Causal forecasting in Action
When does quantum computing break encryption? A causal forecast.
When does quantum computing break encryption? A causal forecast.
Somewhere ahead of us is a date when a quantum computer can break RSA-2048 and the elliptic-curve keys that secure most of the internet, including the curve Bitcoin and Ethereum run on. Nobody knows when. Ask ten people who follow the field and you will get ten years, each defended with a roadmap slide.
The problem is not that the question is unanswerable. It is that almost every answer is an extrapolation. Take a qubit count, draw a line through it, read off the year. That tells you what happened last year, dressed up as a forecast. It says nothing about why the line moves, so it cannot tell you what happens when something changes.
We built a model that reasons about why. It runs live in your browser here: https://quantum.causisresearch.com/
What actually decides the date
Strip the question down and it is a race between two moving curves.
One is capability: the number of fault-tolerant qubits that can actually be built. This curve does not simply rise with time. It only starts once error correction crosses the threshold where adding qubits makes a system more reliable rather than less, which happened in 2024, and then it climbs at some doubling rate, through a maturity ramp, with the slips that every published roadmap has so far shown.
The other is requirement: the number of fault-tolerant qubits needed to break RSA-2048 or ECC-256. This curve falls over time as algorithms and error-correcting codes improve, but not to zero. There is a floor, and the floor is one of the most contested numbers in the field.
The threat arrives where the curves cross. Add the lag between a machine existing and an adversary getting access to it, and a fat-tailed chance that the whole effort stalls for decades, and you have the mechanism.
That is the thing to model. Not the year. The mechanism that produces the year.
How the model approaches it
The forecast is a structural causal model of that mechanism, built on our architecture. Each moving part is a node: the capability curve, the requirement curve, the crossing, the access lag, the stall risk, and the coupling between the drivers. Every node shows its live value and the primary result that anchors it. Every anchor traces to a source. Every judgment is labelled as a judgment, with a range. The whole thing is generated from a single file you can download, so there is nothing in the answer that is not in the inputs.
What comes out is not a year. It is a probability distribution over years, with a median, and a shape that tells you as much as the median does. As we write this, the distribution is floor-limited: the requirement curve's floor, not the capability curve's speed, is what holds the date where it is. That is a real finding about the structure of the problem, and it is not something an extrapolated line can tell you.
The part that makes it causal
A forecast that only reports a distribution is still just a better-dressed prediction. What separates a causal model from a correlational one is that you can act on it, and the model reasons about the consequences.
Drag a prior. Set the doubling time faster or slower, choose a vendor's published roadmap and run it as the capability curve, move the qubit floor. The crossing moves and the distribution recomputes in front of you. This is the first rung of causal reasoning: intervention, what happens if this changes.
Then go a rung higher. The model can answer counterfactuals: if below-threshold error correction had arrived in 2030 instead of 2024, same world, one fact changed, when does the threat arrive? It reconstructs the case and re-runs it. And it can do attribution: was crossing the threshold in 2024, rather than 2032, the cause of a cryptographically relevant machine existing by 2040? That is a question about the causes of effects, not the effects of causes, and it is the kind of question that only a model with causal structure can address at all.
None of this is bolted on. Intervention, counterfactual, and attribution are what the architecture does natively, on this problem and on any other with real dynamics.
What it says, and what it does not
Run it and read the distribution for yourself. We are deliberately not printing a headline year here, because a single year is exactly the false precision this model exists to replace. What we will say is what would change the answer, because the model makes that legible. A factoring algorithm that brings the requirement below a hundred thousand qubits pulls the date in sharply. Sustained sub-yearly doubling of fault-tolerant qubits, or a verified logical-qubit breakthrough, moves it toward the more aggressive expert estimates. An engineering or yield wall, or a stall in below-threshold scaling, pushes it past 2065. Each of those is a prior you can drag and watch.
Two honest caveats. This is a model of a mechanism, not a prophecy; its inputs are public estimates and published roadmaps, and they can be wrong. And it is ongoing research. The value is not that the answer is certain. The value is that you can see exactly which assumptions it rests on, and how far the answer moves when you change one.
Why this small thing matters
The quantum threat is one question. But the shape of it, two forces with real dynamics, a crossing that matters, and stakes that depend on knowing what would happen if something changed, is the shape of most questions that matter. When does a market regime break. What actually drives a failure in a physical system. What happens in a biological network if you intervene on one node.
Correlational models answer those by extrapolating what happened before, and they break the moment conditions change. A model that has learned the causes does not. This forecast is a small, public example of that, on a problem where you can check the sources yourself.