You cannot copy it

A four-line proof, provoked by a paper the referee recommended publishing because he knew it was wrong. It forbids backing up a qubit, protects relativity from faster-than-light messages, and underwrites a form of secrecy that does not depend on any assumption about your opponent.

1981 – today18 min

By the end you should be able to

Reproduce the no-cloning proof and identify the single property it relies on
Explain why no-cloning is what keeps quantum mechanics consistent with relativity
Say what makes quantum key distribution secure, and what it does not protect

This one begins with a paper that was wrong. In 1981 Nick Herbert submitted a scheme called FLASH — First Laser-Amplified Superluminal Hookup — claiming to send messages faster than light. The idea is not silly. Alice measures her half of an entangled pair along an axis of her choosing, which leaves Bob's half in a state that depends on that choice. Bob cannot detect the difference from a single particle, because one measurement yields one bit and the statistics come out 50/50 either way — that is the no-signalling result from three lessons ago. But if Bob could copy his particle, he could make many copies, measure them in different bases, and reconstruct which axis Alice had used. A message, arriving instantly. So the scheme reduces to a single question: can you copy an unknown quantum state?

The referee who published it anyway

The referee was Asher Peres, and he recommended publication while being confident the paper was wrong. His reasoning, given years later: the argument was clearly presented, the error was not obvious, and he could not immediately locate it himself. A quiet rejection would bury a stimulating mistake; publication would provoke someone into finding the flaw, and that would be worth more than the paper cost. He was right. Within a year two independent papers — Wootters and Zurek, and Dieks — refuted it, and in doing so established the no-cloning theorem, which is now foundational. Peres later wrote that he was not sorry to have been the referee of this paper, "because its lasting effect was a spurt of research". It is a good argument for treating publication as a means of getting things checked rather than as a certificate of correctness.

It is linearity that forbids it

Notice what the proof does not use. Not uncertainty. Not measurement. Not observers, or disturbance, or anything about what happens when you look. Those appear in every popular gloss on this theorem and none of them is required. The single property used is linearity — that the evolution of a sum is the sum of the evolutions. Which is the same property that makes superposition possible at all. The feature that lets a qubit be in two states at once is exactly the feature that prevents you from copying it. You cannot keep one and discard the other. And this is not merely tidy. If quantum mechanics were even slightly non-linear, cloning would become possible — and, as the next section shows, so would faster-than-light signalling. Several people have proposed non-linear modifications of the Schrödinger equation over the years, and this is why they are hard to make work: the modification tends to break relativity as a side effect.

What the theorem is holding up

Go back to Herbert's scheme, because he was not being careless. FLASH would work if cloning were possible. The reasoning is sound; only the premise is false. So the no-cloning theorem is not an incidental limitation that happens to be true. It is load-bearing. Quantum mechanics permits correlations that no local theory can reproduce — that is Act 7 so far. Relativity forbids sending information faster than light. Those two facts coexist without contradiction, and no-cloning is a substantial part of why: it is precisely what prevents the correlations from being converted into a signal. That is an unusually satisfying situation. A four-line argument from linearity turns out to be what keeps the two great theories of the twentieth century from contradicting each other.

Measure the qubit. You cannot copy it, and this is what happens if you look at it instead.

Loading the sphere…

The two ways you might protect a classical bit are both unavailable. You cannot duplicate a qubit — that is the theorem. And you cannot inspect one to check whether it is still correct, because measuring returns a single bit and destroys the state.

You might think

Since qubits cannot be copied or inspected, quantum error correction is impossible.

Actually

This was widely believed for about a decade, and it is wrong — though the objection is a good one. Classical error correction works by copying a bit several times and taking a majority vote, and both halves of that are forbidden here. Shor in 1995, and Steane independently, found the way through. You spread one qubit’s information across several entangled qubits, so that no individual qubit holds the state. Then you measure relationships between the qubits — parity checks — rather than the qubits themselves. Those measurements reveal that an error occurred and which qubit it struck, while revealing nothing about the protected state, and therefore without collapsing it. It is the equivalent of detecting that a page has been altered without reading the page. Error correction is now the central engineering problem of the field, and the reason useful machines need thousands of physical qubits per logical one.

What "secure" means here

The word unbreakable gets used carelessly about this, so it is worth being exact about the difference. Ordinary public-key encryption is secure because factoring large numbers is believed to be computationally hard. That is an assumption about mathematics — nobody has proved factoring is hard — and an assumption about your opponent's resources. Shor's algorithm is precisely an attack on it, which is why the field is funded. Quantum key distribution rests instead on the impossibility of copying an unknown state. That is a physical prohibition, derived from linearity, not a conjecture about computational difficulty. An adversary with unlimited computing power, unlimited time and perfect technology still cannot do it. That is a genuinely different kind of guarantee, and it is rare. Almost nothing else in security has it.

You might think

Quantum key distribution is unbreakable, so a system using it cannot be compromised.

Actually

The theorem covers the qubits in flight and nothing else. It says nothing about whether your single-photon source occasionally emits two photons, whether your detector has a timing side-channel, whether your random number generator is trustworthy, or whether somebody has interfered with the hardware. Real commercial systems have been broken by attacks on exactly these — most elegantly by shining bright light at the detectors to blind them into behaving as classical devices, after which the eavesdropper controls what Bob records. None of these attacks violate the theorem; they route around it. The physics is secure; the engineering is engineering, and the engineering is where systems fail. This is not a criticism of the technology so much as a general lesson: a proof about one component is not a guarantee about a system.

The experiment

Entanglement distributed from orbit, over 1200 km

Juan Yin, Jian-Wei Pan and colleagues, using the Micius satellite · 2017 · Low Earth orbit; ground stations at Delingha and Lijiang, 1,203 km apart

The question: Do entangled pairs survive distribution over intercontinental distances through free space — and do the correlations still violate Bell’s inequality after that journey, which is what security in the Ekert protocol actually rests on?
The apparatus: A 600 kg satellite in a 500 km sun-synchronous orbit carrying an entangled photon source, producing about 5.9 million pairs per second, with the two photons sent to separate ground stations through independent telescopes. Optical links had to be maintained to microradian pointing accuracy while the satellite moved across the sky, and the whole thing works only at night in clear weather.

Theory predicted

Atmospheric loss and pointing error make the link efficiency extraordinarily poor. If entanglement survives, the measured correlations should still violate the CHSH bound of 2; if decoherence or loss destroys it, they will not.

They measured

Entanglement was distributed to both stations simultaneously, with a measured CHSH value of S = 2.37 ± 0.09 — a violation of the classical bound by about 4 standard deviations. The link delivered roughly one usable pair per second out of 5.9 million emitted — an efficiency of about 2 × 10⁻⁷.

How sure could they be? Modest by laboratory standards, and that is the point: 4σ over 1,203 km through the atmosphere, where the best terrestrial fibre links had managed a hundred kilometres or so. The two-photon link is about seventeen orders of magnitude more efficient than the same distance through optical fibre, where 0.2 dB/km over 1,203 km amounts to 241 dB of attenuation — because atmospheric loss is concentrated in the lowest ten kilometres and the rest of the path is vacuum.

Why it mattered

It makes entanglement-based key distribution a practical proposition at continental scale, and it demonstrates that entanglement is not a fragile laboratory artefact — it survives a 1,200 km trip through free space and a satellite in motion. The same programme subsequently used the link for key exchange between Beijing and Vienna. That is a considerable distance from a philosophical dispute in 1935 about whether particles have properties before anyone looks.

Ekert's 1991 refinement is worth understanding, because it connects this act's two halves. Instead of Alice preparing states and sending them, both parties receive halves of entangled pairs and measure them. The shared key comes from the correlations. And the security check is a Bell test: some of the measurements are used not for the key but to compute S. If the correlations violate the inequality, then no local hidden-variable model can reproduce them — and an eavesdropper holding a classical record of what the values "really were" is precisely such a model. So a Bell violation certifies that no one has such a record. The security follows directly from Bell's theorem. Pushed to its conclusion this becomes device-independent cryptography: you need not trust the apparatus at all, nor know how it works, nor believe the manufacturer. You need only observe that the statistics violate the bound. That is an extraordinary standard — security that survives being handed equipment built by your adversary.

1981Herbert’s FLASH proposal. Peres recommends publishing it, believing it wrong.
1982Wootters & Zurek, and Dieks independently, prove no-cloning.
1984Bennett and Brassard propose BB84.
1989First working demonstration — over 32 centimetres of air.
1991Ekert bases the security on Bell violation instead.
1995Shor shows error correction is possible without copying.
2007Used to protect an election count in Geneva.
2017Micius distributes entanglement over 1,203 km from orbit.

Where this leaves us

A four-line argument from linearity turns out to do a remarkable amount of work. It forbids backing up a qubit, blocks the obvious approach to error correction, keeps quantum mechanics consistent with relativity, and underwrites a form of secrecy that holds against an adversary with unlimited resources. And all of that assumes the qubits survive long enough to be used. They mostly do not. We met the reason in Act 6: nothing is ever isolated, and correlation with an unwatched environment destroys interference. A dust grain is struck by air molecules 10¹⁸ times a second. A qubit is enormously more delicate than a dust grain, and the phase — the invisible parameter where the entire advantage lives — is the first thing to go. That is the central engineering obstacle of the whole field, it is why quantum computers are refrigerated to within a hundredth of a degree of absolute zero, and it is the next lesson.