The fridge that fought back
Or, how genuine flex markets could make connected devices and infrastructure safer
The wake-up calls
On 2 November, supermarket chains in 7+ EU countries reported fridges and freezers soaring overnight to as high as 50C (122F for our US friends), echoing the cyber-attack last month that caused millions of euros of damage in France.
Precious food spoiled, customer choice fell, the real commercial costs will go unallocated, and thus presumably fall on the supermarkets’ insurers, which will in turn raise premiums, which will make food more expensive (during a cost of living crisis).
A harbinger of things to come? Experts were wheeled out on our favourite news platforms to warn that background infrastructure and hospitals could face similar attacks in future.
Let’s pause and break this down.
IMHO, the control panels were probably online so OEMs or contractors could tune them remotely and get fault alerts. A feature installed when they were made, and likely rarely used. One researcher interviewed said that some units had been unsupported for years, others hadn’t been patched, and many seemed to run on default passwords. Unsurprising, given the volume of ‘smart’ things out there!
As a decetralisation and digitalisation geek, this is obviously potentially troubling for the provision of electricity flexibility services (which run on the commodities of ‘trust’ and ‘remote control’), so I’ve thought a lot about what happened and why.
Let me try and give you a different perspective, and a call out to my policymaking, flex and insurance-industry colleagues to see this as the opportunity it is!
The inherent risk of being online
Let me start by being clear: there is an inherent risk in remote asset control! The background question is whether the value exceeds that risk, and if it does not now, whether it could.
Connectivity gets added for convenience (i.e. remote maintenance or alerts) or societal expectation and treated as a cost — and sometimes ‘support service package’ revenue — line, rather than a true control surface. The spread is growing, as the capex of adding connectivity is falling: see the costs of telemetry, coverage levels, chip prices, etc.
Interestingly, in the current environment, nobody “owns” that communications risk. The OEM has probably moved on to the next generation of assets, the installer has long gone, and the assets’ owner doesn’t necessarily know the device is internet connected, and thus exposed. Did the supermarkets see this coming? [Note to all of us: anything that costs more than GB£ / EUR / US$ 2000 is likely connected!]
In theory, the thing we energy industry wonks call ‘DER’ (a spectrum from major industrial chillers or heaters and processes through residential EV chargers, heat pumps and batteries and solar inverters) exhibit the same risk: millions of devices and diffuse accountability. They’re also aggregated, so any one of them could add to a grid-scale problem.
The controllability that makes these devices useful for flexibility is also an unpriced liability.
The counterintuitive argument: flexibility as a security forcing function
Here’s where my thinking morphed… Firstly, and critically, many of these decentralised assets are actually *NOT* yet aggregated for energy system purposes, despite policy efforts.
But what if they were?
I suspect that once operational control becomes something valuable, explicitly contracted and consented to, it will be protected in the way any valuable right is.
Get Doug Cook’s stories in your inbox
Join Medium for free to get updates from this writer.
Why? Because an asset that earns revenue from being dispatched has a named controller, a contractual chain, and a reason to stay patched.
By definition, consent makes that control overt. If someone is allowed to turn your heat pump down, then everyone else is not allowed. Illegitimate commands become anomalies against a baseline behaviour.
We’d also have better detection: flex markets require telemetry, performance verification and settlement — and people or machines reviewing them. This visibility is the very same thing that detects tampering.
Finally, unsupported devices become stranded commercially rather than lingering silently online. End-of-support becomes an end-of-revenue event, rather than assets “going gently into that good night”.
A value transaction that can be understood and insured
So that led me to think about the second major thing: at the moment, risk from a connected device is a vague, unquantified tail. Insurers can’t price what nobody has defined.
A flexibility contract defines the asset, the controller, the permitted actions, the value at stake, and the counterparties. That’s a quantifiable, ‘insurable’ object.
Premiums could reward good hygiene: supported firmware, no default credentials, secure-by-design standards, and alignment with emerging UK requirements on load control (see the DESNZ / Ofgem team’s work on Smart Secure Energy Systems).
In short, that liability becomes allocatable. There would be a clearer link to “who pays” if a malicious command spoils the homeowner’s food, damages the battery, or contributes to a demand spike.
In fact, what if insurance became part of the value proposition: i.e. “participate in flex, and your asset is covered”?
Caveats worth naming
OK, so thinking laterally about the world is messy. There are a few things I want to call out:
· First, more controllability means a bigger attack surface. Its obvious that value attracts attackers as well as investment.
· Second, aggregators are concentration points, and one compromised platform could reach thousands of homes. Their compliance with cyber standards is non-negotiable (but should scale proportionate to their fleets, so we don’t create a huge barrier to entry in this dynamic space).
· Third, contracts don’t actually patch firmware. This only works if standards, assurance and enforcement are real. Who are the flex police?
Summary: turning this risk into an opportunity…
I flipped this around: unpriced remote, ‘DER’ control is a danger (inverted commas as they are clearly not energy resources at present!).
Ensuring assets’ control is explicit, consented and valuable — i.e. making policy changes around flex market access and linking this to insurance — could be the best way to make it secure.
[Of course, it has the consequential benefit of providing the demand-side flexibility that we all agree the power system needs!]
