up:: For Policymakers MOC
What a city council member needs to know
You cannot direct a single agency to do any of this, and that turns out to matter less than it sounds.
What a mayor needs to know covers the executive actions. This page covers the two things a council holds that no mayor does: the power to create a record, and the power to make it permanent.
Not legal advice
This is general education about available authority rather than legal advice. What a particular council may do is a determination for its own counsel and its own charter.
What is the situation in 5 sentences?
Encryption protecting data in transit today can be recorded now and decrypted years later, once a sufficiently capable quantum computer exists, so records with long confidentiality lives are exposed the day they travel rather than the day the machine arrives. Federal agencies carry a dated migration mandate. No mandate at any level reaches your city. The systems your constituents deal with, meaning schools, the public hospital, benefits, courts, transit and vital records, are all in that uncovered space. And most of your city’s current cryptographic posture was decided by vendors rather than by anyone the council can summon.
Why is the council’s power the record rather than the directive?
Because a mayor can act and a council can make acting necessary, and on this issue the second one has proven scarcer.
Nothing here is being deliberately ignored. This work has no natural home, sitting across incident response, privacy and IT operations while belonging to none of them, so it drifts rather than getting refused. A drifting item does not need an opponent to defeat it. It needs someone to ask about it on the record, once, with a date attached.
And the council holds the more durable instrument. A mayoral directive ends when the administration does. A reporting requirement adopted by the council keeps producing answers through every subsequent administration, which on a risk measured in decades is the difference between a gesture and a record.
What is the one question with no good answer?
“Which federal, state or city requirement obligates this city to inventory or migrate its cryptography?”
There is no affirmative answer today. OMB M-26-15, the federal migration directive, is addressed “TO THE HEADS OF EXECUTIVE DEPARTMENTS AND AGENCIES” and carries exactly one explicit exclusion, for national security systems. The words local, tribal, municipal and territorial appear zero times in it.
Source: OMB, M-26-15, June 24, 2026, M-26-15 PDF.
Ask it in a hearing and the answer is on the record either way, which is the entire point. It takes 30 seconds and it costs nothing.
What to do when the answer is “we follow federal guidance”
That is the answer you will most likely get, and it is not true of your city. Federal guidance binds federal agencies. A city files no plan, answers to no phase date, and appears in no scope section.
The follow-up that lands: “Which specific instrument are we following, and does the city file anything under it?” A city following federal guidance voluntarily is a reasonable position and it is a different claim from being covered by it. Getting that distinction onto the record is more useful than any commitment made in the same hearing.
What can a council actually adopt?
A reporting requirement, which is the council’s native instrument and the right shape for this.
A mandate telling agencies to migrate would commit the city to milestones its vendors control, which is how these efforts turn into documented non-compliance. A reporting requirement commits the city to knowing, which is both achievable and the actual prerequisite.
The three things worth requiring an annual report on:
- What the city operates itself, as distinct from what it buys. This is the only set a city decision can change directly, and most cities cannot currently name it.
- What vendors have stated in writing about post-quantum support and their dated plans, gathered through the procurement review the city already runs.
- When the city last measured its public-facing posture, which is measurable from outside by anyone using public records and ordinary connections.
None of the three requires a cryptographer, an appropriation or a new position. All three are administrative work an existing technology office can do, and the reporting requirement is what makes them happen on a schedule rather than when someone remembers.
Drafting text for the procurement side is at What can a city actually do.
When is the moment?
Budget season, at the technology office’s hearing.
The question fits naturally into an annual technology budget review, it does not require a special hearing, and the budget context is what makes the follow-up land: the city is spending money on systems whose cryptographic posture nobody has established, and establishing it costs nothing.
Why does this pay off for you?
Because the asymmetry runs harder for an oversight role than for an executive one.
Asking costs nothing and cannot be attacked. There is no appropriation to defend and no program to name. It is a question at a hearing you were already attending.
Nobody is defending the gap. There is no organized opposition to asking what the city operates and what its vendors have said, which is rare on anything touching technology.
A reporting requirement outlasts the administration that would have issued a directive. This is the council’s structural advantage and it is worth using deliberately. On a risk measured in decades, the instrument that survives turnover is worth more than the one that moves faster.
It is legible to constituents without translation. Your public hospital’s records, your schools’ student files, your constituents’ benefits data. The question is not abstract and it does not require explaining quantum computing to anyone.
The first-mover position is unclaimed. As far as this Guide can establish, no US city has adopted a reporting requirement of this shape or published a post-quantum baseline of its own infrastructure. First at something checkable, for the cost of a hearing question and a short local law.
And if it surfaces later, the record is the difference. If long-lived city records are found to have traveled under retired cryptography, the question asked will be what was known and when. A council that asked in 2026 has a transcript. A council that did not was never told, which is a worse position to explain than having asked and been given a bad answer.
Claim the question, never the outcome
“First council to require annual post-quantum reporting” is checkable. A claim about the city being quantum-safe is neither, and it belongs to the administration rather than to the council in any case.
What should I ask at the hearing?
Six questions, answerable without technical background, in the order that builds.
- Which federal, state or city requirement obligates this city to inventory or migrate its cryptography?
- Which systems do we operate ourselves, as opposed to buy, and can you name them?
- For our largest services, who actually operates the infrastructure, and is that written in the contract?
- What does city email run through, and have we asked that provider about post-quantum support?
- Which of our systems or equipment cannot receive a cryptographic update at all?
- When did we last measure our public-facing posture, and what did it show?
Question 4 is the one most likely to surface something. Published measurement finds the email lane running far behind the web on the same estates, and it is the lane almost nobody checks. A fuller version of all 6, with what a substantive answer and a deflection each sound like, is at What should I ask in a hearing.
Which city systems should I ask about by name?
| System | Why it’s the worst case |
|---|---|
| The public hospital or health system | Clinical records with lifetime sensitivity, often on self-operated infrastructure |
| Schools | Student records, health and disciplinary files, held from childhood forward |
| Benefits and social services | Household financial data on the most vulnerable constituents |
| Courts and corrections | Sealed records, juvenile files, protected identities |
| Vital records | Birth, death, marriage. Permanent by definition |
| Police and emergency dispatch | Criminal justice information, which carries its own federal obligation |
Ask about the health system first if your city operates one. Self-operated infrastructure is where a city decision changes the answer directly, and it is the one place an administration cannot answer by pointing at a vendor.
Questions people ask
Is this urgent or is it a 2035 problem? The exposure that matters is records with long confidentiality lives, and those are traveling now. See Harvest Now Decrypt Later.
Isn’t this the administration’s job? Executing it is. Establishing that it is happening is oversight, and nothing on this page asks the council to run anything.
Can a council mandate this? Charters vary and a mandate is the wrong shape regardless, because it would commit the city to milestones its vendors control. A reporting requirement is achievable and durable.
What if the technology office says they are already on it? Ask when the report will exist and what it will contain. An office genuinely on it will welcome the deadline.
Does this cost money? The 3 reporting items cost staff time. Nothing on this page commits the city to a migration program.
Is any council doing this already? This Guide does not track municipal legislative activity comprehensively. If a council has adopted something not reflected here, that is a correction worth sending. See Corrections and verification.
Where to go next
- What a mayor needs to know covers the executive actions your questions would prompt.
- What can a city actually do is the operational version with the procurement language.
- What should I ask in a hearing covers oversight questions in depth.
- What a state legislator needs to know covers the level that can reach your city with funding conditions.
- What is not legislated yet places the municipal gap among the others.
- For Policymakers MOC is the full policy route.
Last verified 2026-08-10 · Maintained by Addie LaMarr, LaMarr Labs.