Quantum risk in mining and critical minerals

Not by name. Regulation (EU) 2024/1252, in force since 23 May 2024, is about supply: 2030 benchmarks of 10 per cent of EU consumption for extraction, 40 per cent for processing, 25 per cent for recycling and no more than 65 per cent from a single third country, plus a strategic-project regime with streamlined permitting and a single point of contact in each Member State. What it does is make provenance, security of supply and the resilience of a project's partners a matter of Commission scrutiny, and the records that prove those things rest on digital signatures and encrypted exchanges. A strategic project whose traceability platform signs with ECDSA holds evidence with a shelf life.

Not as mining. NIS2 names neither mining nor extraction. A mining group is in scope where it operates an asset or activity the directive does name: electricity generation, gas, hydrogen or oil infrastructure in the energy sector; rail, port or road transport operations; a chemicals business; or the manufacture of machinery and equipment. National transposition laws can add sectors, so check each Member State. Even outside scope, a miner supplying an essential entity, whether a steelmaker, a utility or a chemicals plant, will be asked the Article 21(2)(d) supply chain questions by its customers.

The Security of Critical Infrastructure Act 2018 applies to 11 sectors, and mining is not one of them. The Act defines asset classes, though, among them critical ports, critical freight infrastructure, critical electricity, gas and liquid fuel assets and critical data storage or processing assets, and a large miner often owns several. Each carries the three positive security obligations: an entry in the Register of Critical Infrastructure Assets, cyber incident reporting to the Australian Cyber Security Centre, and a written risk management program under the 2023 rules that addresses cyber and information security hazards and supply chain hazards and goes to the board each year. Quantum-vulnerable cryptography belongs in that program as a named hazard.

Anything that uses RSA or ECDSA for key exchange, certificates or authentication: OPC UA security modes in the plant, DNP3 Secure Authentication on the power and water systems at a site, the TLS and VPN tunnels that wrap Modbus/TCP, PROFINET and EtherNet/IP, the certificates on fleet-control and dispatch servers, and the VPNs on every satellite, microwave and private LTE backhaul. Plain Modbus on a conveyor carries no cryptography at all, which is a different problem. The symmetric parts, AES-256 and HMAC, hold up. Our free OT Protocol Quantum Vulnerability Scanner maps this for the protocols you select.

Yes, at a cost. A hybrid X25519 plus ML-KEM-768 handshake adds roughly 2.3 KB to each key exchange compared with a classical one. That is nothing on fibre and noticeable on a metered VSAT link with half a second of round-trip latency when sessions re-key often. The practical answer is to pilot it on one site-to-ROC VPN, measure the bandwidth and latency cost, tune session lifetimes and then roll it out link by link. The satellite and telecoms providers behind the link have their own migration schedules, so ask for them in writing.

Because the data lives as long as the orebody. A resource model built this year still describes the deposit in 2050, and still tells a competitor where you did not drill. Fleet configurations last the life of the fleet, tailings records last through closure and post-closure, and offtake terms carry intelligence value for the life of the contract and the next negotiation. All of it moves today over links that are easy to record. Traffic captured in 2026 and read in the 2030s is still inside every one of those windows.

Chain-of-custody and provenance platforms prove where a tonne came from with digital signatures and, often, a distributed ledger. Signatures made with RSA or ECDSA can be forged once a cryptographically relevant quantum computer exists, so a record signed in 2026 and relied on in 2035 proves nothing unless it was re-signed or timestamped with a post-quantum scheme first. The CRMA strategic-project regime, customer due diligence and the critical minerals strategies of the UK, Canada, Australia and the US all lean on those records. List every signed provenance and compliance record and plan the re-signing now.

It is starting to. Quantum gravimeters and magnetometers measure the subsurface with a precision and long-term stability that spring gravimeters and conventional sensors do not reach, and Nomad Atomics in Australia already sells absolute gravity surveys for exploration and time-lapse gravity for cave mine monitoring built on what it describes as the first absolute quantum gravimeter designed for field survey. The near-term effect is better targeting, fewer holes and faster decisions. The strategic effect is that a better survey dataset becomes a more valuable thing to steal, which brings the conversation back to the cryptography protecting it.

Three things. Extend the cryptographic inventory to the sites, the ROC and the backhaul, starting with fleet control and the IT-OT boundary. Run a protocol scan on one site and classify every controller, gateway and terminal by whether it can take a cryptographic update. Write crypto-agility and a dated post-quantum roadmap into every fleet, instrumentation and backhaul tender from now on. Those three give your board the evidence to set priorities and your customers the answers they are about to ask for.

Five numbers: inventory coverage across sites, links and commercial systems; the models, configurations and contracts that must stay confidential beyond 2030; the count of algorithm-fixed controllers, gateways, fleet servers and terminals and their replacement dates; how many vendors have a dated post-quantum roadmap on file; and budget and milestones against the 2028, 2030 and 2035 dates.

Everything on this page. The two-minute readiness check scores your mining and critical minerals programme and routes you to the right next step. The free tools, including the OT Protocol Quantum Vulnerability Scanner and the Third-Party Cryptographic Exposure Model, run in your browser with no registration. The weekly peer call runs every Tuesday at 15:00 CET and is open to anyone. Sample lectures from the 170-plus expert library are linked above, and the page is reviewed as the mandates change; the date beside the key facts is the last check.

It depends on the role. Board and executives start with the Certified Quantum Business Professional bootcamp, about 22 hours self-paced across ten modules. Security, risk, supply chain and IT teams take Introduction to Quantum Cyber Security, four to five hours online with a QSECDEF certificate. OT and automation engineers and ROC security leads take Quantum Threats to OT Security in Mining and Extraction Environments, the sector course for SCADA, DCS and PLC exposure at a mine. Whoever will run the migration takes CPQCPM, the Certified Post Quantum Cryptography Programme Manager course: ten hours live online over five weeks, with the next public cohort in January 2027.

Yes. QSECDEF runs private CPQCPM cohorts for a single organisation, live online or in person, and private deliveries of the sector courses listed under Equip your people for your OT, remote operations and supply chain teams. Board and leadership workshops are built on your own exposure and obligations and end with an agreed position on quantum risk. Use the contact button in the For your organisation section and tell us your timeline.

Through the QSECDEF Expert Members directory. Every listed member has been vetted, has signed the Members' Charter and has presented to the community. You can filter by consulting and services, technology vendor or enablement and investment, and send a request for further information from the member's own page. QSECDEF is vendor-neutral and sells training, not migration products, so the shortlist stays yours.

Two routes. QSECDEF membership gives your team the self-paced courses, the full lecture archive, the weekly call and 25 per cent off CPQCPM and partner training. Expert Membership is for the builders, consultancies and technology vendors serving mining and critical minerals who want to be found by the people reading this page; it includes a showcase listing with an enquiry form, the Industry Conversations and speaking slots at the annual QSECDEF symposium.

No. QSECDEF is a vendor-neutral membership network. We train people and connect them with peers and peer-reviewed experts; we do not sell migration software or services.

CPQCPM is ten hours of live instruction over five weeks, two hours a week. The mining courses are full days of six hours, in person or online. The Quantum Cyber Security course is 4 to 5 hours, self-paced. The business bootcamp is self-paced at your own speed.