Here is the original study: Restrict Remote Access of PV Inverters from High-Risk Vendors
The European Solar Manufacturing Council (ESMC) has issued a stark warning, highlighting a critical threat to Europe’s energy autonomy stemming from the unregulated remote access capabilities of PV inverters produced by non-European, high-risk manufacturers—particularly those from China. A recent study by DNV substantiates these concerns.
As solar power becomes increasingly integral to Europe’s clean energy goals and energy security, a major vulnerability looms: software-enabled remote access to PV inverters—the essential control units of solar power systems.
[…]
The threat is real, not hypothetical. Internet connectivity is essential for modern inverters to perform grid support functions and participate in power markets. However, this connectivity also enables remote software updates, allowing manufacturers to potentially modify device performance from afar. This poses serious cybersecurity risks, including the danger of intentional disruption or large-scale shutdowns. A recent DNV report, commissioned by SolarPower Europe, highlights the credible risk of cascading blackouts due to coordinated or malicious manipulation of inverters.
The US cloud act and the US Patriot Act
Especially with just about every comsumer electronic regularly sending all your data to their servers, these laws are nothing but a backdoor with extra steps.
The CLOUD Act is to allow data stored outside the US by US-based cloud providers to be accessed by selected foreign countries that have issued subpoenas and have requested US government assistance. It’s not a backdoor per se, and anyone with any sense encrypts their data before uploading it to the cloud instead of relying on cloud provider encryption services. Even if the US government weren’t snooping, there’s the risk that a cloud provider could be compromised by other hostile actors. Though it’s not all that wise to assume that cloud providers’ encryption services don’t have backdoors, unless that’s been confirmed by an impartial third-party audit. I know of no such audits.
The PATRIOT Act is a human-rights nightmare for many reasons, but doesn’t grant the US government anti-privacy powers that the CLOUD Act doesn’t. It’s just more vaguely worded.
And if you really want some worse Kafkaeque misery, FISA warrants will give you plenty if your or your firm’s name is on one.
The CLOUD Act and Patriot Act contradicting GDPR is the reason why the EU needed the various Privacy Shields to give some legal basis for declaring data transfers to the US legal.
And no, most people don’t encrypt their data before uploading to US cloud providers. That’s the issue.
/f
Yeah ok. Thanks for clearing that up, I thought I missed something else. Yeah that’s pretty bad and it’s mind blowing how nobody cares in Europe and every new PC/Laptop is sold with Windoz and every big Company has all its assets in Micråsoft infrastructures…