⚖️ Mosca Hand Threshold Evaluator

The survey band above is the capability probability: the chance a CRQC exists inside your window. The Hand probability is the chance of harm to you, which the accompanying article's §III.E decomposes as P = P_c × P_h × P_d — capability, harvest, decryption prioritization. This panel supplies the latter two as a single factor P_h×P_d; the survey band above is P_c(W), and the headline threshold R < P(W) reads the composed Hand probability, P(W) = P_c(W) × P_h×P_d. The two are collapsed deliberately: harvest and prioritization are not independent — no adversary warehouses ciphertext it never expects to read, so data worth harvesting is data worth decrypting. P_h×P_d = 1.00 is the documented upper bound and the default; the anchor positions below are illustrative pedagogy, not threat-intelligence estimates.

This factor cuts both ways. Defense counsel will argue your P_h×P_d is low; plaintiffs will answer that harvesting is cheap and indiscriminate, that no adversary warehouses ciphertext it never expects to read, and that prioritization climbs over your data's whole confidentiality horizon as decryption capability spreads and cheapens. Lowering P_h×P_d is an affirmative judgment — document it. (Scenario links carry the factor but not your rationale; the documentation block is the record.)

Fast and slow variables. P_c is the fast variable — resurveyed annually, it swings with each QTTR edition. P_h×P_d is the slow variable — a target-profile judgment, stable quarter to quarter — but it ratchets upward: harvest is an absorbing state (collected ciphertext never becomes uncollected; migration protects future traffic, not the warehouse), decryption capacity compounds (Gidney 2019–2025: a ~20× resource reduction), reaching progressively less attractive targets, and data accumulation grows the target itself. Re-estimate annually on the QTTR cadence; downward revisions demand extraordinary justification — a documented 0.60 that becomes 0.40 two years later reads as motivated reasoning. The documentation block timestamps your estimate against the survey edition in force.

Anchors. Averaged cumulative probabilities computed from the raw expert response counts published in each report's Appendix A.4, using the report's own optimistic/pessimistic bin assignments. QTTR 2024 (n=32, published Dec 6, 2024); the March 2026 QTTR (n=26, published Mar 9, 2026), referred to in the accompanying article as the March 2026 Quantum Threat Timeline Report. Cross-checked against values stated in each report's body (e.g., Mar 2026: ~15% optimistic at 5 years; 28–49% at 10 years; 51–70% at 15 years). Read in sequence, the selectable curves trace the foreseeability ratchet the article describes: each survey cycle has moved the consensus probability upward, tightening the duty inside the window since long before most organizations knew the window existed.

Interpolation. Monotone cubic (Fritsch–Carlson) through anchors at 0, 5, 10, 15, 20, 30 years from report publication, with P(0) = 0. Values beyond 30 years are clamped at the 30-year anchor and flagged.

The window. W = [today, start + X + Y]. Left edge: a CRQC arriving today decrypts harvested data still within shelf life — and the left edge stays at today even after migration commences or completes, because migration stops future harvesting while the already-harvested archive remains decryptable until it ages out; arrival dates already in the past are spent risk, not exposure. Right edge: the last datum harvested before migration completes remains sensitive for X further years. Pc(W) = Pc(right) − Pc(left) — the unconditional capability mass of Z inside W; the composed Hand probability is P(W) = Pc(W) × Ph×Pd. (A conditional variant renormalizing on no-CRQC-today, Pc(W)/(1 − Pc(today)), is more aggressive; the unconditional form is used here as the conservative default.) In the accompanying article's terms, W is the organization's own remaining slice of the Shor–Q-Day window: the global interval, open since Shor's 1994 proof and closing at Q-Day, within which harm is foreseeable but not yet manifest.

Sliding vs. frozen. Until migration commences, the right edge is today + X + Y and W slides up the rising curve daily. Commencement freezes the right edge at start + X + Y; W then shrinks as the left edge (today) advances. The procrastination premium is P(W today) − P(W at awareness), both read on the current report's curve.

Awareness anchors & the notice gradient. The awareness date sets where D begins. The selector offers dated public signals — statutes and regulations in force, standards publications, intergovernmental statements, threat surveys, and industry deployments — each carried with its citation in the tool's data files. Which signal starts a particular organization's clock is a legal argument, not a computation: the tool takes the date you select (or your own documented date) and reports the consequences. The documentation block includes the full ladder — D measured from every listed signal — because the reasonableness of a claimed awareness date is naturally tested against the public record that preceded it. Step 2's notice strip — drawn directly above the awareness slider, sharing its 2015–today track, so the thumb climbs the record it selects from — plots that record as a cumulative step line: counts, not weights — each signal adds one step regardless of tier, because assigning relative evidentiary weight to a regulation versus a product deployment is an argument for counsel (and the accompanying article), not a datum this tool asserts. The strip notes the epistemic tier separately, in a caption on its baseline — Shor's algorithm (1994) and the founding of post-quantum cryptography as a field (2006): the issue's coming-into-existence, which per the accompanying article's two-boundary framework precedes any duty and is deliberately not selectable as an anchor. Existence made the harm foreseeable; it did not start anyone's clock. One boundary within the record carries structural weight: NIST announced the finalized FIPS 203, 204, and 205 on August 13, 2024, and migration to the finalized standards could not have commenced before they existed (announced August 13; published in the Federal Register August 14 — 89 Fed. Reg. 66,052 (Aug. 14, 2024)). D measured from an earlier anchor therefore decomposes into two clocks: notice delay — the aggregate name for the anchor-to-finalization stretch, time on notice while the finalized standards did not yet exist — and feasibility delay — finalization to commencement, time the standards existed and migration to them had not begun. When a governance date is documented, the notice-delay stretch resolves further into governance delay (anchor to first minuted engagement — notice accruing with no recorded response) and preparation runway (governance to finalization — documented diligence, excluded from D by definition: a number labeled procrastination must not include diligence, or it impeaches itself). Notice delay and governance delay are never interchangeable — the first is the undifferentiated aggregate, the second the culpable component a governance record isolates. Without a documented governance date the tool credits no runway: undocumented governance earns zero credit, the same conservative-default pattern as the harvest-and-prioritization factor. The strip marks the boundary with a dashed rule, the D counter reports the split, and the documentation block flags pre-standards anchors. See Post-Quantum Negligence §III.A (two-clock decomposition of the procrastination variable). The boundary is an argument marker, not an absolution: cryptographic inventory, crypto-agility, and vendor engagement were feasible throughout the notice period, and pre-standard deployments on draft-stable algorithms — Chrome's X25519Kyber768 hybrid (Chromium Blog, Aug. 10, 2023), Signal's PQXDH (Sept. 19, 2023), and Apple's iMessage PQ3 (Feb. 21, 2024, expressly framed against harvest-now-decrypt-later) — show migration-adjacent action was possible before finalization; evidence each side will read its own way. Feasibility was also organization-relative: this boundary marks the earliest theoretical date — the standards' existence — while organizations dependent on vendor libraries, HSM firmware, or certified implementations faced feasibility dates trailing into 2025–2026 (HQC selection and vendor availability; FN-DSA still pending). The educational edition keeps the single global boundary as the conservative, simple reading; per-organization feasibility dating is enterprise advisory territory. The full record, with citations and per-event anchor selection, is in the constructive-notice timeline beneath the D control; the duty-side logic — foreseeability → notice → duty → breach — is laid out in the “From Foreseeability to Duty” panel at the top of the page.

Crossing date t*. The first calendar date at which the sliding window's mass reaches R, found by forward scan with bisection refinement on each interpretation curve. If the mass already exceeded R at the report's publication, the crossing is reported as "at or before publication" rather than extrapolated to dates predating the survey.

Theoretical lineage. The window construction restates Mosca's Theorem — exposure when x + y > z — in probabilistic form. Michele Mosca, Cybersecurity in an Era with Quantum Computers: Will We Be Ready?, 16 IEEE Security & Privacy 38 (2018). The procrastination variable D adopts the augmentation introduced by Jaime Gómez García, Chair of the Europol Quantum Safe Financial Forum, within the FS-ISAC PQC Working Group's collaborative work — the Mosca-Gómez formulation, x + y + D > z (D is the formulation's delay term, elsewhere rendered p_delay). Under the article's own definition — delay from when migration could have begun — the formulation's delay term corresponds to D_f, the feasibility delay; governance delay D_g enters the inequality only through spillover (preparation unfinished at finalization lengthens D_f) and enters the law through the fiduciary lens (companion article in progress). See FS-ISAC PQC Working Grp., The Timeline for Post-Quantum Cryptographic Migration (Nov. 2025); Jaime Gómez García, Perspectives on the Transition to PQC in the Financial Sector, PKI Consortium PQC Conference (Jan. 16, 2025).

Benchmark sources for B and L presets. Burden: OMB/ONCD, Report on Post-Quantum Cryptography (July 2024) (~$7.1B for federal civilian systems, 2025–2035); sector program models of $50–300M+ for a single large operator. Loss: IBM, Cost of a Data Breach Report 2025 (U.S. average $10.22M; healthcare and financial costliest); Anthem 2015 breach aggregate ≈$171M ($115M class settlement + $16M OCR + $39.5M multistate AGs); UnitedHealth/Change Healthcare attack cost estimate $3.09B; Citi Institute (Feb. 2026) (systemic damage of a quantum-enabled attack on a major U.S. bank: $2.0–3.3T). Preset values are deliberately conservative within these ranges and are illustrative, not firm-specific.

Threshold logic. Liability exposure indicated when R < P(W), where R = B/L — algebraically the Learned Hand condition B < P×L for L > 0 (United States v. Carroll Towing Co., 159 F.2d 169 (2d Cir. 1947)), with P made organization-specific as the composed window probability Pc(W) × Ph×Pd.

Severity taper (future refinement). Arrival early in W (before migration completes) is catastrophic; arrival late in W harms only not-yet-expired harvested data, decaying to zero at the right edge. This refines L, not P, and is reserved for the enterprise analysis.

This is an educational framework for one negligence-analysis lens. It does not model: regulatory compliance mandates (NIST, NSA CNSA 2.0, sector-specific rules); industry standards and peer behavior; insurance coverage and requirements; vendor and ecosystem readiness; technical feasibility of migration for specific systems; data classification nuances (different data types carry different X); operational impacts during migration; or the severity taper within the window (early CRQC arrival is catastrophic, late arrival harms only unexpired harvested data — an expected-loss refinement reserved for enterprise analysis). Relatedly, a scalar P_h×P_d applied across the whole window underweights late-window arrivals: P_d ramps up across W just as the severity taper ramps L down across it — both within-window gradients are scalar-simplified here, conservative in opposite directions, and both are enterprise refinements.

Recommended next steps: consult qualified legal counsel on your risk profile; engage cybersecurity experts on feasibility; review applicable regulatory requirements; conduct data classification to identify HNDL-sensitive holdings; and document your decision-making process regardless of the timeline you choose — the documentation itself is the governance.

Resources: NIST Post-Quantum Cryptography Project · NSA CNSA 2.0 Advisory · GRI / evolutionQ Quantum Threat Timeline Reports · Mosca, Cybersecurity in an Era with Quantum Computers, 16 IEEE Sec. & Priv. 38 (2018) · United States v. Carroll Towing Co., 159 F.2d 169 (2d Cir. 1947) · FS-ISAC PQC Working Group publications.