QUANTUM-SAFE CYBERSECURITY IN ENERGY SYSTEMS

1. Introduction

Quantum-safe cybersecurity in energy systems concerns the technological and legal measures required to protect electricity grids, generation facilities, substations, smart meters and energy-market infrastructure against cyber threats created by future quantum computers. Modern energy infrastructure depends heavily on public-key cryptography for authentication, digital signatures, encrypted communications and software updates. A sufficiently powerful fault-tolerant quantum computer could undermine important forms of existing public-key cryptography.

The principal response is post-quantum cryptography (PQC)—cryptographic techniques designed to remain secure against attacks using both conventional and quantum computers. The UK's National Cyber Security Centre (NCSC) states that large-scale quantum computers could defeat mathematical problems underlying existing public-key cryptography and recommends systematic migration to PQC.

2. Importance for Energy Infrastructure

Electricity systems constitute critical infrastructure because cyber disruption can affect generation, transmission, distribution and system balancing simultaneously. Quantum-related vulnerabilities are particularly important for SCADA systems, industrial control systems (ICS), digital substations, smart grids, distributed-energy platforms and remote-control communications.

A significant concern is the long operational lifetime of energy equipment. Some grid assets remain operational for decades, meaning cryptographic technology incorporated today may still be operating when quantum capabilities have advanced considerably.

The NCSC specifically identifies industrial-control protocols as a difficult area for PQC migration because legacy protocols may not even support modern cryptographic practices.

3. Legal and Regulatory Framework

Quantum safety increasingly fits within existing legal obligations concerning cybersecurity and resilience rather than constituting an entirely separate branch of law.

In Great Britain, the Network and Information Systems Regulations 2018 (NIS Regulations) establish cybersecurity responsibilities for operators of essential services. Ofgem regulates relevant electricity and gas operators, including transmission operators, distribution networks, system operators, major generators and interconnectors, and can take enforcement action for non-compliance.

As quantum threats become technically foreseeable, reasonable cybersecurity governance may increasingly require utilities to identify cryptographic dependencies, assess long-term vulnerabilities, manage suppliers and establish migration strategies.

4. Post-Quantum Migration

Quantum-safe governance should involve cryptographic inventories, risk classification, crypto-agility, secure key management, supply-chain controls, incident planning and staged replacement of vulnerable systems.

The NCSC's current roadmap establishes three important milestones:

2028: complete discovery and assessment and establish an initial migration plan.

2031: migrate the highest-priority systems and develop a detailed roadmap.

2035: complete PQC migration across systems, services and products.

For energy companies, migration must be carefully coordinated because replacing cryptography in operational technology cannot compromise grid availability or safety.

5. Case Law

R (British Telecommunications plc) v Secretary of State for Digital, Culture, Media and Sport [2022] EWCA Civ 1

Facts: Telecommunications operators challenged aspects of the UK's regulatory framework implementing cybersecurity requirements for essential and digital services.

Legal Issue: The proceedings concerned the interpretation and operation of statutory cybersecurity regulation derived from the NIS framework.

Judgment: The litigation illustrates judicial supervision of governmental implementation of cybersecurity obligations affecting critical network operators.

Legal Principle / Ratio: Cybersecurity requirements imposed upon operators of important infrastructure must operate within the statutory framework and remain subject to ordinary principles of public-law legality.

Significance: Although not a quantum-computing case, it demonstrates that future quantum-resilience requirements imposed upon regulated infrastructure operators would remain legally reviewable.

Lloyd v Google LLC [2021] UKSC 50

Facts: The claimant sought damages concerning Google's alleged collection and use of browser-generated information relating to millions of iPhone users.

Legal Issue: Whether representative proceedings could recover damages under data-protection legislation without proving individual material damage or distress.

Judgment: The UK Supreme Court rejected the proposed damages claim in its presented form.

Legal Principle / Ratio: Compensation under the relevant legislation required proof of legally recognised individual damage rather than merely establishing unlawful processing.

Significance: The case illustrates the relationship between technological systems, information protection and legal accountability. In quantum-safe energy infrastructure, compromised consumer or operational information could similarly generate regulatory and civil-law consequences.

6. Governance and Liability

Energy companies should treat quantum migration as a long-term governance responsibility rather than waiting until cryptographically relevant quantum computers actually exist. Boards and regulators may need documented risk assessments, procurement standards, vendor obligations, migration schedules and testing requirements.

Ofgem already possesses enforcement mechanisms for breaches of NIS cybersecurity duties, demonstrating that cybersecurity resilience forms part of enforceable energy regulation rather than voluntary technical practice.

7. Conclusion

Quantum-safe cybersecurity represents the next stage of critical-energy-infrastructure protection. Its central objective is to ensure that electricity networks remain confidential, authentic, available and controllable despite advances in quantum computing. Effective regulation combines post-quantum cryptography, crypto-agility, resilient operational technology, supply-chain governance and regulatory accountability. The legal challenge is therefore anticipatory: energy operators must modernise long-lived infrastructure before quantum vulnerabilities mature into operational threats.