The Ghost in the Machine

News this week that Chrysler were recalling 1.4 million cars because they are vulnerable to hackers taking control of dashboard functions, steering, transmission and brakes was somewhat alarming given widespread enthusiasm over the Internet of Things (IoT) and driverless cars.  The Sunday Times followed up with an article saying that hackers would be able to use smart fridges to access smart home networks and hold people to ransom in the same way they do with computer hard drives – pay up or we crash your smart home.  Although journalistic this article did raise some serious issues about the security of smart devices and smart systems – the emerging internet of things (IoT).

Much of the discussion around the IoT has an energy focus, smart and interlinked thermostats like the Nest are part of IoT and now every light fitting in a building, and now even every light bulb, can be internet enabled.  The benefits for energy saving and maintenance can be very large and no doubt this kind of application will grow dramatically because of those real economic benefits.  This trend is part of the fusing of energy supply and energy demand that is disrupting the energy market everywhere.  In the past every energy using device was simply a fixed load and the electricity supply network had to deliver enough power to meet the load at all times.  Variation of load was simply an addition of all the fixed loads that were on at any time.  Now with IoT enabled devices each individual load can potentially be varied or switched on or off, and of course linked directly to supply network intelligence, enabling a more dynamic, two way interplay between supply and demand.

At the International Energy Research Centre’s conference in Cork in May there was an interesting session called “the internet of energy things” (IoET?).  I took away the idea that the IoET is a sub-set of the IoT which impacts on the energy sector.  (It is almost certainly the largest subset although there can be non-energy using IoT enabled objects).  Now, as well as the things in the energy generation, transmission and distribution system, (which tend to be big bits of kit), joining the IoET we are now seeing more and more (small or even tiny) end-user energy using devices also joining the IoET – adding to the complexity of what is already our largest machine, the electricity system.  At  that meeting I did raise the issue of security of the IoET, citing the infamous Stuxnet virus which was used to infect Siemens motor controllers which were attached to centrifuges in the Iranian Natanz Nuclear Technology Centre which were enriching uranium, possibly (probably?) for use in a nuclear weapon.  If someone can use Stuxnet to take out centrifuges in what is presumably Iran’s most secure facilities, (by the way the Siemens motor controllers weren’t even connected to the internet the virus was put into computers inside the plant from a USB stick), the risk to internet enabled devices in the energy system has to be serious.

There is no doubt that the benefits of the IoET could be huge in terms of energy savings and more dynamic markets, but the issue of security is critical and I am not sure it is receiving the attention it deserves.  Of course there is always the possibility that it is but we never hear about it for security reasons.   Anyway, we definitely have to add cyber security to all the other growing risks to the energy system.