FBI issues warning on rising cyber threats to U.S. renewable energy sector

As renewable energy continues its rapid expansion across the United States, a new concern has emerged: the vulnerability of these systems to cyberattacks.

The FBI recently issued a warning highlighting the growing threat as more Americans and private entities invest in renewable power, spurred by government incentives like the Inflation Reduction Act. While this shift marks significant progress in the fight against climate change, it also introduces new risks that could impact the nation’s energy security.

Surge in renewable energy adoption

The adoption of renewable energy has surged in recent years, driven by federal incentives to reduce carbon emissions.

Electricity generation is the process of generating electric power from sources of primary energy.

According to the U.S. Energy Information Administration (EIA), renewable energy sources, including wind and solar, accounted for 21% of U.S. electricity generation in 2023. The Inflation Reduction Act, one of the most significant drivers of this growth, offers substantial tax credits and financial incentives for both individuals and businesses to invest in clean energy systems.

However, the rapid proliferation of these systems has outpaced the development of security protocols that traditionally safeguard utility infrastructure. Unlike conventional power grids, many of these new systems are privately owned and operated, often lacking the stringent regulations imposed on established utilities. This gap in oversight presents a lucrative target for cybercriminals.

Vulnerabilities in the renewable energy sector

The FBI’s warning is not without precedent. As early as 2019, a private operator of renewable energy systems lost control of approximately 500 megawatts of wind and solar sites across California, Utah, and Wyoming. While hacks against residential solar power have been rare, the rise of microgrids—localized energy systems that operate independently of traditional utilities—introduces new vulnerabilities.

The EIA estimates that small solar systems, primarily rooftop installations, generated 73.62 billion kilowatt-hours of electricity in 2023. These systems, which are increasingly connected to the internet, could be prime targets for hackers seeking to disrupt energy supply.

One particular point of concern is the operational technology (OT) used in solar power systems, specifically inverters. These devices convert direct current (DC) from solar panels into alternating current (AC) for household use. When connected to the internet, hackers can manipulate inverters to either reduce output or overheat systems, potentially causing widespread damage.

A growing cybersecurity challenge

The Solar Energy Industries Association® is the national trade association of the U.S. solar energy industry, which now employs more than 250,000 Americans. Through advocacy and education, SEIA® is building a strong solar industry to power America. SEIA works with its 1,000 member companies to build jobs and diversity, champion the use of cost-competitive solar in America, remove market barriers and educate the public on the benefits of solar energy.

The renewable energy industry’s rapid expansion is happening in a landscape where cybersecurity is still catching up.

A 2023 report by Moody’s highlighted that only 8% of infrastructure budgets are allocated to cybersecurity, underscoring the sector’s vulnerability. Moreover, as renewable energy systems become more interconnected, the risk of cyberattacks increases. This threat is compounded by the fact that much of the U.S. renewable energy systems equipment is manufactured in China, raising concerns about potential foreign access to critical infrastructure.

Industry leaders are aware of these challenges. The Solar Energy Industries Association (SEIA) has proactively addressed cybersecurity, hosting summits with the Department of Energy and hiring experts to bolster its defenses. Despite these efforts, the industry’s focus on rapid deployment to meet market demand often results in inadequate testing for vulnerabilities.

The bigger picture: a delicate balance

The FBI’s warning serves as a crucial reminder of the balance that must be struck between advancing renewable energy and ensuring the security of the nation’s power supply. While renewable energy is key to combating climate change, its integration into the national grid must be managed carefully to prevent new forms of risk.

As the United States continues to lead in adopting clean energy, it is imperative that both the government and private sector prioritize cybersecurity. The future of energy security will depend on generating power sustainably and protecting that power from those who seek to disrupt it.