Post-Quantum Security and the Future of ASEAN Trust

Thailand's National Cyber Security Agency is sounding the alarm on a future threat: the day when quantum computers can break today's encryption. As the Bangkok Post reports, the immediate concern is "harvest now, decrypt later" attacks, where malicious actors steal encrypted data today to decrypt it with future quantum computers. While this may seem like a distant problem, the recommendation from IBM and Thai officials to start prioritizing upgrades for critical infrastructure reveals a more immediate and foundational issue for the region's digital ambitions.

The Infrastructure of Trust

The discussion in Thailand is not just about a specific technology but about the long-term integrity of the country's digital infrastructure. Post-quantum cryptography (PQC) is the next frontier in a continuous effort to secure the data that underpins the economy. For governments and corporations, the data being "harvested" now includes everything from state secrets and intellectual property to personal financial and health records. The security of these assets is a matter of institutional trust. If citizens and businesses cannot trust that their data is secure for the long term, their participation in the digital economy will be hesitant.

This is where the conversation about PQC connects to the broader theme of building a resilient digital ASEAN. The call to prioritize critical infrastructure is a recognition that foundational systems for banking, healthcare, and government services are the most attractive targets and require the most robust protection. The expense and complexity of a nationwide upgrade to PQC mean that choices made today will determine the security landscape for decades.

Sovereign AI and the Data Layer

While quantum computing represents a future challenge, the principles at stake are relevant to the current development of artificial intelligence. As explored in ASEAN Rising, the true test of a nation's digital sovereignty lies not just in developing advanced AI models but in the control over the fundamental components that power them. The book argues that "Sovereign AI in ASEAN will be tested not by model launches but by who controls the compute, the data layer and the digital identity rails".

The "data layer" is particularly relevant here. The data currently being harvested by adversaries could one day be used not only for decryption but also for training hostile AI models. Securing this data layer against future threats, including those posed by quantum computers, is essential for maintaining control over national digital systems. The integrity of digital identity systems, which rely on encryption to function, is also at stake. Without a secure foundation, the entire structure of the digital economy becomes vulnerable.

Execution and Capital

For Thailand and its ASEAN neighbors, addressing the post-quantum threat is a question of execution and capital. The NCSA's pragmatic approach, acknowledging budget limitations and the need for a phased rollout, is a familiar one in the region. It highlights the difficult trade-offs that governments must make between preparing for future risks and addressing present needs. Deciding which parts of the country's digital infrastructure are "critical" is the first step in a long and expensive process.

This process will require significant public and private investment, not just in new software but in the talent required to implement and manage it. The competition for cybersecurity expertise is already intense, and the specialized knowledge for PQC is even rarer. Building this capacity within ASEAN is a strategic imperative. The choices made in capitals like Bangkok, Jakarta, and Kuala Lumpur regarding these investments will shape the security and autonomy of the region's digital future.

What to watch

Watch for how national cybersecurity agencies across ASEAN begin to incorporate PQC into their strategic plans and budget requests. Observe whether a regional standard or a collaborative procurement approach emerges to reduce costs and ensure interoperability. The first movers in upgrading critical infrastructure will signal the region's seriousness in building a secure and sovereign digital economy for the long term, far beyond the immediate hype of AI model releases.