America’s Solar Buildout Has a Security Blind Spot – Energy News Beat

Energy News Beat
The Intersection Between Energy and Finance
Panels, Chinese-linked inverters, rush interconnections, and what Iran-linked
water cyberattacks teach ratepayers, utilities, and data-center investors
This is the introduction for the Energy News Beat Research Desk on The Energy News Beat Substack.  
We are providing deeper dives for paid subscribers on Energy Topics, and this was requested by a paid subscriber.
• 228 GW of U.S. solar PV (net summer) as of July 2026 — 165 GW utility-scale + 63 GW small-scale (EIA Table 6.1.A).
• SEIA/WoodMac: 279 GWdc cumulative at year-end 2025; 43.2 GWdc installed in 2025 (SEIA YIR). Rough panel estimate: ~465–560 million modules at 500–600 W — estimate, not a census.
• Inverters are the sharper security surface: WoodMac finds 50% Chinese-made share in 2024–25 and >90% of ~200 GWAC C&I/utility inverters imported; >70 GW from Chinese-headquartered makers (often SE Asia) (Solar Power World).
• FCC put foreign-produced power inverters on the Covered List July 28, 2026 (updated Aug. 20) (FCC). DOE’s sample of ~30 units found no definitive evidence of malicious hidden radios after Reuters’ May 2025 reporting (pv magazine).
• Rush: EIA plans 43.4 GW utility-scale solar in 2026 if realized (EIA). CAISO alone curtailed 3.4 million MWh of wind+solar in 2024 (93% solar) (EIA).
• Iran-affiliated actors hit U.S. water/OT in 2026 (CISA AA26-097A; FBI July 30 PSA; multi-state reports) — a reminder that internet-exposed industrial controls are the soft underbelly, whether the asset is a pump station or a solar farm SCADA (CISA, FBI).
 
[ENB OPINION]  The United States is building solar at historic speed while the component that actually talks to the grid — the inverter — remains heavily foreign-sourced, often Chinese-made or Chinese-headquartered, and only newly gated by the FCC Covered List. That is not the same as proving a nationwide “backdoor census.” It is enough for ratepayers, PUCs, and data-center offtakers to demand provenance, firmware attestation, and network isolation — the same hygiene water utilities learned the hard way when Iran-linked actors hammered internet-facing PLCs.
[ENB ANALYSIS]  Panels are mostly glass and silicon. The risk concentrates where software, radios, cloud portals, and remote O&M live: inverters, monitoring dongles, transformers with digital controls, and the third-party platforms that update them. Treat “Chinese chips in panels” as a supply-chain question; treat inverter firmware and undocumented communications as the operational threat model.
A utility-scale solar farm is a field of modules feeding inverters that turn DC into grid-compatible AC, then step up through transformers to the transmission or distribution system. Distributed (rooftop/community) systems do the same at smaller scale, often with string or microinverters tied to a vendor cloud.
Threat model in consumer language:
Modules. U.S. imports shifted hard after AD/CVD circumvention findings on Vietnam/Malaysia/Thailand/Cambodia. NLR’s Winter 2026 update (Census-based): 33.2 GWdc of modules imported in 2025 (−40% y/y); 21.1 GWdc of cells (+50% y/y). On cells, Indonesia (~29%) and Laos (~20%) led 2025 import shares (up from 6% combined in 2024). On modules, Indonesia and Laos together rose to ~56% of 2025 U.S. module imports (from ~5% in 2024). Indonesia+Laos were about half of c-Si cell and module imports combined (NLR Winter 2026). Direct mainland-China module share fell under tariffs, but upstream wafers, cells, polysilicon, and many Chinese-headquartered brands remain central to the global chain (DOE trade overview).
Inverters. Wood Mackenzie: of ~200 GWAC of PV inverters delivered to U.S. C&I and utility projects over ~10 years, more than 90% were imported; more than 70 GW came from Chinese-headquartered manufacturers (often Southeast Asian factories); Chinese-made products held about 50% U.S. market share in 2024 and 2025 (Solar Power World, WoodMac press).
Policy gate — FCC Covered List. As of the Covered List dated October 21, 2026, entry added July 28, 2026 (updated August 20, 2026): “Foreign-produced power inverters” except those with Conditional Approval by DoW or DHS (FCC Covered List). Early Conditional Approvals listed include Power Electronics España GEN3 utility-scale platforms, Dynapower CPS/MPS series, and GE Grid Solutions FLEXINVERTER variants. Scope nuances (wireless vs wired central inverters; firmware updates on already-authorized gear) are still being interpreted by manufacturers and owners (WoodMac commentary).
Transformers. Large power transformers are a separate but related grid bottleneck. DOE’s July 2024 LPT resilience report to Congress documented heavy import dependence historically (about 82% of 2019 domestic LPT consumption imported) (DOE LPT report). That is not a “Chinese solar panel” statistic — it is a reminder that interconnection equipment provenance matters for the same farms.
U.S. module spot prices remain far above global dumps: NLR cites roughly $0.27/Wdc U.S. vs about $0.10/Wdc global at end-January 2026 (NLR Winter 2026). That premium is the visible cost of tariffs, logistics, and domestic-content strategies — not a cybersecurity fee.
WoodMac expects domestic inverters to cost more than foreign imports in the near term after the FCC move, while noting >100 GWAC of announced U.S. inverter manufacturing aiming to start before 2028 — potentially enough to meet demand if builds complete (Solar Power World). ENB does not invent a LCOE delta; project owners should ask EPCs for bid apples-to-apples on Covered List-compliant vs legacy foreign gear, including firmware-update rights.
Alternatives / mitigations that are real today:
SEIA/WoodMac cumulative 279 GWdc at YE 2025 implies, at a mid assumption of 550 W per module, roughly 507 million panels — or about 465-560 million across a 500-600 W band. That is an order-of-magnitude estimate, not a factory serial-number census. Many older residential modules are 300-400 W; newer utility modules cluster near 540-600 W (NREL/DOE benchmarks). EIA 228 GW July 2026 net-summer figure is AC-side capacity and is not directly divisible into panel counts without DC/AC ratios.
Scale matters for security: a single compromised residential inverter is a nuisance; coordinated manipulation across many utility plants is the scenario DOE flagged as harder but higher-impact (pv magazine).
Security. Documented issues are mostly vulnerabilities and supply-chain opacity, not courtroom-proven state kill switches in every Chinese inverter. Reuters raised undocumented communications; DOE limited sample did not confirm malice. CISA advisories on Sungrow (and researcher work on Growatt/SMA) show remote takeover paths via bad crypto, hardcoded credentials, and cloud IDOR flaws — classic insecure-by-design problems that any nation-state or criminal crew can abuse once devices are internet-reachable (CISA, Forescout).
Reliability / rush builds. EIA expects 43.4 GW of new utility-scale solar in 2026 if developer plans hold — 51% of a record 86 GW total planned additions (EIA). SEIA reported 15.7 GWdc already installed in H1 2026 amid safe-harbor and FEOC timing pressure (SEIA data). Faster COD calendars raise the odds of incomplete commissioning, weak OT segmentation, and ship-the-firmware-later culture — the opposite of supply-chain cyber hygiene FERC has been pushing NERC to tighten (CIP-013 family; see FERC, NERC project page).
CAISO evidence of friction: 3.4 million MWh curtailed in 2024 (+29% y/y), 93% solar, driven by spring oversupply, congestion, and the need to keep gas online for evening ramps (EIA). That is not Chinese chips caused blackouts. It is proof that capacity megawatts without deliverability, storage, and flexible resources create instability and wasted energy — a bill that shows up in PPAs and eventually rates.
Policy / trade. AD/CVD, Section 301, UFLPA, FEOC/PFE rules under 2025 tax law, and the FCC Covered List interact. Circumvention through Southeast Asia and now Indonesia/Laos means not Made in China on a customs form is not the same as China-free supply chain.
Figure 3. Rush-build and policy scorecard. Sources: EIA, SEIA/WoodMac, FCC. ENB chart.
 
Practical checklist for consumers, investors, data-center offtakers, and PUC intervenors:
[STU’S TAKE]  Friends, if your utility is racing ~43 GW of utility-scale solar (EIA 43.4 GW planned) onto the grid in a single year while half the recent inverter market is Chinese-made, you do not need a spy novel — you need a shopping list and a network diagram.
• The United States now sits on roughly 228 GW of solar (EIA, July 2026) and about 279 GWdc cumulative (SEIA YE 2025). That is on the order of half a billion panels. Celebrate the electrons. Interrogate the brains of the system — the inverters.
• Reuters rang the alarm on undocumented communications; DOE’s sample did not find a smoking-gun malicious radio. That is good news and incomplete news. Sample size ~30 is not the fleet.
• The UK’s K3 Scout heartbeat-to-China story is the teachable moment: even approved cameras on military boats can squawk home through a third-party part. If the Royal Navy can get surprised, your county water board and your hyperscale campus can too.
• Iran-linked actors did not need fancy AI to hurt water systems in 2023-2026 — they needed default passwords and PLCs left on the public internet. Solar farms with lazy OT will learn the same lesson the expensive way.
• Ask your PUC, your co-op board, and your data-center landlord three questions: What brand is the inverter? Who can push firmware? Is it on the Covered List or Conditionally Approved? Then wait for the pause. That pause is the story.
 
Solar is still among the cheapest new bulk energy options in many U.S. markets on a pure energy basis, and domestic module manufacturing has scaled dramatically (SEIA: module manufacturing capacity 65.5 GW online end-2025). And cheapest when you do not include grid resiliency into the mix. Energy News Beat is very vocal that wind and solar need to be tied to storage to level the playing field of true costs for coal, nuclear, and natural gas. Security concerns must not become a lazy excuse to ignore interconnection reform, transmission, or gas/nuclear firm capacity needs. Conversely, green at any supply-chain cost is how you import tomorrow’s outage. ENB’s bias is verification before trust — demand attestations, not vibes.

Energy News Beat is your go-to source for global energy news, covering oil, gas, renewable energy, and market trends. We provide timely updates, expert insights, and in-depth analysis to keep you informed on the latest developments shaping the energy industry.

source

This entry was posted in Renewables. Bookmark the permalink.

Leave a Reply