Swiss solar power: security alarm over Chinese inverters

Switzerland currently has around 338,000 photovoltaic installations in operation, the result of years of steady growth in the energy transition. A new, not-yet-published study by the National Test Institute for Cybersecurity (NTC), seen by SRF, points to a weakness that has so far received little attention: inverters, the devices that convert the current produced by solar panels into electricity usable by the grid.

Almost all inverters remain permanently connected to the internet and to manufacturers' servers, explains Andreas Leisibach, a cybersecurity expert at the NTC. This connection allows remote control, useful for maintenance but also exploitable for malicious purposes, for instance to switch off or tamper with a device.

Market concentration

The main problem identified by the study concerns market concentration. According to an estimate by the Federal Office of Energy, around 100,000 photovoltaic installations in Switzerland are equipped with Chinese-made inverters, with the two brands Huawei and Sungrow now covering more than 60% of the market. For Raphael Reischuk, founder of the NTC, this concentration represents a significant risk: whoever controls the inverters effectively controls the entire installation and the grid it is connected to.

Simultaneously shutting down all inverters from a single manufacturer while they are operating at full capacity could cause serious disruption to the Swiss power grid. Reischuk notes that a manufacturer would have no economic interest in causing such an event, but could be forced to do so by a state actor or by cybercriminals. This is not merely a theoretical scenario: in the past, a Chinese manufacturer remotely disabled numerous inverters in the United States and other countries during a trade dispute, displaying the message "Not allowed to use" on the blocked devices.

The most widespread technology, made by Huawei, is also installed in public buildings, such as a new system being built on the roof of a cantonal school in Bern. The director of the company carrying out the work acknowledges the quality and competitive price of the Chinese products, but admits that the systemic risk arising from their widespread use cannot be solved by individual operators or by the industry alone. When contacted by SRF, Sungrow did not respond, while Huawei stated in writing that cybersecurity is an absolute priority and that its systems can also operate offline, an option that, according to the experts interviewed, is difficult to apply in practice.

The United States and the European Union are already taking steps to limit the use of inverters from sanctioned countries. Switzerland's Federal Intelligence Service has also flagged the risk, warning that the country could become an easier target if protection of critical infrastructure proves less strict than in the EU. Meanwhile, the industry association Swissolar is calling for binding cybersecurity standards and a central registry to track how much of the electricity supply could actually be controlled remotely.