For chief officers, heads of digital and communications, control room and resilience leads in police, fire, ambulance, coastguard and civil protection, and the suppliers of their radios, networks and control room systems
Be ready when the authority, the inspectorate or the national network programme asks.
In fifteen minutes you will know which incident, patient and intelligence records are already exposed to harvest now, decrypt later collection, what the TETRA disclosures of 2023 and 2025 changed, which NIS2, CER and NCSC dates apply to a blue-light service, and the first 90 days of a plan your chief officer team or authority can sign.
Step 1 of 5
An adversary does not need a quantum computer to start on a blue-light service. It records encrypted radio, data and dispatch traffic now and reads it when one arrives. Emergency services hold two kinds of long-lived secret: the personal data of callers, patients, victims and witnesses, kept for years or decades under police and health retention rules, and the keys and identities of the network itself, which outlive every handset on it. A third exposure is sharper here than anywhere else. A forged dispatch, a spoofed group call or an injected status message during a live incident does its damage in minutes.
| Record type | How long it is kept | Confidential until, if created in 2026 |
|---|---|---|
| Police records on serious offences and public protection matters (MoPI Group 1) | Until the subject is deemed to have reached 100 years of age, reviewed every ten years | The 2090s for a subject in their thirties today |
| Children's health records, including ambulance patient records (NHS records codes, England and Wales) | Until the 25th birthday, or the 26th if the patient was 17 when treatment ended | 2051 for a child born in 2026 |
| Adult health records, including ambulance patient report forms | 8 years after the last contact; 20 years for mental health records | 2034, or 2046 |
| ANPR read data in the National ANPR Service | 12 months nationally and 90 days locally, unless retained for an investigation | 2027; the live link matters more than the archive |
| TETRA and MCX network keys, radio identities and firmware signing keys | The life of the network; 2025 research found one network key shared across every algorithm a network supports | Airwave shutdown has no published date; ESN mobile services run to 2031 |
Durations from the College of Policing's Management of Police Information guidance, the Records Management Code of Practice for Health and Social Care 2022 (the England code sets the same periods), the National ANPR Standards, version 3.5, and Midnight Blue's 2025 TETRA research. Check the retention schedule your own force, service or trust publishes.
CAD, 999 and 112 call handling, records systems and the links between them authenticate with public-key certificates and carry caller location, patient detail and intelligence in sessions that can be recorded today. Around 200 control rooms will sit on ESN in the UK alone.
You will know which dispatch, records and call-handling systems hold the longest-lived data, and which certificates and PKI roots need ML-DSA roadmaps first.
TETRA air interface encryption runs on 80-bit stream ciphers designed in the 1990s, and TEA1 was shown in 2023 to reduce to a key a laptop can brute-force. Mission-critical push-to-talk, video and data on LTE and 5G key with public-key cryptography under 3GPP TS 33.180. Nothing moves until both ends of a link and the national operator move.
You will know which keys, identities and inter-system interfaces depend on the national programme, the operator or the radio vendor, and what to ask each of them for.
Body-worn video, ANPR cameras, drone command links and vehicle telematics sign and encrypt in firmware that is replaced on a five to ten year cycle. Evidence integrity rests on signatures a quantum computer will forge.
You will know which device fleets can take a new algorithm in firmware and which will be replaced before 2035 anyway, so the money goes where it changes the outcome.
Free readiness check
Eight questions mapped to what NIS2 and the CER Directive, the NCSC timeline, your national network programme and your authority or board will ask. You get a score, your top three priorities and the next step that closes your biggest gap. Nothing is sent anywhere.
Start the checkStep 2 of 5
Midnight Blue publishes TETRA:BURST on 24 July: five vulnerabilities, including a TEA1 key that reduces to a trivially brute-forceable size. In November, ETSI's TETRA committee agrees to publish every air interface algorithm.
ETSI publishes TEA Set A and Set B in February. The NCSC sets 2028, 2031 and 2035 in March, and the EU roadmap follows in June. In August, 2TETRA:2BURST shows an end-to-end cipher reduced to 56 bits and one network key shared across algorithms.
CISA lists networking and radio hardware as still transitioning in January. Member States identify critical entities under the CER Directive by 17 July. The Commission proposes the EU Critical Communication System on 30 September, naming post-quantum encryption. NIST IR 8547 is final in October. National PQC roadmaps are due across the EU by the end of the year.
The NCSC milestone: discovery done, migration goals set, an initial plan in place and suppliers told what you need from them.
EU high-risk use cases migrated by the end of 2030, and the first EUCCS stage starts on 1 December 2030. NIST deprecates RSA and ECC after 2030. The NCSC's highest-priority migration is complete by 2031, the year the ESN mobile services contract runs to.
NIST disallows quantum-vulnerable algorithms in 2035. The NCSC timeline and the EU roadmap both end there. Every Member State is connected to EUCCS from 1 December 2036.
You show: A cryptographic inventory across control room, records, network interfaces and field devices, with migration goals and an initial plan.
You show: A policy on cryptography and encryption, a named migration lead and quantum cryptanalysis in the risk register your management body has approved.
You show: The algorithm set each network runs, TEA1 disabled, keys rotated, and the MCX key management roadmap from the national programme or operator.
You show: PQC roadmaps on file from the radio, control room, body-worn and drone vendors, with clauses in the next contract change.
UK services. Airwave still carries most blue-light voice while ESN is built. The July 2026 business case extends the EE/BT contract to 2031, sets no shutdown date and notes that the CMA charge control on Airwave ends in 2029, so plan on both networks running into the 2030s. The NCSC timeline sets the pace for everything else: discovery and a plan by 2028, highest-priority migration by 2031, complete by 2035. Police forces, fire and rescue authorities, ambulance trusts and the Secretary of State for maritime and coastal emergencies are Category 1 responders under the Civil Contingencies Act 2004. Read the NCSC position explained.
NIS2 applies to public administration entities of central government, to regional entities where a Member State's risk assessment says disruption would be significant, and to local bodies only where a Member State chooses. Entities working in public security, defence or law enforcement can be kept outside it, so a police force and an ambulance service in the same country may face different obligations. The CER Directive names public administration as one of eleven sectors and asked Member States to identify critical entities by 17 July 2026. The EUCCS proposal of 30 September 2026 names post-quantum encryption among the technologies the system should integrate, with interconnection in three stages from 1 December 2030; BroadWay, the Horizon 2020 pre-commercial procurement that ran from May 2018 to January 2023 with eleven buyers in eleven countries, proved the interoperable broadband model it builds on. Read the NIS2 analysis.
FirstNet, created by the Middle Class Tax Relief and Job Creation Act of February 2012 with USD 7 billion and 20 MHz of Band 14 spectrum, carries public safety broadband in all 50 states, five territories and the District of Columbia. CISA is the Sector Risk Management Agency for the Emergency Services Sector, which covers law enforcement, fire and rescue, emergency medical services, emergency management and public works. CISA's January 2026 product categories list shows networking and radio hardware still transitioning to PQC, and NIST IR 8547, final in October 2026, deprecates RSA and ECC after 2030 and disallows them after 2035. CISA Emergency Services Sector
ETSI published the TETRA algorithms in February 2025, so the question of which algorithm set a product runs now has a public answer. CISA's product categories list is the closest thing to a buyer's checklist for networking and telecommunications hardware. Expect NIS2 supply chain measures, ESN assurance and EUCCS accreditation to ask for PQC roadmaps on the record. Read the 5G vendor readiness analysis.
What the standards bodies, programmes and researchers have put on the record.
Publishes TS 104 053-1 and 104 053-2, the TETRA encryption algorithms TEA Set A and Set B, carrying out the November 2023 decision to open them.
Source: ETSI →Presents 2TETRA:2BURST at Black Hat USA: a weakened end-to-end cipher and a network key shared across air interface algorithms.
Source: Midnight Blue →Publishes the 27 July 2026 ESN summary business case: GBP 19.1 billion whole-life, the EE/BT contract to 2031, Airwave shutdown when it is safe to do so.
Source: GOV.UK →Proposes the EU Critical Communication System Regulation, with post-quantum encryption among the technologies to integrate and interconnection from 1 December 2030.
Source: Council of the European Union →Step 3 of 5
Dates from the NCSC timeline and the EU Coordinated Implementation Roadmap. Sequencing across police, fire and ambulance is the subject of our one-day Quantum-Safe Interoperability for Multi-Agency Response course. For budget ranges, see our PQC migration cost benchmarks.
Need help delivering the plan? Our expert members are peer-reviewed suppliers, integrators and advisers. Meet the expert members →
Step 4 of 5
A migration succeeds or stalls on people. Match each role, from the control room to the chief officer team, to the outcome you need from them.
$1,450 a seat · $1,087.50 for members
QSECDEF training · CPQCPM
Your brochure, the next cohort dates and the costs are ready on the next page.
Certified Quantum Business Professional
Self-paced, no physics background. Covers PQC, policy and PQC risk and migration management.
Free first session · included in membership
Get Session 1 freeIntroduction to Quantum Cyber Security
Six modules, 4 to 5 hours, certificated.
Free first module · included in membership
Get Module 1 freePQC Migration for Emergency Communications: TETRA, LTE, and 5G
Full day, 6 hours, professional level. Covers TETRA air interface encryption and the TEA algorithms, LTE MCPTT key management, 5G MCX security, ESN and FirstNet migration and the ETSI and 3GPP trajectory.
Dates and pricing on the course page
See the course Team membership brings your chief officers, programme lead, control room and security teams up to speed together, tracks what each person has completed and certifies across the group. The courses above are included, plus 170+ expert lectures and the weekly call, and members pay less for CPQCPM.
See team membershipStep 5 of 5
A members-only structured Q&A for chief constables, chief fire officers, ambulance chief executives, heads of digital and communications and the senior officials of national public safety network programmes. It runs under the Chatham House Rule and is facilitated by Anna Beata Kalisz Hedegaard, Founder of QSECDEF.
Practitioner lectures from the QSECDEF library that matter most to emergency services: quantum security for 5G and mission-critical networks, PQC in private networking, resilient timing, and national quantum-secured infrastructure.
Expert Membership
Expert membership brings you into an open community working across sectors, opening up industry conversations, knowledge and access to experts. If you are building technology or consulting capabilities in this sector relevant to Quantum or Advanced AI, we want to hear from you.
TETRA:BURST, published by Midnight Blue on 24 July 2023, disclosed five vulnerabilities in the TETRA air interface. The critical ones were CVE-2022-24402, a TEA1 algorithm whose 80-bit key reduces to a size that can be brute-forced in minutes on commodity hardware, and CVE-2022-24401, a keystream generator that relies on unauthenticated network time and allows decryption oracle attacks. 2TETRA:2BURST, presented at Black Hat USA on 7 August 2025, moved to end-to-end encryption and key management: CVE-2025-52941, an end-to-end algorithm whose effective key drops from 128 to 56 bits, CVE-2025-52943, a network key identical across every air interface algorithm a network supports, and CVE-2025-52944, message injection even with authentication enabled. None of this needed a quantum computer. It shows how long a weakness can sit inside a public safety network before anyone outside the vendors can look.
ETSI's TETRA committee agreed in November 2023 to publish every air interface algorithm, and did so in February 2025: TS 104 053-1 for TEA Set A, the original TEA1 to TEA4, and TS 104 053-2 for TEA Set B, the TEA5, TEA6 and TEA7 ciphers with 192-bit keys. Symmetric ciphers with 192-bit keys are not the part of the stack a quantum computer breaks first. The exposure is in everything that authenticates and distributes keys, in the IP links between sites and systems, and in a network that still has TEA1 enabled alongside a stronger cipher. Ask your vendor and your national programme which set your network runs, with the published specifications in hand.
It depends on how your Member State drew the lines. NIS2 covers public administration entities of central government, regional entities that a Member State's risk assessment identifies as significant, and local bodies only where a Member State opts them in. Entities whose activities are in national security, public security, defence or law enforcement can be excluded. In practice an ambulance service may be a health sector entity under Annex I while the police force next door sits outside NIS2 and inside national law enforcement rules instead. Whichever applies, Article 21 asks for policies on cryptography and encryption, and Article 20 puts the management body in charge of approving and overseeing them. The Directive had to be transposed by 17 October 2024.
The CER Directive (EU) 2022/2557 names public administration among its eleven sectors, alongside health, digital infrastructure, transport, energy and space. It applies from 18 October 2024, asked Member States to adopt a national resilience strategy by 17 January 2026 and to identify their critical entities by 17 July 2026. An identified critical entity must assess its risks and take resilience measures across physical and cyber dependencies. If your service or the network it depends on has been named, the dependency on cryptography that a quantum computer will break belongs in that assessment.
The Home Office page updated in February 2025 counts more than 300,000 frontline users, 45,000 vehicles, over 90 aircraft and around 200 control rooms that will depend on ESN. EE was awarded the mobile infrastructure contract in December 2024 and IBM leads design, build and integration from January 2025. The summary business case of 27 July 2026 puts the whole-life budget at GBP 19.1 billion to 2043/44 with GBP 6.1 billion spent, extends the EE/BT contract to 2031 and targets Airwave shutdown when it is safe to do so, without naming a year. Plan for TETRA and mission-critical LTE running side by side into the 2030s, and ask the programme how post-quantum key management fits the ESN releases.
Not yet. 3GPP standardised MCPTT in Release 13 in 2016 and MCVideo and MCData in Release 14, with security in TS 33.180. Those services establish identity and keys with public-key cryptography, which is exactly what a cryptographically relevant quantum computer breaks. The 3GPP security groups are working on post-quantum options for the 5G system, and CISA's January 2026 product categories list still places networking and radio hardware among the categories in transition. The migration will come from the national network operator and the application vendors; your job is to know your dependencies and ask for dates.
Because the data lives longer than the algorithm. Police records on serious offences and public protection matters are retained until the subject is deemed to be 100. Children's health records, including the ambulance patient record, are kept to the 25th birthday. Investigation and intelligence material identifies victims, witnesses, informants and officers for a lifetime. Traffic recorded in 2026 and read in the 2030s lands well inside those windows. The National ANPR Service, by contrast, deletes reads after 12 months, which is a reminder that the live link, not just the archive, is what an adversary records.
With four things. A cryptographic inventory of control room and dispatch systems, records systems, the interfaces to the radio and MCX networks and the device fleets. A map of which records must stay confidential beyond 2030 against the algorithms protecting them. Confirmation of which TETRA algorithm set the network runs, whether TEA1 is disabled and when the keys were last rotated. And roadmaps requested from the national programme, the operator and every radio, control room, body-worn and drone vendor. Those four give the chief officer team or authority the evidence to set priorities.
Possibly for a fixed fibre link between two sites, and several of our lectures cover national QKD networks. It does not authenticate, does not sign firmware or evidence, and does not run on a handset, a body-worn camera or a drone. The NCSC and the EU roadmap both point to post-quantum algorithms as the baseline. Treat QKD as a complement for one high-assurance link, not a substitute for the migration, and run the QKD Network Readiness Qualifier before anyone writes it into a tender.
Everything on this page. The two-minute readiness check scores your service and routes you to the right next step. The free tools, including the HNDL Risk Calculator and the Third-Party Cryptographic Exposure Model, run in your browser with no registration. The weekly peer call runs every Tuesday at 15:00 CET and is open to anyone. Sample lectures from the 170-plus expert library are linked above, and the page is reviewed as the mandates change; the date beside the key facts is the last check.
It depends on the role. Chief officers, authority members and directors start with the Certified Quantum Business Professional bootcamp, about 22 hours self-paced across ten modules. Security, IT and control room systems teams take Introduction to Quantum Cyber Security, four to five hours online with a QSECDEF certificate. Communications engineers and network security leads take PQC Migration for Emergency Communications: TETRA, LTE, and 5G, the sector course for TETRA, MCPTT and 5G MCX. Whoever will run the migration takes CPQCPM, the Certified Post Quantum Cryptography Programme Manager course: ten hours live online over five weeks, with the next public cohort in January 2027.
Yes. QSECDEF runs private CPQCPM cohorts for a single organisation, live online or in person, and private deliveries of the sector courses listed under Equip your people for your communications and control room teams. Board and leadership workshops are built on your own exposure and obligations and end with an agreed position on quantum risk. Use the contact button in the For your organisation section and tell us your timeline.
Through the QSECDEF Expert Members directory. Every listed member has been vetted, has signed the Members' Charter and has presented to the community. You can filter by consulting and services, technology vendor or enablement and investment, and send a request for further information from the member's own page. QSECDEF is vendor-neutral and sells training, not migration products, so the shortlist stays yours.
Two routes. QSECDEF membership gives your team the self-paced courses, the full lecture archive, the weekly call and 25 per cent off CPQCPM and partner training. Expert Membership is for the builders, consultancies and technology vendors serving emergency services who want to be found by the people reading this page; it includes a showcase listing with an enquiry form, the Industry Conversations and speaking slots at the annual QSECDEF symposium.
No. QSECDEF is a vendor-neutral membership network. We train people and connect them with peers and peer-reviewed experts; we do not sell migration software or services.
CPQCPM is ten hours of live instruction over five weeks, two hours a week. The Quantum Cyber Security course is 4 to 5 hours, self-paced. The business bootcamp is self-paced at your own speed. The emergency services courses are one-day workshops of six hours, listed with their formats on the training pages.
The free weekly call runs every Tuesday at 15:00 CET. Bring your question.
Join the Tuesday call →
For your organisation
When your chief officer team, your authority or your national programme needs something specific, we shape the workshop, the training or the engagement around your systems, your retention rules and your equipment cycle. Independent of any vendor.
In-person sessions for police, fire, ambulance and national network programmes covering TETRA, LTE and 5G migration, dispatch and control room security, multi-agency interoperability, drone and autonomous systems security and quantum optimisation for resource deployment, drawn from the emergency services workshop programme.
Private CPQCPM cohorts, live online or in person for your required delegates, with team membership for the self-paced courses.
Cryptographic inventory, PQC migration planning, supplier review and specialist teams sourced from 1,500+ members across 900+ organisations.
Prefer email? Write to info@qsecdef.com and tell us about your timeline.
Photos: Pexels (Mikhail Nilov, 112 Uttar Pradesh, Przemysław Cyruliński, Kindel Media, john mckenna, Maël BALLAND, Anna Shvets) and QSECDEF, converted to black and white or brand duotone.
