Spain sounds cyber weakness in small electric plants after the off

Unlock Free

Roula Khalaf, publisher of the FT, selects her favorite stories in this weekly newsletter.

Spain requires information from small electricity generators about their cyber defenses, as researchers from the last month’s shutdown are intended to determine if they were a weak link exploited by bad actors to demolish the country’s power grid.

The questions of the National Institute of Cybersecurity of Spain (inciu) will intensify the debate about whether those of the country dependence on renewable energy He was guilty of the interruption of power, a statement dismissed by Prime Minister Pedro Sánchez, champion of decarbonization.

High government officials have “concerns” about the robustness of cyber defenses at small and medium -sized energy facilities, especially solar and wind parks that have proliferated when Spain became a world leader of renewables, said a person who knew this.

Spain has not yet identified the main cause of the collapse of the Iberian power grid on April 28 and has not discounted a cyber attack. “To date, we are not discarding any possibility. Everything is on the table,” said the Ministry of Energy and Environment of Spain.

Separately, a judge from the National Court of Spain has opened an investigation into whether there was a cyber attack behind.

The Spanish network operator Red Eléctrica said the day after the interruption that there was no evidence of a cyber attack on its own facilities, but since then it has not commented.

The government said last week that Spain suffered 100,000 cyber attacks in all sectors last year, with 70 percent of them aimed at companies or other organizations, as it announced an investment of 1.1 million euros to strengthen it. Cyber ​​safety.

Three companies that have or operate the renewable energy plants told The Financial Times that they had received a barrier of questions about the shutdown and their own defenses or invants, as part of the official consultations on what happened.

The questions included “Is it possible to remotely control the power plant?”, “Were anomalies detected before the April 28 incident?” and “Have you installed any recent paste or security updates?”

One of the government officials said that the authorities pursued multiple lines of research and that the UNCIBE questions were not a sign that a hypothesis about the shutdown was giving more weight than others.

The renewable energy boom of Spain has ended the traditional model of the country in which the generation of electricity was concentrated in a few highly regulated fossil or nuclear power plants.

In contrast, Spain has moved to a system of thousands of smaller generators, which has created the most goals for pirates who want to wreak havoc, injecting malicious software or disturbing power flows.

Potential entry points to the system, all linked to the Internet, include firmware -led devices that turn electricity into a safe current and communication channels between generating units and control centers.

Red Eléctrica says it receives live data from 4,000 renewable facilities that have a generation capacity of at least 1 megavati. Can send instructions in real time to modify the production of 5MW or larger.

But in its latest annual report, Red Eléctrica’s parent company was identified as a risk of “insufficient information for real -time operation of the system due to an increase in renewable generation facilities with exits less than 1mW.”

Anpier, a trade group, estimates that Spain has about 54,000 solar facilities connected to the network, including small -scale land matrices in factories, offices and houses.

Several Spanish electricity executives said that they doubted that a cybernetic attack would cause the off, partly due to the difficulty of executing -one with such a dramatic impact. But they acknowledged that an assault could not be ruled out in a previously conceived form.

Miguel López, director of regional sales in southern Europe for the Cyberian Security Group, Barracuda, said: “With the information we have available at this time, a cybernetic attack does not seem to be the most plausible hypothesis, because there should be several well -coordinated attacks on various different agents.”

If the hackers had managed to “break” something, it would have taken much more than the 16 hours Spain needed to completely restore the operation of the network, López added.

Anpier said: “Generally.

The shutdown occurred after Spain lost 15 electricity gigawatts, 60 percent of its supply, in just five seconds, destabilizing the network and causing multiple other power plants to be disconnected. Prior to the interruption, the renewable contributed 70 percent of the electricity of Spain.