NetFlow Logic, a company that sells software for analyzing network flow records, wrote in May 2026 that network visibility “is the only layer that can catch HNDL-style operations while they are happening,” in a post about harvest-now, decrypt-later attacks. Harvest now, decrypt later (HNDL) is an attack in which an adversary records encrypted data today and stores it until a quantum computer can decrypt it. NetFlow Logic treated the harvest as exfiltration, the unauthorized transfer of data out of a network. “It occurs today, at the moment your data is exfiltrated,” the company wrote.
An adversary can harvest without moving anything out of the victim’s network, by copying encrypted traffic from a fiber, a radio link, or a satellite beam that the victim does not own.
A copy of encrypted traffic made by passive interception outside an organization’s network leaves that organization’s packet and flow records unchanged, so products marketed for harvest-now, decrypt-later defense, including NetFlow Logic’s, watch for exfiltration, anomalous traffic, or quantum-vulnerable encryption instead.
Security teams have good reasons to watch for exfiltration. Against harvesting, the control that works is moving data with a long secrecy lifetime to post-quantum key exchange.
Disclosure: Quantum Observer’s Editor-in-Chief Marin Ivezic is the founder and CEO of Applied Quantum, a quantum systems integration and consulting firm, and the author of its PQC Migration Framework.
Where harvesting happens
Encrypted traffic that leaves a company’s network travels over carrier fiber, radio links, and satellite beams owned and monitored by others. Researchers at the University of California San Diego and the University of Maryland reported at the ACM CCS conference in October 2025 that they had intercepted IP traffic from 39 geostationary satellites with one rooftop dish. They collected it “by passively scanning” and wrote that such a station is within reach of “any individual with a clear view of the sky and US$600.” A dish records encrypted traffic just as easily as the unencrypted traffic the researchers reported.
On cellular networks, the Electronic Frontier Foundation writes that “it is impossible for anyone to know if their phone’s signals have been accessed by a passive IMSI catcher,” a receiver that only listens to phone signals. On fiber, AT&T Bell Laboratories patented a tap in 1989 that draws light out of a bent fiber without breaking it, with a typical added loss of 0.001 to 1.0 dB. For a tapped signal of −40 dBm, assuming 0 dBm input, the inventor, Calvin M. Miller, put the loss at “approximately 0.002 dB/tap,” less than a tenth of one percent of the light.
Owners of fiber can look for such taps with monitoring equipment. ADVA Optical Networking marketed tap detection in 2010 for “private enterprise networks over dark fiber” and for managed service providers to sell as a premium service. An enterprise that buys wavelength or IP services cannot test its carrier’s fiber and depends on whatever monitoring the carrier offers.
Attackers “can gather information without alerting their targets or leaving obvious traces of their presence,” Europol, the EU’s law enforcement agency, wrote in a 2026 report on harvest-now, decrypt-later attacks.
Researchers have found one narrow exception in radio receivers. A receiver’s local oscillator, the internal signal generator it uses to tune to a frequency, can leak a faint signal through the antenna. In 2018, a University of Illinois team with a University of Michigan co-author detected hidden software-defined radios that way “with more than 95% accuracy up to 5 meters away,” in a paper for the MobiCom conference. The team detected off-the-shelf Wi-Fi cards with 89% accuracy at up to 1 meter.
A fiber tap emits no radio signal. A satellite receiver can operate anywhere in a beam’s footprint, far beyond 5 meters from any detector.
The products, in their vendors’ words
Four vendors describe on their own pages what their products observe. Two of them say their products detect harvesting.
| Company | Document | Claims to detect harvesting | What the product observes |
|---|---|---|---|
| NetFlow Logic | Blog post, May 8, 2026 | Yes | Flow records of outbound volume, timing, and destinations |
| ipoque | Blog post, October 28, 2025 | Yes | Ciphertext volumes in transit and ciphertext manipulation |
| ExtraHop | Blog post, August 12, 2026 | No | TLS handshakes, including the key exchange negotiated |
| Forescout | Solutions page, read November 12, 2026 | No | Quantum-safe and non-quantum-safe encryption in use |
“The only defense against the harvest phase is detecting it while it is in progress,” NetFlow Logic wrote. The company also wrote that “Transitioning to quantum-resistant encryption is essential and urgent” and called post-quantum migration “Necessary But Not Sufficient” in a closing heading. The signals it listed, from “Sustained bulk outbound transfers” to “Low-and-slow incremental collection,” are all measurements of data moving out through the customer’s network.
In defining the harvest as exfiltration, NetFlow Logic left out copies made outside the network, on a satellite link or a carrier’s fiber. An adversary who copies traffic there changes none of those signals.
In October 2025, ipoque, a Rohde & Schwarz company that sells deep packet inspection software, described harvesters as actors who “illegally store terabytes of encrypted traffic.” It wrote that deep packet inspection “can uncover this covert activity by tracking unusual volumes of ciphertext in transit and detecting real-time ciphertext manipulation.” It named adaptive chosen-ciphertext attacks as an example. The company also wrote that its inspection engines can be used for targeted monitoring, to pinpoint “the most vulnerable traffic flows.”
A passive copy adds no traffic to the link it copies and changes neither the volume nor the content of the traffic on it, wherever an operator or enterprise installs the inspection software. In a chosen-ciphertext attack, an attacker sends altered ciphertexts to a system and studies its responses, so the attack is active by definition. Neither ipoque nor NetFlow Logic wrote in these posts that its tools can see a copy made outside the customer’s network.
ExtraHop and Forescout describe their products more narrowly. ExtraHop wrote in August 2026 that its product “spots quantum-resistant algorithms and hybrid key exchanges” in TLS handshakes. On a solutions page, Forescout says its technology “detects and inventories quantum-safe and non-quantum-safe encryption usage in real time” and helps customers “identify which encrypted traffic is most likely to be harvested today.” Both companies measure exposure, meaning the traffic a harvester would want to keep, without claiming to see the harvest.
The case for detection
Europol, the FBI, and CISA have documented the facts behind the strongest case for these products. In its report, Europol wrote that there is “currently no clear evidence that HNDL is being systematically exploited at scale,” but it named a reason for concern. Past incidents “involving the exfiltration of encrypted data from high-value organisations suggest that the prerequisites for future decryption may already be in place,” Europol wrote.
In a November 2024 joint statement, the FBI and CISA said that “PRC-affiliated actors have compromised networks at multiple telecommunications companies to enable the theft of customer call records data.” They also described the compromise of “the private communications of a limited number of individuals” and the copying of information “subject to U.S. law enforcement requests pursuant to court orders.” The agencies did not mention encryption. Those intrusions took place inside the telecommunications companies’ networks, where their own security teams could have looked for them.
Monitoring for exfiltration covers that route, so boards have reason to keep funding it under its own name. No security team can tell from an alert what an adversary plans to do with stolen ciphertext. A large outbound transfer looks the same whether the thief decrypts it next week with classical tools or stores it for a quantum computer in the 2030s.
Government guidance
CISA, the NSA, and NIST warned in an August 2023 factsheet that threat actors “could be targeting data today that would still require protection in the future” through what the agencies called “harvest now, decrypt later” operations. The UK’s National Cyber Security Centre described “a risk from an attacker collecting and storing data today and decrypting it at some point in the future” in a whitepaper updated in August 2024. NCSC added that such an attack “is only likely to be worthwhile for very high-value information.”
These four agencies, Europol in its October 2026 reports, and the G7’s cybersecurity working group in a September 2026 call to action all told organizations to prepare for post-quantum migration. None described a method for detecting harvesting. Europol wrote that at the time of collection, “security systems may fail to detect the full scope of the breach.”
What boards should hear
A board that asks whether its organization is a harvesting target is asking a question its own network telemetry cannot answer for traffic copied outside the network. In a 2015 preprint, the cryptographer Michele Mosca of the University of Waterloo posed a question that a board can answer. If x, how long the data must stay secret, plus y, the time needed to migrate, exceeds z, the time until a quantum computer breaks today’s public-key cryptography, there is “a serious problem today,” Mosca wrote.
To answer Mosca’s question, a board needs an inventory of the systems that still use RSA or elliptic-curve key exchange and of the data they handle that must stay secret into the 2030s. Tools of the kind ExtraHop and Forescout describe can help build it. The Government Accountability Office found one complete inventory of quantum-vulnerable cryptography among 24 federal agencies in a report made public in October 2026, covering an audit that ended in September 2025.
Organizations that move key exchange to post-quantum algorithms such as ML-KEM, formerly CRYSTALS-Kyber, the key-encapsulation standard NIST published in August 2024, protect traffic harvested after the move against the known quantum attacks on RSA and elliptic-curve key exchange, for as long as the new algorithms and their implementations remain unbroken. Any session already recorded under RSA or elliptic-curve key exchange stays exposed. In its final transition plan, NIST deprecates RSA and elliptic-curve algorithms after 2030 and disallows them after 2035. In Executive Order 14412, signed in June 2026, President Trump directed the Office of Management and Budget to require federal agencies to move high-value assets and high-impact systems to post-quantum key establishment by December 31, 2030.
In a statement adopted during Canada’s 2025 G7 presidency, the G7’s cybersecurity agencies advised each organization to make one board member accountable for the migration.
A briefing that fits the evidence has three lines. The organization cannot know whether its traffic has been copied outside its network. It can know which data with a long secrecy lifetime still depends on quantum-vulnerable key exchange. It can fund the migration of that data first.
What would change this view
This view would change if a vendor published a test in which its product, using only the customer’s own telemetry, detected a passive copy made on a link the customer does not control. It would also change if carriers routinely reported tap-detection results to the customers whose traffic crosses their fiber.
If Europol or an intelligence agency published evidence of harvesting at scale, boards would have more reason to hurry the migration. Their own tools would still miss a passive copy made outside their networks.
