Cyber flaws in solar systems pose risks to Swiss power grid

Industry association Swissolar has called for binding cybersecurity standards as well as a central registry tracking the share of electricity generation that can be controlled remotely. Keystone / Christian Beutler

Solar power is a cornerstone of Switzerland’s energy transition, with more than 338,000 photovoltaic systems connected to the grid. But according to experts at the National Test Institute for Cybersecurity (NTC), weaknesses in critical components could be exploited to disrupt parts of the national power network.

The warning comes from an as-yet unpublished NTC study obtained by Swiss public television SRF.

The concern centres on the inverter, the device that controls the photovoltaic system and converts the direct current generated by solar panels into alternating current needed by the Swiss electricity grid. The inverter is effectively the system’s brain.

According to experts from the Swiss non-profit organisation, that’s precisely where the risk lies. Most modern inverters are permanently connected to the internet through integrated communication modules and communicate directly with servers operated by their manufacturers.

Andreas Leisibach, a cybersecurity expert at NTC, says those connections allow inverters to be controlled remotely.

“This can be used for legitimate purposes, but also maliciously, for example to switch off or manipulate a device,” he told SRF.

The NTC has, for the first time, examined the cybersecurity of solar inverters used in Switzerland. It concludes that the vulnerability is particularly worrying because a large share of devices comes from only a handful of manufacturers, creating what experts describe as a concentration risk.

Heavy reliance on Chinese-made inverters

The Federal Office of Energy estimates that around 100,000 Swiss solar installations are equipped with inverters from the same country of origin: China. Detailed data has only recently begun to be collected, but the market share of the two Chinese manufacturers Huawei and Sungrow has risen to more than 60%.

For Raphael Reischuk, founder of the NTC, that concentration is problematic.

“Whoever controls the inverter controls the entire installation, and ultimately has influence over the electricity grid,” he said.

Reischuk says that a simultaneous shutdown of all devices from a major manufacturer while operating at full capacity could threaten the stability of Switzerland’s power grid. He stresses that manufacturers themselves may have no economic incentive to do so. But they could potentially be forced into such actions by state actors or by cybercriminals seeking to extort them.

The scenario is not purely theoretical. In a previous case, a Chinese manufacturer remotely disabled large numbers of inverters in the United States and other countries during a commercial dispute. Affected users were confronted with an error message stating: “Not allowed to use”.

Today, more than one in every two newly installed inverters in Switzerland comes from Huawei.

At the Bern vocational school, for example, solar company Clevergie is currently installing a new rooftop photovoltaic system using Huawei inverters. CEO Lukas Meister says the products are both reliable and competitively priced.

The concentration risk created by thousands of similar installations, however, is not something that individual customers or even the industry can solve on their own, he argues.

Manufacturers reject security concerns

What do Chinese manufacturers say about the safety concerns?

Sungrow did not answer questions submitted by SRF. Huawei declined an on-camera interview but stressed in writing that cybersecurity is its “highest priority”.

It wrote: “The operation of our systems in Switzerland is carried out by our customers (…). Depending on the requirements, these systems can be operated via a secure, encrypted connection to the manufacturer’s management system (…) or in offline mode.”

For cybersecurity experts, however, offline operation is often impractical.

US and EU are taking action

Other countries are already responding to the risks. In the United States, President Donald Trump declared a national emergency relating to the high-voltage electricity grid. Among other measures, new rules prohibit the installation of grid-connected inverters from countries subject to an arms embargo or sanctions, including China. Operators could even be required to remove already installed devices.

The EU is also starting to take action. Projects using Chinese inverters are no longer eligible for certain funding programmes. EU Commission spokesperson Siobhan McGarry says security risk assessments have confirmed the potential threat, including the possibility of manipulation of electricity production. In practice, this could mean a remote shutdown of the grids and thus nationwide blackouts.

Underlying these concerns is Chinese legislation, requiring companies to cooperate with state security agencies. Critics say that Beijing could force manufacturers to remotely disable solar systems in Europe in the event of a conflict.

Swiss intelligence service issues warning

In Switzerland, the Federal Intelligence Service (FIS) has also raised concerns. In a recent report, it warns that if Switzerland protects its critical infrastructure less effectively than the EU, the country could become a preferred target for cyberattacks.

Yet public authorities continue to rely on Chinese technology. The canton of Bern’s building department structured the tender for the cantonal vocational school in such a way that effectively only left Huawei as the only viable option for an inverter. The department rejects the claim that a specific manufacturer was prescribed. But it acknowledges that cybersecurity is “still not very well anchored” in procurement processes. Excluding Chinese manufacturers could amount to discrimination, since public contracts must be awarded to the “most advantageous offer”.

Reischuk stresses that the NTC study should not be interpreted as an argument against the expansion of renewable energy. But it is intended as an appeal for more caution when choosing technologies.

The Swiss Federal Office of Energy broadly agrees with the findings, acknowledging that the risk of a coordinated attack cannot be ruled out. Industry association Swissolar has also reached a similar conclusion and is calling for binding cybersecurity standards as well as a central registry tracking the share of electricity generation that can be controlled remotely.

Translated from German, sub-edited by Simon Bradley/ac