India moves to shield power grid from solar equipment malware

India issued guidelines to protect solar power equipment from potential cyberattacks, responding to industry concerns that imported China-made parts may be putting the grid at risk.

Suppliers of inverters - devices that turn direct current into electricity for homes and the grid - will need to connect the machines to a national software platform, hosted on servers in India and managed by a government agency, according to the renewable energy ministry. All communication devices connected to the inverters must use special SIM cards that let machines securely share data without human input, it said in a note on its website.

As power grids become more automated and digitally connected, they face growing cybersecurity threats, prompting governments worldwide to tighten safeguards. Reuters reported in May that the US is reassessing the risk posed by Chinese-made inverters after unexplained communication equipment was found inside some of them.

"Inverter communication modules that transmit data to servers outside India not only pose risks of unauthorised control but also threaten national energy sovereignty by exposing sensitive consumption and generation data," the Indian ministry said.

The directions currently apply to rooftop solar inverters - considered the most vulnerable part of the green power supply network due to limited technological safeguards. Data from these devices also reach to suppliers, many based in China, according to India Smart Grid Forum, which advises the government on building new-age power infrastructure.

India currently has 1.8 million rooftop solar units connected to the grid, ISGF said in a May report. More than 80% of the inverters installed at these units are made by Chinese companies, it said, highlighting the cybersecurity risk.

The nation plans to cover 10 million houses, with a cumulative capacity of 30 gigawatts by March 2027, according to the ministry.