Are we building cyber vulnerability into EV charging infrastructure?

Electric vehicle (EV) charging stations are vulnerable to hacks that could disrupt the grid or steal users’ personal information, and without significant technology upgrades, regulations and standards, the effects could be dramatic.

A recent study from the Sandia National Laboratories outlined the scale of the potential issues, adding to similar alarms raised by other academic researchers. Sandia’s study said hackers could access charging stations to overload the grid, or shut down a station by making it think it has drawn all the energy it needs.

The cloud services used to manage charging stations could also be vulnerable to hacks, especially if software is not kept up to date. Criminals could also use credit card skimmers to steal drivers’ personal information, as they do now on standard gas pumps. There are also concerns that the chargers themselves could be hijacked and be used to display inappropriate content.

With EV companies trying to quickly ramp up their vehicle and charging options amid a nationwide push to electrify transportation, observers said that cybersecurity doesn’t get appropriate attention.

“Right now, there's a bit of a Wild West mentality out there,” said Kayne McGladrey, field chief information security officer at security software company Hyperproof and a senior member of the Institute of Electrical and Electronics Engineers. “Companies are incentivized for being first to market, not necessarily most secure to market. Because security costs money and because it requires time and resources, naturally that becomes a lower priority.”

EVs themselves have already been shown by researchers to be vulnerable to attack, but the cybersecurity of charging infrastructure has flown under the radar until relatively recently.

At a forum last month hosted by the Office of the National Cyber Director at the White House, leaders in government and the EV industry agreed to work together to assess current cybersecurity standards associated with EVs, what else is needed to keep the ecosystem safe and the state of research and development in this area. Participants also pledged to work together and “identify opportunities for harmonization,” according to a White House readout of the meeting.

States are starting to think harder about cybersecurity too. In its August 2022 state plan for EV infrastructure deployment, the Michigan Department of Transportation (MDOT) said risks “continue to intensify” as the technology advances, but it put the onus on its third-party vendors to be responsible for cybersecurity.

MDOT said it would update its procurement process to ensure cybersecurity and privacy requirements are met. The plan comes as Michigan invests heavily in EV infrastructure, including through a network of chargers and the first public road that charges EVs as they drive on it.

Separately, vendors applying for federal National Electric Vehicle Infrastructure (NEVI) funding will be required to submit a cybersecurity plan that includes “an understanding of high-level security and privacy practices, including physical and technological solutions, in place to protect the chargers and data from cyberattacks,” according to the state plan.

To bolster the cybersecurity of EV charging infrastructure, McGladrey called on companies to invest more in upgrading their hardware and software and conduct regular penetration tests to assess their security. Currently, McGladrey said too much infrastructure relies on wireless networks that connect to the internet and deliver over-the-air updates, so a more secure alternative is needed.

The White House’s labeling system for internet of things (IoT) device cybersecurity could also serve as a roadmap to help rate how resilient EV chargers are in the face of threats, McGladrey said.

Beyond simply upgrading existing technology to improve cybersecurity, others suggested that security be integrated into new software and hardware from the beginning. Jillian Goldberg, chief revenue and investment officer at automotive security company GuardKnox, called that approach “security by design,” adding that it would help build more trust in charging infrastructure, whose vulnerabilities are well known and may be slowing deployment.

“I like to say, if I gave you a car and said, your brakes are going to work 99% of the time, are you going to drive that car? Probably not,” she said. “If I'm going to give you a charging station and say this will be secure 99% of the time, are you going to use that charging station? Probably not.”

 As well as upgrading EV charging technology regularly, McGladrey said regulators worldwide should work to have as much of the infrastructure as standardized as possible, so that it is interoperable and provides at least a minimum standard of protection in both the hardware and software to prevent attacks. Vendors applying for NEVI funding, for example, will be required to meet minimum standards and requirements, part of an effort the federal government believes will help ease cybersecurity concerns.

In Singapore, vendors must follow cybersecurity guidelines for IoT devices sold and used in the country — a good model for EV infrastructure, McGladrey said, as it incentivizes manufacturers to follow those rules if they want to be able to sell their products. 

Leading nations like the United States, United Kingdom, Canada and Australia could even partner on cybersecurity standards for EV infrastructure, he said. There are differences in models, but manufacturers in those countries are essentially “selling the same kit,” he added.

Standards can also help governments respond to attacks. If there were a common infrastructure or software for EV charging, technologists could quickly assess the damage, regardless of the manufacturer.

“The idea is that even if you are a small cog in a giant machine, you still need to know how the whole machine operates, so that you know exactly what the implications of flaws in the other parts may be,” said Sunil Chhaya, a senior technical executive at the Electric Power Research Institute, during a Nextgov webinar earlier this year.

The International Organization for Standardization has already taken steps toward EV charging security standards by specifying terms and definitions and general requirements. And domestically, the National Institute of Standards and Technology has held many conversations on the topic of standardization. A NIST spokesperson did not respond to requests for further comment.

As the rollout of EV charging infrastructure continues, both McGladrey and Goldberg said they are skeptical that cybersecurity will be seen as a priority until there is a major cyberattack — which Goldberg called a “black swan event” — that forces companies to reassess their priorities.