Panels, Chinese-linked inverters, rush interconnections, and what Iran-linked
water cyberattacks teach ratepayers, utilities, and data-center investors

This is the introduction for the Energy News Beat Research Desk on The Energy News Beat Substack.  

We are providing deeper dives for paid subscribers on Energy Topics, and this was requested by a paid subscriber.

Bottom line up front

[ENB OPINION]  The United States is building solar at historic speed while the component that actually talks to the grid — the inverter — remains heavily foreign-sourced, often Chinese-made or Chinese-headquartered, and only newly gated by the FCC Covered List. That is not the same as proving a nationwide “backdoor census.” It is enough for ratepayers, PUCs, and data-center offtakers to demand provenance, firmware attestation, and network isolation — the same hygiene water utilities learned the hard way when Iran-linked actors hammered internet-facing PLCs.

[ENB ANALYSIS]  Panels are mostly glass and silicon. The risk concentrates where software, radios, cloud portals, and remote O&M live: inverters, monitoring dongles, transformers with digital controls, and the third-party platforms that update them. Treat “Chinese chips in panels” as a supply-chain question; treat inverter firmware and undocumented communications as the operational threat model.

How it works (plain English)

A utility-scale solar farm is a field of modules feeding inverters that turn DC into grid-compatible AC, then step up through transformers to the transmission or distribution system. Distributed (rooftop/community) systems do the same at smaller scale, often with string or microinverters tied to a vendor cloud.

Threat model in consumer language:

• Panel / module risk: Forced-labor and circumvention trade issues (UFLPA, AD/CVD) dominate policy debate. A passive module does not “phone home.” Chips in junction boxes or optimizers can add complexity, but the primary remote-control path is usually the inverter and its communications stack — not the glass.
• Inverter risk: Inverters need remote access for warranty, firmware, and performance. That is legitimate — and it is also how an attacker (or a vendor under duress) could change setpoints, trip offline, or inject bad telemetry. Forescout’s 2025 research found serious flaws in Sungrow, Growatt, and SMA products; vendors patched after disclosure (Forescout, CISA ICSA-25-072-12).
• Undocumented radios / “ghost” devices: Reuters reported in May 2025 that unexplained communications gear had been found in some Chinese-made inverters (and, per sources, some batteries). DOE national labs later inspected ~30 inverters and reported no definitive evidence of malicious wireless functions; two documentation mismatches were called non-malicious (pv magazine, Jan. 28, 2026).
• Analogy, labeled clearly: In August 2026, UK MoD found a Chinese-made camera component on Royal Navy K3 Scout uncrewed surface vessels sending a “heartbeat”/squark to a Chinese IP. MoD said no evidence of MoD data or systems being compromised (BBC, WSJ). That is a supply-chain heartbeat analogy, not proof that U.S. solar farms are similarly beaconing. It shows why “NDAA-compliant” labels and third-party camera/sensor suppliers still need forensic testing.

Who’s behind the hardware (verified)

Modules. U.S. imports shifted hard after AD/CVD circumvention findings on Vietnam/Malaysia/Thailand/Cambodia. NLR’s Winter 2026 update (Census-based): 33.2 GWdc of modules imported in 2025 (−40% y/y); 21.1 GWdc of cells (+50% y/y). On cells, Indonesia (~29%) and Laos (~20%) led 2025 import shares (up from 6% combined in 2024). On modules, Indonesia and Laos together rose to ~56% of 2025 U.S. module imports (from ~5% in 2024). Indonesia+Laos were about half of c-Si cell and module imports combined (NLR Winter 2026). Direct mainland-China module share fell under tariffs, but upstream wafers, cells, polysilicon, and many Chinese-headquartered brands remain central to the global chain (DOE trade overview).

Inverters. Wood Mackenzie: of ~200 GWAC of PV inverters delivered to U.S. C&I and utility projects over ~10 years, more than 90% were imported; more than 70 GW came from Chinese-headquartered manufacturers (often Southeast Asian factories); Chinese-made products held about 50% U.S. market share in 2024 and 2025 (Solar Power World, WoodMac press).

Policy gate — FCC Covered List. As of the Covered List dated October 21, 2026, entry added July 28, 2026 (updated August 20, 2026): “Foreign-produced power inverters” except those with Conditional Approval by DoW or DHS (FCC Covered List). Early Conditional Approvals listed include Power Electronics España GEN3 utility-scale platforms, Dynapower CPS/MPS series, and GE Grid Solutions FLEXINVERTER variants. Scope nuances (wireless vs wired central inverters; firmware updates on already-authorized gear) are still being interpreted by manufacturers and owners (WoodMac commentary).

Transformers. Large power transformers are a separate but related grid bottleneck. DOE’s July 2024 LPT resilience report to Congress documented heavy import dependence historically (about 82% of 2019 domestic LPT consumption imported) (DOE LPT report). That is not a “Chinese solar panel” statistic — it is a reminder that interconnection equipment provenance matters for the same farms.

Costs, limits, and alternatives (sourced)

U.S. module spot prices remain far above global dumps: NLR cites roughly $0.27/Wdc U.S. vs about $0.10/Wdc global at end-January 2026 (NLR Winter 2026). That premium is the visible cost of tariffs, logistics, and domestic-content strategies — not a cybersecurity fee.

WoodMac expects domestic inverters to cost more than foreign imports in the near term after the FCC move, while noting >100 GWAC of announced U.S. inverter manufacturing aiming to start before 2028 — potentially enough to meet demand if builds complete (Solar Power World). ENB does not invent a LCOE delta; project owners should ask EPCs for bid apples-to-apples on Covered List-compliant vs legacy foreign gear, including firmware-update rights.

Alternatives / mitigations that are real today:

• Source non-Covered-List or Conditionally Approved inverters (see FCC list updates).
• Segment inverter OT networks; disable unused radios; require U.S.-based O&M for high-risk sites (DOE recommendations summarized in pv magazine).
• Prefer vendors with published SBOMs, signed firmware, and third-party penetration tests — not marketing claims alone.
• Pair solar with storage and transmission (CAISO own curtailment playbook) so rush capacity does not become stranded midday power (EIA CAISO).

Land, resource, and scale notes

SEIA/WoodMac cumulative 279 GWdc at YE 2025 implies, at a mid assumption of 550 W per module, roughly 507 million panels — or about 465-560 million across a 500-600 W band. That is an order-of-magnitude estimate, not a factory serial-number census. Many older residential modules are 300-400 W; newer utility modules cluster near 540-600 W (NREL/DOE benchmarks). EIA 228 GW July 2026 net-summer figure is AC-side capacity and is not directly divisible into panel counts without DC/AC ratios.

Scale matters for security: a single compromised residential inverter is a nuisance; coordinated manipulation across many utility plants is the scenario DOE flagged as harder but higher-impact (pv magazine).

Limitations and risks

Security. Documented issues are mostly vulnerabilities and supply-chain opacity, not courtroom-proven state kill switches in every Chinese inverter. Reuters raised undocumented communications; DOE limited sample did not confirm malice. CISA advisories on Sungrow (and researcher work on Growatt/SMA) show remote takeover paths via bad crypto, hardcoded credentials, and cloud IDOR flaws — classic insecure-by-design problems that any nation-state or criminal crew can abuse once devices are internet-reachable (CISA, Forescout).

Reliability / rush builds. EIA expects 43.4 GW of new utility-scale solar in 2026 if developer plans hold — 51% of a record 86 GW total planned additions (EIA). SEIA reported 15.7 GWdc already installed in H1 2026 amid safe-harbor and FEOC timing pressure (SEIA data). Faster COD calendars raise the odds of incomplete commissioning, weak OT segmentation, and ship-the-firmware-later culture — the opposite of supply-chain cyber hygiene FERC has been pushing NERC to tighten (CIP-013 family; see FERC, NERC project page).

CAISO evidence of friction: 3.4 million MWh curtailed in 2024 (+29% y/y), 93% solar, driven by spring oversupply, congestion, and the need to keep gas online for evening ramps (EIA). That is not Chinese chips caused blackouts. It is proof that capacity megawatts without deliverability, storage, and flexible resources create instability and wasted energy — a bill that shows up in PPAs and eventually rates.

Policy / trade. AD/CVD, Section 301, UFLPA, FEOC/PFE rules under 2025 tax law, and the FCC Covered List interact. Circumvention through Southeast Asia and now Indonesia/Laos means not Made in China on a customs form is not the same as China-free supply chain.

Figure 3. Rush-build and policy scorecard. Sources: EIA, SEIA/WoodMac, FCC. ENB chart.

Track record and history (documented)

What readers should ask or watch

Practical checklist for consumers, investors, data-center offtakers, and PUC intervenors:

1. Ask the utility or developer for an equipment provenance schedule: module OEM + factory country, inverter OEM + model + firmware version, transformer OEM, EMS/SCADA vendor.
2. Ask whether inverters are on the FCC Covered List, have Conditional Approval, or were authorized before the July 28, 2026 listing — and what that means for future firmware updates (FCC).
3. Ask for network architecture: are inverter portals internet-exposed? Firewalled? Vendor VPN only? MFA? Out-of-band monitoring?
4. Ask for SBOM / signed firmware / third-party pen-test summaries (even under NDA).
5. Ask the PUC docket or IRP: does the utility apply CIP-013-style supply-chain cyber practices to IBRs even when formal NERC CIP applicability is limited?
6. For data centers: put Approved Vendor Lists and rip-and-replace triggers in the PPA / behind-the-meter EPC contract — not a slide deck promise.
7. Watch CISA ICS advisories and FBI PSAs the same week you watch SEIA install charts — both are leading indicators.

Stu’s Take

Open questions

• How many utility-scale inverters currently operating in the U.S. would fail a post-July 2026 Covered List test if they sought new authorization today? (Public fleet census: not found as of Oct. 23, 2026.)
• Will FCC guidance clarify wired central inverters vs wireless-capable string inverters for utility projects? (WoodMac flags ambiguity.)
• What share of 2025-2026 Indonesia/Laos modules still depend on Chinese wafers/cells under AD/CVD circumvention tests?
• Have any U.S. utilities publicly disclosed rip-and-replace programs driven by the Reuters/DOE episode? (ENB found press coverage and guidance, not a standardized disclosure database.)
• Will 2026 Iran-linked water incidents expand formally into energy-sector IBRs beyond the PLC advisory language already spanning Energy?

Fair caveats and criticism

Solar is still among the cheapest new bulk energy options in many U.S. markets on a pure energy basis, and domestic module manufacturing has scaled dramatically (SEIA: module manufacturing capacity 65.5 GW online end-2025). And cheapest when you do not include grid resiliency into the mix. Energy News Beat is very vocal that wind and solar need to be tied to storage to level the playing field of true costs for coal, nuclear, and natural gas. Security concerns must not become a lazy excuse to ignore interconnection reform, transmission, or gas/nuclear firm capacity needs. Conversely, green at any supply-chain cost is how you import tomorrow’s outage. ENB’s bias is verification before trust — demand attestations, not vibes.

Appendix — Make appendices great again – All links are on the Substack Research Tab.