Hackers Could Target Offshore Wind Farms
The rapid pace of electrifying society brings hope for the climate. However, shifting away from fossil fuels to renewable sources like wind introduces new, yet unknown risks. A recent study conducted by researchers from Concordia and Hydro-Quebec shed light on this topic at the 2023 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm) in Glasgow, United Kingdom. The study focused on the cyberattack vulnerabilities faced by offshore wind farms that utilize voltage-source-converter high-voltage direct-current (VSC-HVDC) connections. These connections are increasingly being adopted worldwide as a cost-effective solution to harness offshore wind energy.
As we delve deeper into the integration of renewable energies, it is crucial to acknowledge that uncharted territory awaits us, with vulnerabilities and cyber threats yet to be fully understood. Juanwei Chen, a PhD student at the Concordia Institute for Information Systems Engineering (CIISE) within the Gina Cody School of Engineering and Computer Science, emphasized the importance of recognizing these risks. The study serves as a reminder that the transition to renewable energy requires careful consideration of potential vulnerabilities and threats in order to ensure a secure and sustainable future.
The urgent need to combat climate change has accelerated the electrification of society. However, the shift towards renewable energy sources like wind power comes with its own set of risks. Researchers from Concordia and Hydro-Quebec presented a study at a prestigious conference, highlighting the vulnerabilities to cyberattacks faced by offshore wind farms using VSC-HVDC connections. It is vital to navigate this uncharted territory with caution, recognizing the unknowns and addressing potential vulnerabilities to ensure a smooth and secure transition to renewable energy.
Contributing to the study were Hang Du, a PhD student at Concordia, Jun Yan, an associate professor at CIISE, and Mourad Debbabi, the dean of the Gina Cody School. Rawad Zgheib from the Hydro-Quebec Research Institute (IREQ) also played a role. This research is part of a collaborative project led by Prof. Debbabi and the IREQ cybersecurity research group, headed by Dr. Marthe Kassouf. The team of researchers, including Dr. Zgheib, worked together to achieve these findings.
Wind Farm Vulnerabilities
Offshore wind farms require more cyber infrastructure compared to onshore wind farms. This is because offshore farms are typically located far from land and operated remotely. To ensure proper functioning, offshore wind farms need to establish communication with onshore systems through a wide area network. Additionally, the turbines also communicate with maintenance vessels, inspection drones, and each other.
The complex communication system of offshore wind farms creates multiple access points for cyberattacks. If malicious actors manage to infiltrate the local area network of the converter station, they could manipulate the system’s sensors. By replacing actual data with false information, they could cause electrical disturbances at the points of common coupling throughout the offshore wind farm.
These disturbances can trigger poorly dampened power oscillations when all offshore wind farms are generating maximum output. If these cyber-induced electrical disturbances align with the frequency of the poorly dampened power oscillations, they can be amplified. This amplification may then propagate through the HVDC system, potentially impacting the stability of the main power grid. While physical contingencies are usually protected by redundancies, cyber security breaches often lack such safeguards.
The system networks have the capability to handle various events like router failures or signal decays. However, the presence of an attacker who attempts to hijack the signals raises significant concerns. According to Yan, the Concordia University Research Chair in Artificial Intelligence in Cyber Security and Resilience, there are notable gaps in the industry among manufacturers and utilities. While organizations are focusing on corporate issues such as data security and access controls, there is still much work to be done to enhance the security of operational technologies.
Yan emphasizes that Concordia University is taking the lead in international standardization efforts. However, he acknowledges that this work is just the beginning. Regulatory standards exist for the United States and Canada, but they often only specify what is required without providing guidance on how to achieve it. Both researchers and operators recognize the importance of safeguarding our energy security. Nonetheless, there are still numerous avenues to explore and unanswered questions to address.
In conclusion, the system networks possess the ability to handle events like router failures and signal decays. Yet, the presence of attackers attempting to hijack signals raises significant concerns. There are noticeable gaps in the industry when it comes to manufacturers and utilities. While organizations are focused on corporate issues like data security and access controls, there is still much work to be done to strengthen the security of operational technologies. Concordia University is at the forefront of international standardization efforts, but there is still a long way to go. Regulatory standards in the US and Canada may state what is required, but they often lack specifics on how to achieve it. Researchers and operators understand the need to protect our energy security, but there are still many paths to explore and questions to answer.