Harvest-now-decrypt-later for SCADA telemetry

Executive Order 14412 (June 22, 2026) names harvest-now-decrypt-later (HNDL) as the threat that makes post-quantum migration urgent: adversaries recording encrypted traffic today in order to decrypt it once a cryptographically relevant quantum computer exists. This technical note asks whether HNDL matters for the telemetry that moves between a pipeline control center and its field sites. It first notes that much SCADA traffic (Modbus, DNP3) still crosses links unencrypted, which is a present-day exposure regardless of quantum computing. It then locates the quantum-vulnerable public-key operations in typical pipeline telemetry paths (IPsec/IKEv2 WAN VPNs, TLS under IEC 62351-3, OPC UA secure channels, cellular and satellite backhaul, and DNP3 Secure Authentication's asymmetric update-key change), applies Mosca's inequality to classify telemetry by how long it stays sensitive, and distinguishes the HNDL confidentiality risk from the separate long-term risk to signing keys and roots of trust. Using parameter sizes from FIPS 203 and FIPS 204, it quantifies the bandwidth cost on narrowband OT links: an ML-KEM-768 key exchange moves 2,272 bytes versus 64 bytes for X25519 (about 36 times more), taking about 1.89 seconds at 9,600 bps; an ML-DSA-65 public key plus signature is 5,261 bytes (about 4.38 seconds at 9,600 bps). It closes with six prioritized actions: close cleartext gaps, prefer hybrid key exchange, use AES-256 on long-lived links, reduce what is worth harvesting, rank links by data shelf life, and question vendors and carriers on ML-KEM support. Calculations are reproducible from an open script. Issue 02 (October 2026 slot) of Quantum-Safe Pipeline Notes, a monthly technical blog on post-quantum cryptography and OT security for U.S. pipelines. Uses public sources only; views are the author's own and do not represent any employer or client.