New cybersecurity standards for solar inverters, battery storage and electric vehicle chargers are being developed by the federal government to improve the security of Australia’s energy supply, which is increasingly exposed to compromise.
Department of Climate Change, Energy, Environment and Water (DCCEEW) officials on Monday confirmed that a departmental team had been stood up to work with Standards Australia on the security issues facing distributed energy resource (DER) technologies.
DER technologies are defined by the Australian Renewable Energy Agency as “renewable energy units or systems that are commonly located at houses or businesses to provide them with power”.
They include rooftop solar photovoltaic units, batteries, electric vehicle chargers, biomass generators and other ‘behind the meter’ energy technologies used installed at the site of the user.
While Standards Australia has already completed a cyber standards gap analysis and a roadmap for introducing new standards, work to develop the new standards “for the Australian market” has now commenced, DCCEEW’s acting head of the energy performance and security division, Martin Squires, told Senate Estimates.
Solar inverters, which converts the DC electricity from the solar panel to AC electricity used in the grid, and other DER technologies connected to the internet were flagged as a risk by the Cybersecurity Cooperative Research Centre in a report published in August 2023.
“Solar inverters are vulnerable to a range of cyber intrusions including hacking, malware attacks, manipulation and disruption. Therefore, as the number of homes with solar systems continues to increase, the risk associated with solar inverters continues to grow,” the report reads.
As the adoption of DER technologies increase, so too will the “cyber-attack surface of solar systems”, potentially increasing the risk of a damaging cyber-attack on Australia’s energy supply. The South Australian, Western Australian, and Queensland governments already require that all new or upgraded solar panels are capable of being switched off remotely.
The CSIRO and Energy Networks Australia estimate that DER could account for up to 45 per cent of generation capacity by 2050.
Mr Squires told the Senate during the October round of estimates that Standards Australia had been commissioned to develop “additional cyber standards for rooftop inverters”. At the time he stated that the work was funded in the October 2022 Budget.
DCCEEW secretary David Fredericks clarified that work to develop standards for other distributed energy resource technologies was also underway.
“The work that our department is leading is very much focused on a technical standard solution for rooftop inverters and other devices… and we work with other entities to assist us with that,” Mr Fredericks said.
Mr Fredericks also clarified the delineation of cybersecurity policy responsibilities between departments.
The Department of Home Affairs is responsible for “critical cyber issues” such as foreign interference in energy infrastructure, while the Department of Industry, Science, and Resources will look at improving supply chain vulnerabilities through the National Reconstruction Fund. More than 70 per cent of solar inverter shipments reportedly originate from China.
Home Affairs is currently developing a whole of economy framework to undertake cyber risk assessments for technology, as a part of the action plan for the 2023-2023 Australian Cyber Security Strategy.
Under questions from Liberal Senator James Paterson during a different Senate Estimates hearing on Monday, Home Affairs also noted that they were looking to review the Protective Security Policy Framework as it relates to technology management.
