bert hubert 🇺🇦🇪🇺🇺🇦

Software developer, entrepreneur, former government regulator, current government advisor, amateur scientist.  https://berthub.eu/ - Nederlands account bert_hubert@mastodon.nl

Website: https://berthub.eu/
Orcid: https://orcid.org/0000-0001-6317-0670
Linkedin: https://www.linkedin.com/in/bert-hubert-b05452/
Location: The Netherlands

Public Key

npub1x5rldse034lrakl92u9dxdq2fx5x8kdht7kaxc3dda4u2de29teswkzpt5

NIP-05 Address

bert_hubert_at_eupolicy.social@momostr.pink

Profile Code

nprofile1qqsr2plkcvhc6l37m0j4wzknxs9yn2rrmxm4ltwnvgkk7679xu4z4ucprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntqyg8wumn8ghj7mn0wd68ytnhd9hx2kulmyq

Publishing to

Author Public Key

npub1x5rldse034lrakl92u9dxdq2fx5x8kdht7kaxc3dda4u2de29teswkzpt5

Show more details

Last Notes

2026-10-25 14:51:44 UTC

- reply

the heavy water rabbit hole goes quite deep! https://en.wikipedia.org/wiki/Norwegian_heavy_water_sabotage

2026-10-25 14:47:02 UTC

- reply

yes, "HDO" is in fact more common: https://en.wikipedia.org/wiki/Semiheavy_water

2026-10-23 08:33:19 UTC

Things that make you go "mmm", my #Marstek home battery suddenly discovering it is actually fully charged, and spontaneously starting a discharge. At 04:15. I measure it actually delivering 500W right now.
https://eupolicy.social/system/media_attachments/files/117/489/289/702/524/713/original/a1adc3efcbcef0de.png

2026-10-23 08:10:39 UTC

I predict that Galileo satellite E09 will be taken out of service rather soon. Too many of these clock jumps. Follow this all live on [@gnss_changes](https://bot.country/@gnss_changes )
https://eupolicy.social/system/media_attachments/files/117/489/204/318/572/207/original/27e206fd04e73302.jpeg

2026-10-22 22:03:38 UTC

- reply

I'm supposed to have no work meetings planned tomorrow... thanks for the wise words!

2026-10-22 20:26:47 UTC

- reply

same on my screen :-)

2026-10-22 20:12:32 UTC

Could we maybe tomorrow have no infosec drama? I need a rest.

2026-10-22 07:11:46 UTC

- reply

ik vermaak mezelf met de gedachte dat het nog tech een enorm vermogen kost om mijn bezoekjes aan Brussel weer terug te lobbyen.

2026-10-22 07:06:42 UTC

- reply

dit is correct. Dan heb je in een keer 9 kranten.

2026-10-20 19:23:05 UTC

- reply

heb het oorspronkelijke bericht wat bijgewerkt nav Teun's nuance. Blij dat Teun bestaat!

2026-10-20 18:27:53 UTC

- reply

iemand die je internetverkeer kan onderscheppen kan nu zich voordoen als Rabobank.nl. Normaal beschermen die certificaten daartegen. Maar er is nu een tussencertifcaat geheel uitgelekt waarmee boeven nu zelf certificaten kunnen drukken. De geheime sleutel van het certificaat was overigens “4”.

2026-10-20 17:58:59 UTC

- reply

https://xkcd.com/221/

2026-10-20 17:58:39 UTC

https://xkcd.com/221/ relevant today.
https://eupolicy.social/system/media_attachments/files/117/474/528/565/040/566/original/af84889a3f72e52c.jpeg

2026-10-18 11:37:12 UTC

- reply

“The problem is that most governments are by now infused with big-tech aligned employees, contractors and consultants. These people aren’t necessarily corrupt, but if you’ve delivered services for 25 years based on Microsoft platforms, it becomes very tricky to think about anything else”

2026-10-18 11:21:07 UTC

Heading to Brussels again to talk about digital autonomy. Hoping to share what I learned from various European government IT projects. And this is much needed since a lot of discourse tends to be quite removed from practice: https://berthub.eu/articles/posts/eu-civil-society-need-progress-digital-autonomy/

2026-10-17 21:42:11 UTC

- reply

AI crossover from Go perhaps?

2026-10-16 09:48:38 UTC

There is a fascinating connection between M.C. Escher and Roger Penrose (who is still with us). Penrose (re)discovered "impossible stairs" as an object, and when Escher read about these he turned this into his famous painting "Ascending and Decending": https://escherinhetpaleis.nl/en/about-escher/escher-today/ascending-and-descending

2026-10-15 10:02:05 UTC

RE: https://ieji.de/@teezeh/117443249102997715
This would be cheap btw.
#note10a6…xkmv

2026-10-14 21:23:12 UTC

RE: https://social.edu.nl/@OpenTech_AUC/117441360356750484
News in English: https://nltimes.nl/2026/10/14/amsterdam-server-seized-request-us-authorities-antifa-allegations
#note13fp…y32g

2026-10-14 15:56:49 UTC

Currently, hundreds of GW of residential solar power are controlled by terribly insecure & unregulated clouds owned by companies continents away. This problem is well known & could take down the whole European energy grid. We just had a conference about it, and still nothing is happening. Here's my writeup: https://berthub.eu/articles/posts/solar-nightmare-at-the-conference/ #ENISA #NIS2 #CRA

2026-10-13 14:48:06 UTC

Near holy ground.
https://eupolicy.social/system/media_attachments/files/117/434/142/562/973/111/original/77781780e50f86ed.jpeg
https://eupolicy.social/system/media_attachments/files/117/434/143/977/369/767/original/5f3ecdc7cbd4b25f.jpeg

2026-10-13 09:52:35 UTC

- reply

ik zou zeggen, zet het internet in om het te ontdekken.

2026-10-13 08:15:36 UTC

- reply

Dit zijn de Deense makers van koelkasten met allemaal standaardwachtwoorden en afgrijselijke security practices. Dit is de club waar Frankrijk last van had, alwaar ze deze koelkasten naakt aan het internet hadden hangen. NIS2 en CRA zouden hier wel raad mee weten.
https://eupolicy.social/system/media_attachments/files/117/432/598/897/408/787/original/a52d676e955b5fbc.png

2026-10-12 17:23:34 UTC

- reply

Welcome! I too love data journalism.

2026-10-12 17:07:49 UTC

RE: https://mastodon.social/@heidilifeldman/117428664447339160
In legal terms, governments often perform "fishing expeditions" in which they don't know what they are looking for, but are betting they'll find something if they just search hard enough. In sane countries (investigative) judges frown on this practice. And yet. https://en.wikipedia.org/wiki/Fishing_expedition

2026-10-12 08:21:21 UTC

- reply

statement in English from giant parent company AholdDelhaize https://newsroom.aholddelhaize.com/ahold-delhaize-takes-precautionary-measures-following-cybersecurity-incident/

2026-10-12 07:03:00 UTC

The largest supermarket chain in the Netherlands reports an “IT incident” and has ceased deliveries, shut down its website, and is showing wrong prices in physical stores, which still operate. Also say the shutdown is a protective measure. https://nos.nl/artikel/2634644-geen-bezorging-en-verkeerde-prijzen-in-supermarkt-na-it-incident-bij-albert-heijn /cc @npub1lcc…lcye

2026-10-09 19:21:25 UTC

- reply

she's a very wise woman!

2026-10-09 18:49:56 UTC

- reply

- perhaps of interest! From their initial report:
https://eupolicy.social/system/media_attachments/files/117/412/447/768/558/605/original/0d9d783ad3142db4.png

2026-10-09 18:39:32 UTC

I attended an electricity conference on Thursday, in which the Polish grid operator shared great data on how late 2025 various parts of their grid got hacked. They have bravely explained the mundane problems that got them hacked. Default passwords, password reuse, missing matches. And I assure you, everyone has these stupid mistakes. Fix the basics first and then worry about super-duper attackers. Glorious details in here: https://cert.pl/en/posts/2026/08/incident-follow-up-report-energy-sector-2025/

2026-10-09 10:36:17 UTC

- reply

operational technology, also known as PA, Procesautomatisering. Stuff that can go boom.

2026-10-09 07:23:14 UTC

- reply

enjoy!

2026-10-08 15:05:43 UTC

- reply

Well this is timely! https://friendica.helvetet.eu/display/a7e70941-07eda3a6-067b6fc05162a6b4

2026-10-08 14:58:32 UTC

- reply

And as a live example, news from yesterday every SunGrow customer could have their panels taken over/reconfigured and probably taken offline permanently by passing 'login_type="5"' and no password: https://jakkaru.de/articles/sungrow-vulnerability-exposes-gigawatts-worldwide

2026-10-08 14:50:28 UTC

- reply

Many of us have been raising the alarm about this for many years, but things are only getting WORSE: https://berthub.eu/articles/posts/the-gigantic-unregulated-power-plants-in-the-cloud/

2026-10-08 14:38:25 UTC

- reply

I’m not worried about your or my panels. It is about the 99% of the market which is controlled through dreadfully insecure cloud based setups of unsure ownership. Viz: https://jakkaru.de/articles/sungrow-vulnerability-exposes-gigawatts-worldwide

2026-10-08 14:31:56 UTC

RE: https://eupolicy.social/@bert_hubert/117403890256929658
The last minutes of the day were the most important ones. How is it possible that governments continue to allow over 100GW of solar panels “behind the meter” to operate with NO enforced regulation while the apps and clouds that control those panels are ASTOUNDINGLY insecure. A true outcry from a Belgian electricity operator “we can’t solve this”. This could easily bring down the entire grid. #CyberGrids26
#note1qg4…2hn8

2026-10-08 13:53:44 UTC

RE: https://eupolicy.social/@bert_hubert/117403890256929658
Thread is done! Will turn it into an article too.
#note1qg4…2hn8

2026-10-08 13:48:15 UTC

- reply

And that ends the conference & also the live blog. I'll turn it into a blog post eventually. Thank you for listening along! 👋

2026-10-08 13:47:04 UTC

- reply

ACER notes they work with actual electricity networks and generators and not just with other policy people. "We operate one layer lower". ACER almost apologises for demanding precision and accurate answers, but they say the value is so high to get this right, they do it like this because it is so important. ACER clearly loves the grid [I believe Slawomir]. He thanks us for our presence, and he hopes to be back next year!

2026-10-08 13:44:56 UTC

- reply

Slawomir again underlined what Marta said, the infrastructure and OT challenges are enormous and require a lot of attention, including the dependencies. "This is the elephant in the room". Some remarks from ACER: it is a privilege to work with you, where "you" should be understood very widely. We all work on the European grid. ACER provides the covers of the book that everyone is writing. https://european-union.europa.eu/institutions-law-budget/institutions-and-bodies/search-all-eu-institutions-and-bodies/agency-cooperation-energy-regulators-acer_en

2026-10-08 13:41:04 UTC

- reply

The point was well taken that we need "wizards", very good technical people, and not just more regulation. We need motivated people that work on our security. And more forms.

2026-10-08 13:40:02 UTC

- reply

Finishing remarks from Slawomir Bryska from the ACER committee. He worries about the polish attack, which was long in building. He echoes the findings there - mediocre/bad cyber security. Basis hygiene not implemented.

2026-10-08 13:37:07 UTC

- reply

This may be the most important part of the day. The gigawatts per country controlled via absolutely terrible insecure cloud controllers remain unaddressed.

2026-10-08 13:34:49 UTC

- reply

Some unhappiness in the audience about the lack of enforcement of standards. DSO employee says they can't enforce things. This is about the "behind the meter" area. Belgian DSO employee stresses the ENORMOUS impact of disruption of the grid is. "We must act on small devices with IP addresses that can kill the grid". What is the point of the legislation if it can not be enforced.

2026-10-08 13:32:10 UTC

- reply

Marta Solas Hernandez again (RIGHTFULLY) emphasises the need to inventory dependencies and TEST them. We discussed that earlier in the day also, keep it real, get those basics right. We can debate standards all day long, there is a lot of basic work that we need to start with.

2026-10-08 13:25:54 UTC

- reply

Audience questions. Your reporter's brain has turned to mush, so only some highlights from here on.

2026-10-08 13:21:28 UTC

- reply

Marta Solaz Hernandez of i-DE/E.DSO Advocates for defence in depth, and not hurriedly replace everything. This means figuring out what is critical and what not, and what the paths are. Notes that things are very unpredictable. They too need to work on their devices. #CRA Conformity assessment is not yet delivered by EC. This makes it hard to be compliant! A lot of concern within DSOs. There is legal uncertainty who needs to comply.

2026-10-08 13:17:47 UTC

- reply

Heloise asks, how should we deal with legacy equipement, sometimes out of support, and clearly pre-standard. Marta Solaz Hernandez responds, mentions again the dependencies, and this might impact us (DSOs). OT infra is not comparable to IT servers. Very long lifecycle investment, we cannot replace overnight everything, integrated in everything. Needs new documentation training monitoring. We need a balance, "a risk based approach". This will give us some time, maybe 2028, 2029. This is after CRA

2026-10-08 13:14:29 UTC

- reply

Mentions a business case of a 100kW grid connection with 300kW of generating/consuming devices on there. Can only work with a local edge device that coordinates all that. Safely. That is a business case.

2026-10-08 13:13:30 UTC

- reply

EVs, solar panels, heat pumps, batteries all need to become dynamic. The MONITORING clouds are not good enough not safe enough to actually CONTROL those gigawatts. Paul sees a future where there could be a physical device, behind the meter, to control all of this.

2026-10-08 13:12:21 UTC

- reply

Paul Mignot is asked if the existing standards are sufficient for the rapidly evolving landscape with home batteries etc. Withhegrid sees "small things at home" as as problem, and the risk assessment of cloud controllability. That is where the gigawatts of capacity is. There is no regulation there (!). The OEM cloud is huge, we can't quickly replace it. We need some kind of CC for OEM/Vendor clouds (YES) in order to be able to safely offer flexibility solutions, which is where the value is.

2026-10-08 13:10:10 UTC

- reply

Matus thinks the common criteria mechanisms will work to get vendors to comply with the CRA. Again notes the work on the delegated act and the presumption of conformity [these things are very important to hear for the CRA community]. Want to help manufacturers to match the requirements.

2026-10-08 13:08:40 UTC

- reply

Matus from EC: how are the vendors going to comply? He explains this is a newly regulated sector, and it will take time. Matus also thanks the experts, CEN-CENELEC, ETSI. Worries about capacity for confirmance checks Also with the common criteria community are working on surveillance. Also notes the possibility of the delegated acts [in case things are not moving along].

2026-10-08 13:06:56 UTC

- reply

Are we ready or not? Well. Standards are processing well, many have finished the first step and about to be sent of to ? which is the first step. Heloisie also comments, the experts are working very hard. It is a colossal project, we try our best.

2026-10-08 13:05:49 UTC

- reply

CEN-CENELEC's Catherine weighs in, she states with the CRA they did not start from zero. ETSI and CEN-CENELEC had to develop a lot of standards. "Start with coherence between experts and industry as soon as possible". Make sure the right expertise is around the table, not easy. This means training experts how to do standards. Standards need to be developed quickly but they also need consensus. Catherine again thanks the experts & how hard they worked.

2026-10-08 13:03:07 UTC

- reply

Yonas Leguesse from ENISA also lauds standards and the hard work that has been done. In terms of lessons learned, recommends "reuse and not reinvent". Mentions the Radio Equipement Directive (RED). I think he says more should have been reused. Are we ready? A standard is just the start. ENISA followed up with 'notified bodies', who need to know what to do. Ecosystem still needs to grow, but Yonas thinks it is looking good, good baseline.

2026-10-08 12:59:13 UTC

- reply

"We are missing the link between the cybersecurity standards and the grid themselves". If you mess up your cybersecurity, you can stay on the grid. If you mess up the requirements for generators your assets get removed from the grid! But cyber is fine. Recommends balancing these risks - they are just as important.

2026-10-08 12:57:52 UTC

- reply

Marta again stresses managing dependencies. Minimise even, keep track of them. We may need additional suppliers so if one vendor drops out, we have other options. Mignot of Withthegrid notes that they supplied sensors to DSOs on non-critical sensors. LOADS of regulation. Now when he supplies electricity management and trading: no regulations at all. CRA is again going to help, but far to go.

2026-10-08 12:55:45 UTC

- reply

This is not just a matter for contracts, not just add the requirements [cra etc]. We must do audits on our suppliers, we must manage our service very closely. We must work very closely during events, during training, involve them in our business continuity plans, have them join our exercises, so we can work together in an event. [This sounds very good, and unlike some DSOs]

2026-10-08 12:54:23 UTC

- reply

Marta Solaz Hernandez (E.DSO) is asked, how should utilities and manufacturers share responsibilities, and where do these responsibilities begin and end. She notes cybersecurity is always shared. She thinks manufacturers are responsible, and DSOs need to deploy correctly. But it still is a shared thing. CRA will help. Obligations on the vendors. It plugs a gap. DSOs needs to manage their suppliers & dependencies: the basis for resilience.

2026-10-08 12:51:13 UTC

- reply

Catherine from CEN-CENELEC. Our standards come from committees. Agreed sets of rules. Further lauds standards. We all love standards! [once we have them]. CEN-CENELEC goes on about the CRA, that they work on it on behalf of the EC. "We're almost there". CEN-CENELEC also works with other standardisation bodies. Standardisation is really great and important. Resources important too. Everybody should be at the table. More generic talk on standards. Standards!

2026-10-08 12:46:16 UTC

- reply

Heloise asks Matus what the role of certification can be. He worries most from the supply chain, vendors, software suppliers of connected equipment. If one supplier is compromised, this percolates through sectors and across borders. What we need to do to address this. Certification needs transparency. "What is in their supply chains?". Entities can then not fully identify their risks. [talks of things I don't understand on standards]

2026-10-08 12:43:12 UTC

- reply

Matus Baliak from EC now. He notes many people have already said what he would like to say. He sees standards as major and essential. Legislation follows reality with a certain delay, 5, 10, 15 years. We can't afford that anymore! We need standards so we can speed up. Developing standards is still challenging, capacity, time. Asks for more and better involvement with standards setting.

2026-10-08 12:41:16 UTC

- reply

Standards can help, common language, a baseline, cooperation. Standards and regulation will help, but we also need to train and drill and test ourselves in a crisis scenario. Resilience is minimising impact, being able to continue to deliver service. She worries about dependencies [unclear to me which ones].

2026-10-08 12:39:59 UTC

- reply

Marta Solaz Hernandez (i-DE) now comments on the goals of DSOs: keep the lights on. Very neat and simple mission she says. Things are becoming more complex, lots of interconnections, technology. As DSOs we need data, digitalisation, we need technology. Notes that infrastructure is behind on that. Resilience is no longer local, but it goes abroad and to other places. "We don't feel cyber secure only managing our own infrastructure". Supply chain, technology, services: all worrying.

2026-10-08 12:37:25 UTC

- reply

Paul calls for an independent layer, what are the security standards that we need? But also an energy system where we are in control ourselves. This layer needs to be sovereign,, European, flexibel on asset and trader side, and must meet all the regulatory requirements. Sounds like a good idea.

2026-10-08 12:36:26 UTC

- reply

Paul Mignot of Withthegrid/windenergy, formerly with a grid operator, asks who is controlling the control layer, and what will it cost? Who controls the flexibility is important. The ability to control flex is "locked in". We need flex for grid congestion. This is locked in to the manufacturer cloud, it is locked in to the trader. Changing this for more flexibility is expensive.

2026-10-08 12:34:41 UTC

- reply

Catherine Vigneron of CEN-CENELEC one of the standardisation groups in Europe. Catherine explains that their members are 34 European member state organisations. "Experts build standards". Experts appointed by experts. (UNLIKE ETSI, she doesn't say).

2026-10-08 12:33:19 UTC

- reply

Every panelist gets an initial comment. Yonas from ENISA starts off with saying that the CRA is not going to make everything secure, but devices will start to become more secure, secure by design. CRA will make that happen.

2026-10-08 12:31:52 UTC

- reply

"Building resilience: standards, supply chains & risk in action". Headed by Heloise Enjalbal of ENCS. Panellists from EC (DG CNECT) , CEN/CENELEC, WithThegrid, ENISA and I-DE;E.DSO.

2026-10-08 12:29:21 UTC

- reply

New panel!
https://eupolicy.social/system/media_attachments/files/117/405/288/915/764/880/original/85e764165ed4a896.jpeg

2026-10-08 12:23:02 UTC

Question: is the Cyber Resilience Act going to help? Harm thinks it will help, but we should still be testing if people stick to the CRA. CRA still leaves room for companies to be very slow in addressing issues. [not sure if this is true though].

2026-10-08 12:20:55 UTC

- reply

Harm reiterates that the cloud is a far bigger worry. Question from the audience, is there something better than Modbus? MQTT could have TLS, but could also be insecure. Harm notes they are working together with ELAAAD (?) to write beter protocols.

2026-10-08 12:18:56 UTC

- reply

Humaz now has some recommendations: turn off Modbus, and industry should move to better protocols that do have encryption. Now we move to Q&A: Do you also scan IPv6? No, there are too many of them. Was it easy to hack the Rumba? How did you do that? Harm notes you can simply buy access through televisions/residential proxies.

2026-10-08 12:15:51 UTC

- reply

Harm promises that the vacuum cleaner will now clean! It does so. And now the light goes out, because the vacuum cleaner has hacked the battery. They repeat this to show that it works. Nice.

2026-10-08 12:14:33 UTC

- reply

The vacuum cleaner has been hacked! It has connections to local devices, like the battery they show. They also have a lamp that is connected to the battery.

2026-10-08 12:13:42 UTC

- reply

An attacker needs access to your home network somehow, and then they can talk Modbus to your stuff. Harm explains that the cloud vulnerabilities are too sensitive to disclose because they are 10-100GW scale vulnerabilities. This is a smaller local exploit, but attackers could also scale that. They now show a Roomba cleaner, and Battery box, connected through their Wifi.

2026-10-08 12:11:20 UTC

- reply

They explain you can do cloud based attacks, or locally, and they are going to do a local approach: Modbus. A 1970s plaintext very simple protocol. It does reads or writes, that's it. Modbus is usually segmented because it has no security. In a home network, Modbus is typically very exposed. Modbus now also exists on TCP. It used to be serial wire only.

2026-10-08 12:09:32 UTC

- reply

Here their battery box is what they are likely going to hack.
https://eupolicy.social/system/media_attachments/files/117/405/211/501/549/899/original/474c48a154e700dc.jpeg

2026-10-08 12:07:59 UTC

- reply

Chris explains how big a benefit they supply to the energy community, and they'd appreciated some donations. Now, it is demo time! Harm van den Brink and Humza Ahmad from ENCS on stage now.

2026-10-08 12:07:01 UTC

- reply

Chris explains that DIVD is allowed to do this hacking because of Dutch law, which gives them the room to do this. Chris now explains how they themselves got hacked some time ago, through their helpdesk system Zammad, in which there were 2 0 days. They have now published the details of how they got hacked. NCSC-NL and ENISA have also been helpful. They have found notes in the hacked systems which are clearly AI-generated. And it looks weird. DIVD does this for free, and they are out of money.

2026-10-08 12:03:33 UTC

- reply

However, it turns out that some vendors do not respond to vulnerability reports. And then DIVD goes to the government, and the government will approach the vendor. Four vendors have now finally responded via this way. Some of these report were filed in January, but were only published now after intervention from the Dutch government.

2026-10-08 12:01:52 UTC

- reply

Chris explains how ENCS does testing on inverters, and they found that SolaX inverters have a very weak cloud setup, and they could hook into the MQTT stream of Sungrow, and see everyone's data. Shows logos of Sungrow, Mennekes, Huawei, SolarEdge, Growatt and tell us they created 100 vulnerability CVEs for these vendors.

2026-10-08 11:59:24 UTC

- reply

DIVD moved away from the US vulnerability numbering system and moved to ENISA "since we no longer trust the US government, sorry Americans". An American in the room chimes up "we also don't". Publishing such hardware vulnerabilities with CVEs is good for supply chain awareness.

2026-10-08 11:56:39 UTC

- reply

They contacted the vendor, who somewhat improved their act, but they never really fixed it. So DIVD went to the press and to the @npub1aca…2aqg and they confirmed the situation was terrible. But government had no power to act. DIVD investigated the Enphase inverters subsequently. And the found they could try random customer numbers and gain access to random customers. DIVD assigned this a CVE vulnerability itself. And published the vulnerability.

2026-10-08 11:54:01 UTC

- reply

Chris notes DIVD itself got hacked, and they get a lot of threats of lawsuits, but so far they themselves never had to go to court. We now move to their latest discovery, a solar panel control panel, for 10GW of power over 1 million subscribers. The control panel could also send out new "improved" firmware. https://csirt.divd.nl/cases/

2026-10-08 11:50:36 UTC

- reply

Chris starts with an introduction of DIVD, "we hack the whole world", together with our partners like ENCS. https://www.divd.nl/ and https://encs.eu/ - "DIVD provides a place where helpful hackers can do their thing". Also some other people, by the way.

2026-10-08 11:48:37 UTC

- reply

And we're back from lunch! Chris van 't Hof, Harm van den Brink and Humz Ahmad from ENCS will demonstrate a live hack and resolution of a high power IoT device. Chris from DIVD starts with a talk on "how we hack the power grid to make it safer".

2026-10-08 10:31:23 UTC

- reply

(with AI they built all kinds of interesting things from cybersecurity, included automated analysis of incidents, the analysts get a good initial start from their local models. The goal is to support the analyst). They have replaced many lost people with AI, and it works well for them. They did not do the AI because it was a hype, it works for them). Now, lunch break!

2026-10-08 10:25:34 UTC

- reply

"Write down your knowledge in case you lose people" - people are the fragile part [in war]. "AI as a force multiplier in a Wartime SOC". They lost vendor support, they did not offer "Wartime support". They paste their problems in AI now and get better support than from vendors.

2026-10-08 10:22:34 UTC

- reply

(can you imagine how a non-war-impacted TSO would respons do AI-enhanced phishing and impersonation?)

2026-10-08 10:21:19 UTC

- reply

They demand second factor out-of-band verification of all communications. They use AI for analysis, to compensate for the people they lost to mobilisation. "AI proposes, human decides, and not in OT environment".

2026-10-08 10:19:32 UTC

- reply

Lost a 50% of staff to military service. SOC is now distributed across people and work locations. Suppliers stopped deliveries and support because of the war. "The grid does not get a maintenance window". Now onto AI. Painfully good phishing attacks, faster malware, deepfakes and pretexting. They fought this through analysis of communications.

2026-10-08 10:17:26 UTC

- reply

Ukrenergo is the transmission system operator, sycnrhonized with the European grid since 16 March 2022. "We do ISO 27001, but the enemy writes our rules". 15 people (!) run integrated IT and OT SOC.

2026-10-08 10:15:52 UTC

- reply

Next on stage, UKRAINE! NPC Ukrenergo presents on "Experiences and Developments , running a security operations center through a full-scale war". 🇺🇦🇺🇦🇺🇦