May 27th 2025
AI-created, human-reviewed.
In a shocking revelation that has sent ripples through the cybersecurity and renewable energy communities, security experts have discovered undocumented communication devices—including cellular radios—hidden inside Chinese-manufactured solar power inverters and batteries. This discovery, first reported by Reuters and discussed in detail on a recent episode of Security Now with hosts Steve Gibson and Leo Laporte, represents a significant escalation from theoretical power grid vulnerabilities to documented security threats.
The investigation began when U.S. experts conducting routine security assessments started stripping down Chinese solar power inverters connected to electrical grids. What they found was alarming: communication equipment not listed in any product documentation, specifications, or bills of materials. Over the past nine months, these undocumented devices have been found across multiple Chinese suppliers, raising serious questions about supply chain security and potential foreign interference in critical infrastructure.
As Steve Gibson emphasized during the podcast discussion, "Why would there be undocumented radios in inverters that are not part of the documentation or the bills of material, or the operating specifications?" The implications are staggering—these hidden communication channels could allow attackers to bypass firewalls and remotely control power grid equipment.
The scope of this security threat cannot be overstated. According to the European Solar Manufacturing Council, over 200 gigawatts of European solar power capacity is connected to Chinese-made inverters, equivalent to more than 200 nuclear power plants. In the U.S., the renewable energy sector has similarly become dependent on Chinese manufacturing, with companies like Huawei dominating the global inverter market.
Gibson highlighted the concerning reality: "I had no idea solar has gotten as big as it is. Two hundred gigawatts of power is equivalent to 200 nuclear reactors." This massive scale means that even a coordinated attack affecting a small percentage of these devices could have catastrophic consequences for power grid stability.
Perhaps most alarming was the revelation of an incident in November 2024, where solar power inverters in the U.S. and elsewhere were remotely disabled from China. While the full extent of this disruption remains classified, the incident involved a commercial dispute between inverter suppliers and demonstrated the real-world capability for foreign actors to remotely control U.S. power infrastructure.
This event moved the threat from theoretical to demonstrably real, as Gibson noted: "We've been talking about theoretical vulnerabilities in power grids and about how devastating an attack upon our US power grid would be, and now we learn that these concerns have moved from the world of theory to reality."
Solar panels and wind turbines naturally produce direct current (DC), but power grids operate on alternating current (AC) for efficient long-distance transmission. Inverters serve the critical function of converting DC to AC, making them essential chokepoints in renewable energy infrastructure. Their importance to grid stability makes them particularly attractive targets for potential sabotage.
Utility companies have attempted to mitigate risks by installing firewalls to prevent direct communication between these devices and China. However, the discovery of hidden cellular radios suggests a deliberate effort to circumvent these security measures. These undocumented communication channels could allow remote attackers to switch off inverters, change their settings, or potentially cause physical damage to grid infrastructure.
The U.S. Department of Energy has acknowledged the ongoing assessment of risks associated with emerging technologies, emphasizing the need for complete disclosure of product capabilities. Representative August Fugger highlighted the broader context: "The threat we face from the Chinese Communist Party is real and growing. Whether it's telecom hacks or remotely accessing solar and battery inverters, the CCP stops at nothing to target our sensitive infrastructure."
Several legislative responses are already in motion, including the "Decoupling from Foreign Adversarial Battery Dependence Act," which would ban the Department of Homeland Security from purchasing batteries from specific Chinese entities starting in October 2027.
Internationally, countries like Lithuania and Estonia have taken proactive measures. Lithuania passed legislation blocking remote Chinese access to renewable energy installations above 100 kilowatts, while Estonia is considering extending similar restrictions to smaller rooftop solar installations.
Major utilities are already adapting to these security concerns. Florida Power and Light Company, Florida's largest electricity supplier, is reportedly working to minimize the use of Chinese inverters by sourcing equipment from alternative suppliers. This shift represents a significant change in procurement strategies across the industry.
However, as Gibson and Laporte discussed, this transition comes with economic trade-offs. Chinese manufacturers have dominated the market not only due to cost advantages but also because they often produce high-quality equipment. The challenge now lies in balancing security concerns with economic realities and the urgent need to expand renewable energy capacity.
This discovery highlights the broader challenge of supply chain security in an interconnected global economy. As former NSA Director Mike Rogers observed, "China believes there is value in placing at least some elements of our core infrastructure at risk of destruction or disruption."
The energy sector has lagged behind telecommunications and semiconductors in implementing security regulations to address foreign technology risks. This incident may serve as a catalyst for more comprehensive security frameworks across critical infrastructure sectors.
The hosts of Security Now emphasized that while this news is concerning, its early discovery provides an opportunity for appropriate action. Key takeaways include:
Enhanced Vetting: All critical infrastructure equipment needs comprehensive security assessments, regardless of originSupply Chain Diversification: Reducing dependence on single-source suppliers, particularly for critical componentsTransparency Requirements: Mandatory disclosure of all communication capabilities and hardware componentsOngoing Monitoring: Continuous security assessments of installed equipment, not just initial evaluationsThe discovery of hidden communication devices in Chinese solar inverters represents a sobering reminder that cybersecurity threats have evolved beyond traditional IT systems to encompass the physical infrastructure that powers our modern society. As Steve Gibson concluded, "It's unfortunate, but it's the world we're living in today. We end up having to switch to higher cost alternatives because we can't trust everyone to supply gear that's safe for us to use."
This revelation demands immediate attention from policymakers, utility companies, and security professionals. The transition to renewable energy—critical for addressing climate change—must not come at the expense of national security. The challenge lies in building secure, resilient renewable energy infrastructure while maintaining the pace of clean energy adoption necessary for our environmental goals.
The conversation between Gibson and Laporte serves as both a warning and a call to action. The time for theoretical discussions about power grid security has passed; the threats are real, documented, and require an immediate, comprehensive response.
Share: Copied! Security Now #1026May 20 2025 - Rogue Comms Tech Found in US Power…
Is AI Replicating Itself? All Tech posts Contact Advertise CC License Privacy Policy Ad Choices TOS Store Twitter Facebook Instgram YouTube Yes, like every site on the Internet, this site uses cookies. So now you know. Learn more Hide Home Schedule Subscribe Club TWiT About Club TWiT FAQ Access Account Members-Only Podcasts Update Payment Method Connect to Discord TWiT Blog Recent Posts Advertise Sponsors Store People About What is TWiT.tv Tickets Developer Program and API Tip jar Partners Contact Us