The 34th Baltic Sea Parliamentary Conference Mariehamn, Åland Islands, 24-26 August 2025 Symbiosis of Energy Security and Cyber SecurityMarlen Rein Subject Matter Expert Research and Lessons Learned Division NATO Energy Security Centre of ExcellenceSource: AI-generated image2By Unknown Author, licensed under CC BY-SA-NCAlarming news•Netherlands increasing vigilance on solar inverter-related cybersecurity risks, July 9, 2025 •Rogue communication devices found in Chinese solar power inverters, May 14, 2025 •Unexplained components found in Denmark's energy equipment imports, industry group says, May 21, 2025 •China will have 'kill switch' for its wind turbines in Europe, claims NATO expert, April 28, 2025 •China could blackmail Germany via wind turbines, report warns, March 3, 2025 •China’s wind turbine armada is ringing alarm bells at the MoD (UK), February 13, 20253Examples of worst-case scenarios•Data exposure: personal data, Wi-Fi credentials, system software, operational data, infrastructure, vulnerable points, national capabilities •Remote control & system manipulation: unauthorized access to user accounts, modification of inverter parameters, turbine steering, angle of the blades; remote shutdown; communication loss; physical damage •Disruption: power generation disruption, voltage fluctuations, modified settings, grid instability, blackouts •Coordinated attacks & hybrid warfare: simultaneous attacks on multiple wind turbines, wind farms, PV systems; cascading failures; societal disruption, chaos and fear amplified by disinformation; erosion of public trust •“Trojan horse” scenario: backdoors introduced during manufacturing or maintenance and activated at a strategic momentSource: dig.watch4Key factsSource: Eurostat5•2024: ~47% of net electricity generated in the EU came from renewables •June 2025: solar power was the EU's largest source of electricity (22,1%) for the first time, overtaking nuclear and wind •Dominance of China in wind and solar manufacturing: •98% of EU solar panels are imported from China •98% of EU's total rare earth magnet demand is met by Chinese imports •China is investing twice as much on energy as the EUSource: EurostatWarningsVulnerability of solar or wind power systems due to cyber security issues and/or Chinese dominance in the sector Estonian Foreign Intelligence Service Swedish National China Centre Solar Power Europe German Institute for Defence and Strategic Studies (GIDS)Dependence on Chinese technologyNATO Secretary General European Parliament European CommissionChina's threat in general level, incl. cyber espionageCentre for Cyber Security of Denmark Latvian State Security Service Ministry of National Defence and State Security Department of Lithuania Norwegian Police Security ServiceMain messages: •Very high/constant/long-term cyber espionage threat from China targeting the energy sector •China's increasing control over critical supply chains poses strategic vulnerabilities •Avoid repeating past mistakes by creating new dependencies •Chinese inverters as possible repetition of the „5G scenario“ •Potential state affiliation of Chinese tech firms as a national security concern •Chinese companies have attained leadership positions in solar, batteries and EVs, and are rapidly advancing towards wind energy dominance 6Examples of countermeasures•EU Net Zero Industry Act •EU Critical Raw Minerals Act •EU NIS2 Directive •EU Cybersecurity Act •EU Cyber Resilience Act •EU Network Code on Cybersecurity for the electricity sector •National measures: Lithuania, Germany...7Key takeaways: 6 „Cs“ for securing future energy resilience1.Coordination & joint countermeasures (NATO/EU/regional) 2.Consciousness - awareness at all levels (political, technical, industrial, societal) 3.Comprehensive view: ➢Risk-benefit assessment ➢Strong cybersecurity measures (prevention and rapid response) ➢Diversification and trusted providers ➢Support for domestic industries 4.Cyber security and energy security symbiosis 5.Cooperation between public and private sector 6.CoE of Energy Security of NATO in Vilniusenseccoe.org8