. 99.5% is an achieved median fSim result on Ankaa-3, an 84-qubit single-chip machine, reported December 2024. It is also a target Rigetti states for Cepheus-1-108Q, a 12-chiplet system generally available April 2026 and running at 99.1%. Ask which system and which gate type before quoting it |
| Up to 12× the wiring space | IBM, for its modular cryogenic module, 19 August 2026 | Two qualifiers travel with it, both inside IBM’s own sentence. “Up to,” so 12 is a ceiling rather than a measurement, and the baseline is named only as a category, “the most widely used IBM quantum systems,” which is not a system anyone can look up. A multiplier with no published denominator measures nothing |
| 97.5% readout fidelity | QuantWare, for its D-line processors | A two-product figure quoted as a processor specification. It is reached by pairing the processor with the company’s own amplifier, and the coherence and gate figures published beside it are reference-setup measurements from February 2024. Name the date and the configuration, or handle it as a vendor claim rather than a specification |
Source, IBM figures: IBM Quantum, “IBM Quantum Nighthawk r2,” Holger Haas, David McKay and Robert Davis, August 31, 2026, ibm.com, verified against the primary 2026-09-07; IBM, “IBM Connects Its First Modular Cryogenic Systems in Milestone Toward Fault-Tolerant Quantum Computing,” August 19, 2026, newsroom.ibm.com.
Source, vendor performance figures: Rigetti, “Rigetti Computing Launches 84-Qubit Ankaa-3 System; Achieves 99.5% Median Two-Qubit Gate Fidelity Milestone,” 23 December 2024; Rigetti, “Rigetti Announces General Availability of 108-Qubit System,” 7 April 2026, which states that the company “expects Cepheus-1-108Q to reach a median 99.5% two-qubit gate fidelity later this year”; QuantWare, “QuantWare releases Contralto-D and Soprano-D,” February 2024, quantware.com.
Source: Forum Global, “The Report: Quantum USA 2026,” Washington D.C., June 18, 2026. The publisher states that third-party figures, projections, intelligence-community characterizations, and vendor claims belong to the sources who advanced them and are not findings of Forum Global.
Questions people ask
Which of these numbers is the strongest? The pair from 20 million to under 1 million qubits across 6 years, because both analyze the same problem under the same hardware assumptions and the movement between them is the evidence. Quote the runtime with it, because it moved the opposite way, from 8 hours to less than a week. One caution on how to describe them: the 2019 estimate is peer-reviewed in Quantum 5, 433, and the 2025 revision is an arXiv paper with no journal version, so “2 peer-reviewed analyses” overstates it.
Which is the most commonly misused? A qubit count. A headline figure counts noisy physical qubits, while the threshold for breaking encryption is stated in error-corrected logical qubits, and each logical qubit takes many physical ones.
Can I say the government estimated the migration will cost $7.1 billion? Yes, with the scope attached: priority federal civilian systems, 2025 to 2035, excluding national security systems, projected by ONCD, and labeled in OMB’s report as an initial projection with high uncertainty.
Can I say encryption will be broken in 2030? No, and no source here supports it. The 2030 dates are retirement schedules for the old algorithms rather than predictions about a machine.
Is the 60% DNA figure true for everybody? It’s specific to people of European descent in the United States, which is the population the study analyzed, and it’s a projection of what searches will return rather than a measured rate. Generalizing it, or stating it as something already observed, makes the claim inaccurate.
Which sources can’t I get to? Three. The Science paper on familial matching sits behind a journal paywall. The Fox-IT DigiNotar report and the New Jersey appellate opinion in the Merck case both refuse automated retrieval and this resource has not obtained either, so the 531 certificates and the $1.4 billion are marked as resting on documents it has not read. Every other government document, court record, standard, and preprint listed here is freely accessible.
How often is this checked? Each page in this resource carries a last-verified date, and the draft schedules move as documents finalize.
Where to go next
- The primary documents behind every claim is the same material sorted by document rather than by number.
- Corrections and verification is how to report an error or verify a claim before publishing.
- What gets reported wrong covers the recurring errors and the accurate version of each.
- A timeline of the quantum transition puts the dated events in order.
- For Press is the full index.
Last verified 2026-09-17 · Maintained by Addie LaMarr, LaMarr Labs.