'Unhackable' Is Doing an Awful Lot of Work: A Field Guide to Britain's Quantum Internet

There is a particular kind of press release that begins with a lab, a length of optical fibre, and the word 'unhackable'. Britain has produced a fair few of them. Money has been spent, links have been lit, ministers have had their photograph taken next to a rack. And somewhere along the way, a fairly modest piece of physics got dressed up as the end of cybercrime.

This is not a piece arguing that quantum key distribution is rubbish. It's a piece arguing that 'unhackable' is a headline, not a specification, and that the gap between the two is where all the interesting stuff lives.

The physics genuinely is lovely

Start with the bit that works, because it really does work.

QKD solves one problem beautifully: getting two parties to share a secret key without anyone else being able to copy it. Not 'without anyone being able to break it quickly'. Copy it at all. The no-cloning theorem says you cannot duplicate an unknown quantum state. So if you send a single photon in one of four possible polarisations, and an eavesdropper intercepts it and re-sends something, she will get it wrong some of the time. The errors show up in the statistics. Alice and Bob notice, throw the key away, start again.

That is genuinely different from the RSA and elliptic-curve maths currently propping up your banking app, which is hard only because nobody has found a fast way to factor large numbers. Quantum computers, if they ever get large enough and stable enough, would find that way. Hence the panic, and hence the interest in alternatives.

All of which is fair. The trouble begins when you try to build it in the real world, with real lasers and real detectors and real budgets.

Where the sticker peels off

A QKD system is not one thing. It is a photon source, a fibre, a detector, some classical authentication, and a piece of software doing error correction and privacy amplification. Every one of those is a surface. And surfaces get attacked.

Detection systems have been blinded by bright light. Sources have been made to emit more than one photon at a time, which hands an eavesdropper a spare copy. Timing side channels have leaked information about the key through the shape of the electronics rather than the quantum states. None of this breaks the physics; it breaks the implementation. But your security guarantee is only as good as the worst component, and in commercial kit the worst component is very rarely the photon.

Then there's the awkward little sentence that gets left out of the brochure: QKD still needs an authenticated classical channel to work. You must know who you're talking to. If that authentication is done with ordinary cryptography, you have not removed cryptography from the system — you have rearranged it and added a laser.

The trusted node problem, explained by a postbox

QKD over fibre doesn't travel far. Single photons leak out of even excellent glass, at roughly 0.2 decibels per kilometre, and detectors can't tell a signal from dark noise forever. Somewhere in the low hundreds of kilometres, terrestrial links run out of puff. Satellite versions exist and work, and look wonderful in a photograph, but they cost like satellites.

The stopgap is the trusted node. Instead of one long quantum link, you build a chain of short ones and trust a box in the middle to hold the key and pass it on. Which means the security of a nationwide 'quantum network' is the security of every building it passes through, every member of staff with a key, and every patch that gets applied to the node's operating system. It's a chain of locked drawers. Quantum physics secures the link between the drawers. It has nothing to say about the drawers.

If that sounds familiar, it is because trusted nodes are essentially what the internet already does, with more lasers and a bigger electricity bill.

So what's actually running in Britain?

There are real testbeds. The UK quantum communications research programme has strung fibre between university sites and national laboratories, linking places like Bristol, Cambridge, Glasgow and Teddington into a national network for experiments. BT has trialled commercial QKD hardware over installed fibre around its Adastral Park research site in Suffolk, working with industrial partners. Spin-outs and equipment makers sell boxes that do genuinely useful key generation over short, dedicated links.

All of it is real. All of it is small. Most of it is a research platform with a commercial pilot bolted on, which is exactly what you would expect at this stage, and is a perfectly respectable thing to be.

What none of it is, is a replacement for the internet's security model.

Who actually needs this?

Not many people. That isn't an insult; it's a design constraint.

QKD makes sense where you have a fixed pair of sites, a dedicated fibre you control, a secret that must stay secret for decades, and an adversary with a quantum computer and a lot of patience. Government-to-government traffic. Some defence links. Maybe a bank's disaster-recovery backbone, if the board can be persuaded of the threat model. Small number of links, high value, willing to pay for a second fibre path and a support contract.

What it does not make sense for is your average organisation, which needs to secure thousands of endpoints, half of which are laptops in someone's kitchen and one of which is a printer that has never been patched. Nobody is running a photon down a dedicated fibre to that.

For the rest of us, the boring answer is post-quantum cryptography: new maths, software-only, works on the hardware you already own, deployable at the speed of a package update. The UK's own cyber security authorities have been publicly cool about QKD for national infrastructure and consistently warmer about migrating to PQC. That's not a conspiracy against quantum; it's engineers noticing that the maths option ships.

The honest version of the story

Here's the case for quantum networking without the marketing department in the room. QKD is a fascinating, genuinely novel tool with a narrow, expensive, well-defined use case. The research is worth funding, because the science is good, the skills are valuable, and the day may come when we need keys that don't rely on a factoring problem staying hard. Fibre testbeds teach us how to run a quantum network, which is a prerequisite for quantum repeaters and, eventually, for linking quantum computers.

And the word 'unhackable' should be retired to the same drawer as 'chemical-free' and 'military-grade'. Nothing built by humans is unhackable. What QKD offers is a different set of failure modes, priced at a significant premium, in a market that mostly wants something else.

Which is, in the end, a better story than the press release. A small, strange, expensive technology that does one thing well — and a great deal of very British enthusiasm for putting it on a poster.