Achieving a robust and resilient offshore energy system requires strong collaboration

Our society requires a predictable, plannable, and controllable offshore energy system. However, with our growing reliance on renewable energy from the North Sea, our vulnerability is growing, too. We have the capabilities to develop, construct and maintain the offshore energy infrastructure; we are less certain about our abilities to make this infrastructure secure. While building our strategic autonomy and economic value, guarding it becomes more important.

Government, scientific, and private parties need to ally to anticipate and act on different scenarios that threaten our offshore wind farms and our offshore energy system.
One for all, all for ourselves.

This position paper sets out the scene to build such an alliance and the different roles within this body of cooperation.

Maximum production and security

The Dutch offshore wind energy system is set up in such a way that the goal is to achieve the needed power to supply our society with renewable energy. The government tenders offshore wind farms, aiming to achieve maximum production capacity for minimum costs. This has helped our country install large amounts of wind power in the past decade.

But with further accelerated growth and our growing reliance on these distant power sources, connected via cables and many sensors, our energy system is getting more prone to deliberate disturbance. Our offshore energy system isn’t set up to be adequately defended. The risks are relatively easy to address within our energy system's current scale and state. This is, among others, stated by Roland van Rijswijk-Deij, professor in network security at Twente University. Adding every new wind farm and turbine increases the possibility of an attack. Research within the industry, commissioned by TKI Offshore Energy, indicates that the most significant threat lies within the supply chain. Large energy corporations maintain high cybersecurity standards, but the vulnerability grows with every step deeper in the supply chain. Standards may differ. Awareness is not on the same level. And capabilities are not on par.

Contracts and certificates (such as ISO 27001) fend off only a tiny portion of the threats. And mostly in hindsight. They are not an answer to an actual attack.
More is needed to address a cyberattack and build a robust and resilient offshore energy system in IT and human behaviour.

Collaboration is vital in guarding ourselves against an attack. The NATO principle could be a guiding principle here: an attack on one is an attack on all. How far this principle would reach and how the reply takes form is open for discussion.

On whose shoulders rests the responsibility?

Still, a case can be built to continue the current working methods. Here, we leave it to private companies that manage offshore wind farms and the infrastructure. They are responsible for protecting their assets. The NIS2 directive of the EU will enforce this responsibility. Asset owners and providers take care of a solid digital defence among themselves. And what is the likelihood of multiple offshore wind farms being attacked simultaneously? HCSS reported in late 2021 that threats are changing, and other scenarios come into place with today's tools. The Netherlands is becoming a frontline state with our open economy and realisation of added economic value further outside the EEZ. Incidents such as the North Stream sabotage underline this even more.

A fitting response

That should not only be about the technical barriers that we should erect but also about a collaborative ambition. Industry, government, and scientific organisations all play a role in proactively defending our energy sources. Being attacked means not only losing energy to let our society function but also losing your reputation. Wind farms can be restored faster than a reputation.

The proper ambition is to strive for a proactively resilient offshore energy system. This requires combining the strengths and expertise of the stakeholders mentioned above.

For such a collaboration, the Ministry of Economic Affairs and Climate, the Ministry of Interior Affairs/General Intelligence and Security Service, TNO and TKI Offshore Energy/EnergyInnovationNL initiated FLECS. FLECS is a centre of excellence for cybersecurity in offshore wind. The aim is to develop knowledge and create solutions to achieve a digitally resilient offshore energy system.

A partnership between science, industry, and government is critical to realising this ambition. Private parties bring forward their needs and demands, and they offer expertise and platforms to test solutions. Scientific organisations develop knowledge and test early-stage innovations. The government sets the rules and stimulates the industry and society.

Contribute

At FLECS, the different views and experiences are combined. At this centre of excellence, they are translated into ground-breaking and necessary knowledge and innovations.

Will you join and contribute to a digital resilient offshore energy system? Get in touch with Arjan.