Renewable technologies add risk to the US electric grid, experts warn

In congressional testimony, experts warned about the potential cyberthreats from tech needed for the grid transformation.

Technologies that underpin solar and wind energy storage systems, which are central to transferring renewable power to the grid, are potential hacking risks, experts noted at a congressional hearing Tuesday.

As the U.S. grid is undergoing a major digital and generation transformation, the reliance on inverter-based resources is a major point of weakness since the equipment is both digitally native and because China is a major manufacturer many of those devices, said Paul Stockton, former Assistant Secretary of Defense, said during the hearing.

“Manufacturers in China are important producers of inverters being deployed nationwide across the United States and I think looking at supply chain risks — not just availability of critical products — but the risks that China will exploit these products in order to conduct attacks on the grid,” Stockton told the members of the House Committee on Energy and Commerce.

While the threat vector from inverter-based generation may be only a small portion of total electricity generation — roughly 14% — those numbers are expected to go up in the coming years.

The inverters convert direct current (DC) electricity generated by solar panels to alternating currents (AC) that is used by the electric grid. Inverters also distribute power based on software that identifies the state of the grid, a boon for efficiency but come with security concerns, according to a 2022 Energy Department study on the cybersecurity of distributed energy resources.

The report also noted that “distribution rooftop solar and large-wattage, customer-owned devices present new attack potential, can aggregate to magnitudes like traditional resources, and will challenge traditional cyber defense postures through their administration by many different parties.”

“If we can secure those devices we have an opportunity to transition to a stronger resilience strategy to defend the grid and make sure that we can counter the objectives of our future adversaries,” according to Stockton prepared opening remarks.

The hearing comes on the same day the Biden administration announced a labeling system for “smart” devices such as home appliances. But the Department of Energy also announced that it will look at power inverters for the initiative to develop cybersecurity labeling.

“Today’s announcement marks an important milestone in our journey toward a more secure energy sector to benefit all Americans,” said Puesh Kumar, Director of the DOE Office of Cybersecurity, Energy Security, and Emergency Response in a statement. “We look forward to partnering with the Federal Communications Commission, the Cybersecurity and Infrastructure Security Agency, DOE National Laboratories, and our industry partners to advance the cybersecurity of energy systems.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Election official says Tina Peters would be consultant, won’t have access to election systems