The Quantum Clock Is Already Ticking for Nigeria

5 October 2026

The Quantum Clock Is Already Ticking for Nigeria

Why a machine that barely exists yet is already a security problem, and what Africa’s largest economy should do about it in the next five years.

Every time you send money on your phone, log in to your bank or open a government portal, a piece of mathematics is quietly protecting you. It is so reliable that most of us never think about it. I have spent more than 25 years building and securing systems for banks and government departments, and for almost all of that time, this mathematics was the one thing we could take for granted.

That is changing. Not tomorrow morning, but on a timeline short enough that governments in Washington, Brussels and London have already put dates in the diary. Nigeria has not.

I recently finished a full strategy proposal setting out how Nigeria could close that gap between 2027 and 2031. This post is the plain-English version: what quantum computing actually is, why it matters now rather than in some distant future, where Nigeria stands, and what I believe should happen next. You do not need a physics degree to follow it. You just need to care about the systems your organisation, your customers and your country depend on.

Quantum computing, without the hype

An ordinary computer stores information as bits, each one either 0 or 1. Everything your laptop does, from spreadsheets to video calls, comes down to flipping enormous numbers of these switches very quickly.

A quantum computer uses qubits. A qubit can hold a blend of 0 and 1 at the same time (physicists call this superposition), and groups of qubits can be linked so that what happens to one is tied to the others (entanglement). You will often read that this lets a quantum computer “try every answer at once”. That is the bit of the story I would ask you to forget, because it is wrong in a way that matters.

A better picture is waves on a pond. A well-designed quantum program arranges things so that the paths leading to wrong answers cancel each other out, like two ripples meeting and flattening, while the paths leading to the right answer reinforce. When you finally look at the result, the right answer is the one most likely to be standing.

The catch is that this trick only works for certain kinds of problem. For most everyday computing, a quantum computer is no faster than the machine on your desk, and often far worse. Quantum is not a faster laptop. It is a specialist tool for a narrow set of jobs: simulating molecules and materials, some hard optimisation problems, and, crucially for this post, finding the hidden factors behind the codes that secure the internet.

Why that last one keeps security people awake

Most online security rests on a simple asymmetry. Multiplying two very large prime numbers together is easy. Working backwards from the result to find those two primes is, for a normal computer, practically impossible: it would take longer than the age of the universe. Systems called RSA and elliptic-curve cryptography are built on puzzles of this kind, and they protect everything from bank transfers to software updates.

In 1994 a mathematician called Peter Shor showed that a large enough quantum computer could solve exactly these puzzles quickly. For thirty years that was a theoretical worry, because nobody could build a machine anywhere near big enough. The question has never been whether the mathematics works. It has always been when the engineering catches up.

The machine that could do this has a name in the industry: a cryptographically relevant quantum computer. It does not exist today. Anyone telling you otherwise is selling something. But the distance between today’s machines and that one is shrinking faster than most people outside the field realise.

Why a future machine is a present-day problem

Three things turn this from a science story into a boardroom one.

1. The bar keeps dropping

In 2019, the best estimate for breaking a standard 2048-bit RSA key was a quantum computer with about 20 million noisy qubits running for eight hours. In May 2025, Craig Gidney of Google Quantum AI revised that to under one million qubits in under a week (Gidney, 2025). That twentyfold reduction came from cleverer algorithms and error correction, not from new hardware. The hardware still has a long way to go, but the target it is aiming at has moved much closer.

2. Your data can be stolen today and read later

This is the part that surprises most non-specialists. An attacker does not need a quantum computer now to cause harm later. They can record encrypted traffic today, store it cheaply, and wait. Security people call this “harvest now, decrypt later”.

For a lot of information that hardly matters. Yesterday’s card authorisation is worthless in ten years. But some information stays sensitive for decades: national identity records, medical histories, defence and diplomatic communications, long-dated contracts, land titles. If that data is crossing the internet today under RSA, its secrecy already has an expiry date.

There is a neat rule of thumb for this, known as Mosca’s inequality. Add together how long your data must stay secret and how long it will take you to upgrade your systems. If that total is longer than the time until a capable quantum computer exists, you are already exposed. For a national identity database, the first number alone is measured in decades.

3. The rest of the world has set its deadlines

The fix exists. It is called post-quantum cryptography (PQC): new mathematical locks designed to resist both ordinary and quantum attack, running on today’s computers. The US National Institute of Standards and Technology published the first three standards in August 2024. What remains is the hard, unglamorous work of swapping them into millions of systems, and governments have started the clock:

United States: new purchases for national security systems must comply with the NSA’s post-quantum suite from 1 January 2027, and NIST proposes retiring today’s public-key algorithms after 2030 and banning them after 2035.
European Union: member states should start by the end of 2026 and protect critical infrastructure by the end of 2030 (European Commission).
United Kingdom: the NCSC expects organisations to finish discovery and planning by 2028, priority migration by 2031 and full migration by 2035 (NCSC).

Having led large migrations in UK government and banking, I can tell you that ten years is not a generous runway for this kind of change. It is roughly how long it takes.

Where Nigeria stands

Nigeria has built one of the most impressive digital economies on the continent, which is exactly why this matters so much.

The NIBSS Instant Payments system carried ₦1.07 quadrillion in 2024 (NIBSS), and the CBN reports ₦3.46 quadrillion in e-payments for 2025.
Active telecom subscriptions reached 195.1 million in July 2026 (NCC data via The Journal).
The national identity system, government payroll and tax platforms, hospitals and the power grid all sit on the same kinds of cryptography.

None of it currently has a post-quantum migration requirement. Nigeria has no national quantum strategy and no dedicated federal quantum budget. The CBN’s 2024 cybersecurity framework for banks is solid on today’s threats but sets no post-quantum timeline.

I want to be fair here, because the picture is not empty. Nigerian researchers and students are active: the Africa Quantum Consortium has Nigerian national coordinators, and Lagos hosted the QML4Africa quantum machine learning workshop in August 2026. That energy is real. It is also academic and community-led, not government strategy, and the difference matters when you are asking a bank or a telco to spend money.

The encouraging news is that most of the legal machinery already exists. The Critical National Information Infrastructure Order of 2024 lets the Office of the National Security Adviser set minimum security standards for designated critical systems. The National Digital Cloud Policy of August 2026 already sorts government data into four sensitivity levels, which is precisely the triage you need for “harvest now, decrypt later”. And NIBSS is rebuilding its core payment rails on a new National Payment Stack, which is the cheapest possible moment to build in the flexibility to swap cryptography later.

Nigeria does not need to invent a framework from scratch. It needs to point the tools it already has at this problem, with dates attached.

What I am proposing

My strategy, which is a proposal and has not been adopted by government, rests on a simple idea: security first, capability second.

One Order, three dates

The centrepiece is a Quantum-Safe Nigeria Executive Order, signed in early 2027, that makes post-quantum migration a binding duty for every operator of critical national infrastructure. It sets three dates:

31 December 2027: every critical operator completes an inventory of where and how it uses cryptography. You cannot migrate what you cannot see, and in my experience most organisations are surprised by what that inventory finds.
31 December 2030: high-risk systems run hybrid post-quantum protection, which pairs a new algorithm with a proven classic one so that neither has to be trusted alone.
2035: everything else follows.

The 2030 date is deliberate. It matches the EU’s deadline for critical infrastructure, so Nigerian banks, telcos and government systems do not become the weak link in the international chains they plug into.

The Order is backed by directives from the regulators who already know their sectors: the CBN for banks and payment firms, the NCC for telecoms, the health authorities for patient records, the energy regulators for the grid and pipelines, and NITDA for government IT. One rule I consider essential: from mid-2027, no government system should be bought unless the supplier can show a dated post-quantum roadmap. Every inflexible system bought from now on becomes migration debt.

Six pillars

Security takes most of the effort, but it is not the whole story. The strategy has six pillars:

Pillar	What it means in practice
Quantum-safe Nigeria	Migrating critical systems to post-quantum cryptography
Compute and algorithms	Buying cloud access to quantum computers, not building our own, and applying them to Nigerian problems
Sensing and timing	Quantum sensors for mineral survey, and resilient timing for the grid and telecoms that survives GPS jamming
Quantum communications	Quantum random number generators now; quantum key distribution kept to a research testbed
Talent and research	5,000 certified practitioners and three research centres by 2031
Industry and standards	Supply-chain assurance, local PQC service firms and a seat in the rooms where standards are written

That second pillar reflects a judgement I feel strongly about. Nigeria cannot outspend China, the US or the EU on quantum hardware, and it does not need to. South Africa has taken the same view. The smart move is to become an expert user, with people who know which problems quantum genuinely helps and which it does not.

What it costs

I estimate public investment of $371 million to $554 million over five years, roughly ₦493 billion to ₦736 billion at today’s exchange rate. About 40% of that goes on migrating government’s own systems. Banks, telcos and energy companies would fund their own upgrades, much of it within normal equipment refresh cycles. Money would be released against verified milestones, not equipment delivered, because the biggest risk to a programme like this is that it turns into a shopping exercise rather than a migration.

What I got wrong the first time

This is the second version of my strategy, and I think it is worth being open about why.

My 2025 draft leaned on some numbers that would not have survived contact with a budget office. It claimed quantum technology could save Nigeria’s banks ₦80 billion to ₦110 billion a year in fraud. When I checked the NIBSS fraud report, total losses for 2024 were ₦52.26 billion (NIBSS via Nairametrics). You cannot save more than you lose. Worse, most of that fraud comes from social engineering and insiders, and no cryptography, quantum or otherwise, fixes a staff member who registers fake identities.

The same draft promised a 300% to 400% return on investment, and understated the value of Nigeria’s payments by a factor of about four thousand. I have removed all of it.

The lesson applies well beyond Nigeria. The honest case for post-quantum migration is risk reduction, not profit. It is the same argument as fire insurance or seismic building codes: you spend now so that a predictable future event does not become a catastrophe. Dressing it up as a money-maker invites exactly the scepticism that kills good programmes. Decision-makers deserve the plain version, and in my experience they respond to it better.

What your organisation can do this quarter

You do not have to wait for a national strategy. Whether you run a bank, a hospital, a logistics firm or a government department, in Nigeria or anywhere else, these five steps cost little and put you ahead:

Name an owner. Give one senior person responsibility for quantum readiness and put it on the risk register. It will not move otherwise.
Find your cryptography. Build an inventory of where you use encryption, certificates and digital signatures, including inside the products you buy. Ask your top ten suppliers for their post-quantum roadmap, in writing, with dates.
Sort your data by lifespan. Which information must stay secret for ten years or more? That is your harvest-now exposure, and it goes to the front of the queue.
Switch on what you already have. Many modern browsers, servers and VPNs already support hybrid post-quantum key exchange. Turning it on for internet-facing systems closes much of the harvest-now risk at very low cost.
Stop buying new debt. Add a clause to new technology contracts requiring post-quantum support, or a dated plan for it. Equipment bought in 2027 may still be running when the threat arrives.

None of this requires a quantum physicist. It requires the same disciplines that make any large migration succeed: visibility, prioritisation and contracts with teeth.

The window is open, for now

Quantum computing will bring genuine benefits: better materials, new medicines, smarter optimisation of grids and supply chains. But its first large-scale consequence for most organisations will be the security migration it forces on all of us. That migration is not a technology project you can buy off a shelf. It is years of patient, coordinated work, and the countries and companies that start early will spend less and sleep better.

Nigeria has the talent, the regulators and much of the legal framework already in place. What it lacks is a decision and a date. I would like to help change that.

If you are a policymaker, a regulator, a CISO or a board member thinking about what quantum means for your organisation, I would be glad to talk. The full strategy, with its sector roadmaps, draft executive provisions and budget, is available on request.

The views here are my own. The strategy described is an independent proposal and has not been adopted by the Federal Government of Nigeria.

Sources

bolao

Bola's Blog