MC EXCLUSIVE Guard The Grid: India to bar sharing wind project data with China, others for national security

.

Acting on inputs from National Security Advisor (NSA) Ajit Doval and Niti Aayog, the Ministry of New and Renewable Energy (MNRE) will soon impose a ban on sharing operational data of Indian wind energy installations with other countries. The notification is expected in about three weeks, at least two senior ministry officials told Moneycontrol.

Other directives under the new ‘cybersecurity clause’ would be to set up R&D (research and development) and data centres in India within six months from the date of issue of the order.

Despite pushback and submissions from certain foreign players to relax the timelines, the MNRE is unlikely to change its draft cybersecurity directives that were floated this April.

“Relaxation in other clauses such as the requirement to source gearboxes and generators used in wind turbines six months from the date of issue of the order is still being considered. But there will be no compromise on the cybersecurity clause. The rule has to be the same for both Indian and foreign manufacturers who have set up units here,” said one of the officials.

India has at least 14 wind turbine manufacturers with a combined capacity of 20 gigawatts (GW). While key Indian players include Suzlon Energy and the Adani group, Chinese firms such as the Envision group and Sany group have also set up manufacturing units, as have companies from the US, Spain, Denmark, Germany, and so on.

Why such stern mandates for the wind sector?

Wind turbines are considered a bigger cybersecurity risk than solar or thermal energy systems due to their distributed nature, reliance on remote monitoring and control, and the potential for significant disruption if compromised.

A probe into the issue of “increased inroads by Chinese OEMs into the wind sector” was conducted by Doval in August 2022, after which the Niti Aayog came up with a report last year highlighting that the sector was “highly vulnerable” to cyber attack.

Also read: India to quadruple uranium imports for nuclear energy mission.

“Wind turbines are capable of exchanging information with utility operators and aggregators through a device called the power plant controller (an intelligent cyber-physical device), and because of this they're exposed to cyberattacks and may render grid operations insecure,” the report stated.

It added that attackers can enter the network through this route and move on to other high-value assets. “Some of the owners of these renewable energy resources are stationed outside India and manage the operations of these devices remotely. This is a major threat to the national grid and can also lead to a breach of critical data,” it said.

On June 12, union Power Minister Manohar Lal Khattar said that India thwarted nearly two lakh cyberattacks targeting its power sector during Operation Sindoor in May.

Never too late?

Indian manufacturers like Suzlon have welcomed the move but also stated that such regulations should have come way earlier.

“We wrote to the MNRE saying we fully comply with these conditions. When you continue to have geographical tension, cyber security is of the utmost importance,” said JP Chalasani, CEO, Suzlon group.

Foreign OEMs have been manufacturing wind turbines in India for decades now and a majority of them have their control centres in their country of origin. It is only after the  probe and discussions on the matter that some have shifted their centre of operations to India.

For example, Envision Energy, a subsidiary of a Chinese conglomerate, has been operational in India for nine years. But it shifted its control and data centres here from China only towards the end of 2024.

“Envision Energy is the first company to have proactively addressed the cybersecurity requirements outlined by the government. Even before the draft notification was issued, we took decisive action and by the end of last year, we had relocated our servers to India. Our data centres are now fully functional here, in compliance with the mandate that operational data and turbine control must be managed domestically,” said RPV Prasad, CEO, Envision Energy India.