Australia’s renewable energy shift fuels foreign cyber concerns

Australia's transition to a renewable energy grid is introducing significant cyber security risks due to reliance on foreign-manufactured components.

As Australia moves towards its 2030 target of sourcing 82% of its energy from renewables, the nation's power grid is undergoing substantial transformation. This shift is resulting in a complex network of decentralised and digital assets, which, while essential for sustainability, also expands the attack surface for potential cyber threats.

The increasing use of international technology within infrastructure, such as solar inverters and battery management systems sourced from global suppliers, has heightened concerns around cyber vulnerabilities. Components produced overseas could inadvertently introduce risks, including the possibility of facilitating cyber espionage, sabotage, or unauthorised access to critical energy systems.

A significant vulnerability stems from the prevalence of hardware and software manufactured in countries that do not necessarily share Australia's cyber security standards or strategic interests. This dependency brings into question the integrity of the supply chain, the transparency of firmware, and the risk of hidden vulnerabilities within these technologies.

Earlier this year, the Department of Home Affairs highlighted growing concerns about foreign-manufactured inverters and control systems, particularly the risk that some products might contain backdoors or remote access functions. There has been at least one incident involving Chinese-made solar products that featured undocumented communication channels. These channels are capable of transmitting system data externally, raising the risk that, if exploited, attackers could remotely shut down key infrastructure or disrupt grid stability.

Minister for Cyber Security, Clare O'Neil, addressed these concerns in a 2024 interview, stating: "We can't continue to build critical infrastructure with technology we don't trust. Cybersecurity and energy policy are now intrinsically linked."

The trend towards interconnected and digitised grids—featuring smart inverters, Internet of Things (IoT) sensors, and cloud-based management platforms—means that a breach in a single component has the potential to impact the entire energy network.

International precedent underscores that such cyber threats are not merely theoretical. In 2015, Ukraine's power grid was targeted by a sophisticated cyber operation, leading to widespread outages. The incident was attributed to foreign threat actors who had infiltrated industrial control systems. As Australia's grid undergoes digitisation, there is a growing need to safeguard against similar scenarios.

The Australian Cyber Security Centre (ACSC) has issued repeated warnings to the energy sector, identifying it as one of the three most targeted industries for cyber intrusion attempts in its 2023 Annual Cyber Threat Report.

Measures to counter these risks have been embedded in national policy. The Security of Critical Infrastructure Act (SOCI) requires enhanced cyber security risk management for assets classified as critical infrastructure, including renewable energy facilities. The Australian Energy Sector Cyber Security Framework (AESCSF) provides a mechanism for operators to assess and enhance their cyber maturity.

Additionally, the 2023–2030 Cyber Security Strategy advocates for resilience through cooperation, planning for incident response, and the adoption of secure-by-design technologies. These frameworks are designed to establish accountability and give infrastructure owners clear paths to improving their defences. However, implementing these measures remains particularly challenging for smaller providers and regional energy operators who may lack sufficient resources or specialist expertise.

The Australian Government has introduced the "Future Made in Australia" Fund, a AUD $22.7 billion initiative which aims to increase domestic manufacturing of clean energy technologies such as solar panels and energy storage systems. This initiative is intended to boost sovereign capability and also reduce cyber exposure by providing greater oversight of how components are developed and deployed.

Private sector involvement is also playing a role in securing the grid. Cyber security consultancies, including firms like Borderless CS, are working with energy providers on risk assessment, threat modelling, and secure integration of third-party technology. By following standards such as those set by the National Institute of Standards and Technology (NIST) and the ACSC Essential Eight, these firms aim to help energy sector clients improve resilience beyond mere compliance, while retaining a local approach.

Clare O'Neil's statement, "We can't continue to build critical infrastructure with technology we don't trust. Cybersecurity and energy policy are now intrinsically linked," reflects the current consensus among policy makers and industry leaders that securing the nation's renewable energy transition requires coordinated technical, regulatory, and operational strategies.