HNDL in Plain English: Your Private Data Is Being Stolen Right Now to Decrypt Later

The Scenario in Plain Language

Imagine a government intelligence service taps an undersea fiber cable carrying email, video calls, banking traffic, and medical records. They cannot read any of it today because it is all encrypted. So they record everything and store it on hard drives. They wait ten, fifteen, twenty years. When quantum computers arrive, they go through the archive and read it all.

This is Harvest Now Decrypt Later (HNDL). It is not hypothetical. It is the operating assumption every major security organization works from.

Who Does This

Any organization with Internet backbone access and enough hard drive budget. That means:

• National signals intelligence agencies (NSA, GCHQ, Chinese MSS, Russian FSB/GRU, French DGSE, Israeli Unit 8200).
• Criminal organizations with access to enough cables or data center taps.
• Corporate espionage units with insider access.

Why Storage Is Cheap

A petabyte of hard drive storage costs under $20,000. A nation-state intelligence budget is in the billions. Storing years of Internet traffic is a rounding error.

What Gets Harvested

• Email (still commonly in flight with classical TLS).
• VPN traffic.
• Cloud uploads (S3, Google Drive, Dropbox) with classical key wrapping.
• Corporate file transfers.
• Messaging (WhatsApp, Telegram where classical crypto).
• Video calls (Zoom, Teams, Meet).

What Survives HNDL

Data that was encrypted with Post Quantum Cryptography before transmission. An attacker who recorded an encrypted TLS handshake protected by hybrid ML-KEM + X25519 cannot decrypt it even with a future quantum computer (unless they break both algorithms).

The Only Defense

Deploy Post Quantum Cryptography today. Every day you delay adds more data to the adversary's eventual reading pile.

Frequently Asked Questions

Is HNDL science fiction?

No. NSA, CISA, NIST, ENISA, UK NCSC, and the Cloud Security Alliance have all published guidance treating HNDL as an operating threat. The August 2023 NSA/CISA/NIST joint fact sheet explicitly addresses it.

Can I detect HNDL?

No. Collection happens at Internet infrastructure you don't control. You can only prevent it by using Post Quantum Cryptography before your traffic is transmitted.

When will my HNDL data be decrypted?

When a Cryptographically Relevant Quantum Computer exists. Expert estimates put this 10 to 20+ years out. Probabilistic, not fixed.

Is HNDL only for nation-states?

Primarily, but organized crime, industrial espionage groups, and well-funded extremist organizations could also harvest. Anyone with ISP taps, data center access, or network infrastructure positioning.

Sources

1. NSA/CISA/NIST Factsheet

Related Articles

• HNDL Primer
• Q-Day Explained
• Undersea Cable HNDL
• Mosca's Theorem
• Implementing PQC