Balance in the power grid
The power grid needs to maintain a constant balance, between supply of power, and demand of power. If supply exceeds demand, or demand exceeds supply, outages can occur. In order to maintain stability all sorts of countermeasures exist to prevent outages due to peaks or dips in demand or supply. Under normal circumstances, these countermeasures ensure grid stability. There is however a limit to these countermeasures. A maximum peak or dip value in a specific period of time. If an attacker is capable to go beyond this maximum peak or dip value, outages will occur.
The thing with power grids, at least in Europe, is that they are very intertwined. Nations are constantly exporting and importing power to each other, and power grid regulators have made agreements to help each other during crisis times. Because of this intertwinedness an attack or failure of any part of the power grid, automatically has effects in other intertwined power grids as well.
PV installations influence the balance of the power grid in two ways. They supply power directly to local appliances (lessening the demand) and any excess power is supplied to the grid (increasing the supply). An attacker capable of controlling the flow of power from these devices can therefore have a direct effect on the balance of the Power grid.
Scale is key
A hacker controlling a single device of course isn’t much of a problem. The available countermeasures for grid stability will easily protect us from such an attack. Hacking these devices becomes a problem when done at a large scale. Since more and more of these PV installations are being connected to the internet or the local network, to provide the user with certain functionalities, they can be targeted easily, and remotely, by hackers.
In Europe there is over 90 GW of PV power installed, an attacker capable of controlling the flow of power from a large number of these devices could therefore cause peaks or dips of several GigaWatts causing massive balancing issues which may lead to large scale power outages.