“Harvest now, decrypt later” is one of the main reasons the US government has ordered its cryptography replaced before anyone has built the computer that would break it. An adversary collects encrypted data today and waits for quantum hardware to mature, so the theft and the harm can sit years apart, and federal agencies are working to deadlines of 2030 to 2035.

The general form deserves more attention than the quantum case, or even the broader adversarial case: harvest now, analyse later (HNAL). It doesn’t seem to have a standard name.

I came to it from the friendly side. Keeping scans of a handwritten journal alongside the machine transcript, in case a future model reads my handwriting better, is the same bet an attacker makes. The rule is the same in both directions: keep the rawest form plus enough labels to find your way back, since a transcript can be made from the scan whereas the scan can’t be rebuilt from the transcript.

Archives, stolen or public

The attacker’s version needs no new physics, and much of the material isn’t encrypted at all, since what protected it was that nobody had time to read it.

Robin Brattel, chief executive of the breach-intelligence firm Lab 1, told CSO that “the sheer amount of time required to sift through breached datasets and the expertise needed to spot compromising information has held back the weaponization of data breaches”, and that brake is going: Google reports the extortion group ShinyHunters using Claude Code “to parse and analyze exfiltrated directories for extortion”, and in 2025 the head of the Identity Theft Resource Center said criminals were “going back and looking at the data they’ve already stolen”.

Old hauls do get reworked: data the same group stole from AT&T in 2021 was re-released in 2025 with each customer’s Social Security number and date of birth, previously held in separate files, joined to their record, across about 49 million phone numbers. What AI changes is the labour, so each new model gets another pass at whatever copies survive.

In the 2022 Medibank breach, Australia’s privacy regulator alleges that health claims data, including diagnosis and procedure numbers, went onto the dark web. A password can be changed whereas a diagnosis can’t, so this data remains vulnerable to HNAL.

Public posts need no theft at all, since much of what was written under a pseudonym years ago is still sitting on the open web for better tools to read. In a USENIX Security paper, language models linked pseudonymous accounts at up to 55% recall and 90% precision, against near 0% for the best non-LLM method, for less than $5 an account.

Emerging analysis of unreadable traffic

A concerning example is Whisper Leak, published by Microsoft researchers in 2025. Someone watching your network, such as an ISP or a person on the same Wi-Fi, decrypts nothing but instead infers the topic of an AI chat from the size and timing of the encrypted packets as the reply streams back. The test topic was the legality of money laundering, and across 28 models the classifier often scored above 98% on a standard measure. In a simulation of one target conversation among 10,000, many models let the attacker catch at least 5% of target conversations with no false alarms, though Microsoft stresses these are projections from test data and also calls them “a baseline risk level”, since the attack improved with more training data.

OpenAI, Mistral, xAI and Microsoft have deployed protections, which cover traffic from that point on but can’t do anything for recordings made earlier. Granted, exploiting those recordings would need captures made in advance plus a classifier for each model as it then was. It is still a form of the analyse-later structure, applied to a channel where people discuss private matters like their health and finances.

Limits and arms race

Models misread, and ShinyHunters blamed AI for overstating how sensitive its haul from the US insurance regulators’ association was. Addresses and passwords go stale, and defenders run the same tools over leaks to work out who to warn.

What follows

NIST’s planning rule for the quantum case compares how long data must stay secure, plus the time needed to migrate, with when the capability to break it arrives. For material protected only by the labour of reading it, that capability is already here, which leaves retention as the main lever: data deleted before the theft can’t be analysed by any future model. Storage is cheap, so the default is to keep everything, and a retention schedule shows how an organisation has priced this risk.

For individuals, the same logic means closing old accounts and requesting deletion where you can, assuming pseudonymous writing can be linked to you, and keeping sensitive AI chats off untrusted networks.

The friendly case runs the same logic in reverse, and it matters most for material nobody else holds. A studio can rescan a film from its negative, whereas the only copy of a 1990s camcorder tape of your grandparents, a cassette of a relative telling a story, or a box of negatives and letters is the one in your cupboard, and the tape is degrading. The harvest there is to capture it now at the highest raw fidelity you can, and the analysis can wait: today’s upscale, transcript or guess at who is in the frame is a view that can be regenerated once the tools improve, provided the raw capture and the original survive. That is the same retention which becomes a liability once a copy leaves your hands, so the question is less whether to keep than where, and an offline copy is the cheap answer, since nothing can be harvested from a drive that was never on the network.