Chinese solar technology poses a threat, Czech cybersecurity agency says; used in 90% of systems

Chinese technology in Czech solar power plants poses a potential security threat, the Czech National Cyber and Information Security Agency (NÚKIB) has warned. More than 90% of small photovoltaic systems in Czechia use this technology. Existing installations therefore need to be protected against the most serious risks, while entirely new solutions should be considered for future installations. Participants in a panel discussion on the cybersecurity of photovoltaic systems held today agreed on this. They said a blanket ban on photovoltaic systems using Chinese technology is unrealistic.

According to the agency, Chinese suppliers pose risks to data protection and, in an extreme case, could potentially enable remote manipulation. NÚKIB identifies Chinese inverters in particular as a security threat. These photovoltaic system components convert direct current into alternating current and feed it into homes or the distribution grid. Inverters are connected to the internet and managed remotely by manufacturers, service companies and end users, including with the option of remote operation while they are running. According to NÚKIB, inverters may also be vulnerable to cyber threats ranging from the collection and misuse of user data to malicious applications or firmware updates.

“We need to distinguish between installations that are already operating and those that are still being built. Each group requires a different approach. The aim is to find a solution that shields against the greatest threats—particularly coordinated mass attacks or remote commands sent to inverters. Their misuse could even jeopardize the stability of the distribution grid,” said Erika Langerová, head of the energy cybersecurity team at UCEEB, Czech Technical University in Prague.

For new installations, she said, a fundamental change in the approach to managing photovoltaic systems is needed. She also called for restrictions on Chinese technology in European markets.

Industry representatives hope that European suppliers will gain ground in the sector in the future. “We need to understand that China is not the right partner in this area. I believe solutions from European manufacturers will be used more widely,” said Jaroslav Hrubeš of the Czech Association for Energy Storage and Photovoltaics.

Martin Sedlák, programme director at the Modern Energy Union, also stressed the importance of strengthening the cybersecurity of renewable energy sources. “The way forward is to support the development of European technologies that can protect data and operations from attacks or misuse,” he said. Most of the discussion participants said now is the ideal time to strengthen European technologies, as the number of new installations is declining.

Czech company SOLSOL today unveiled a new solution for end users. It has launched the Guardexy device, designed to protect users and infrastructure from unsolicited commands from outside without requiring radical changes to installed photovoltaic systems. The device, made from European components and priced at approximately 3,000 crowns, is designed to filter data flows in both directions and audit and block suspicious commands, the company said.

“Our aim is not to disconnect or ban technologies. In the current situation, that would be economically unfeasible. We offer a smart filter that gives users, companies and municipalities control over what is happening in real time,” said SOLSOL technical director Martin Novák.

More than 220,000 photovoltaic power plants are connected in the Czech Republic. A total of 44,593 new photovoltaic systems were commissioned in the country last year, 38,106 fewer than the previous year. However, the number of larger installations is gradually increasing.