Beautifully hackable

On July 1st this year, the FBI issued a private industry notification with the title Expansion of US Renewable Energy Industry Increases Risk of Targeting by Malicious Cyber Actors.

In it, the Bureau warned that the more wind and solar installations get built, the more targets cybercriminals will have the pleasure of exploiting. The report noted one incident with “lost visibility” to utility-scale wind and solar installations of a total 500 MW as example of the risks inherent in the buildout of alternative energy systems, although it noted it was unclear whether the incident was a deliberate attack on the operator or just a hacker’s exercise.

Deliberate or not, the incident highlighted yet another problem with wind and solar — and EVs, EV chargers, and battery installations. All of these are hackable. Because all of these rely on a lot of software to function.

As someone with a severe softwaric deficiency, I’m probably the last one to discuss the cyber vulnerabilities of wind and solar. But as it happens, I used to write about cybersecurity a few years ago and as I later started covering the blooming industry of wind, solar, and EVs, I wondered about cybersecurity. After I wondered, I talked to people with expertise in the field. It’s good to see that barely three years after my first story on the topic the FBI found it necessary to issue an official warning. The White House followed almost immediately.

Before I delve into these warnings and the risks, here’s the gist of the whole cyberthreat thing: if we visualise energy systems as chains, the more links a chain has, the more places it can break.

Wind and solar installations (and EV chargers, and batteries) have more links than a power plant, because they are scattered all over the place, meaning they have more potential access points for hackers. And EVs? Every EV is an access point. And so is every EV charger. Ditto smart meters. The transition is nothing if not exciting. Vive le software and all that.