Breaking into a regional grid usually means beating hardened, purpose-built communications equipment. A Hong Kong Polytechnic University team argues a cheaper route runs through the app a driver opens to find a plug.
Prof. Bu Siqi, of the Department of Electrical and Electronic Engineering, led the modelling work behind it. The group tested what happens when an intruder plants a handful of false data points in charging prices and live traffic readings. Their sparse vector attacks move a recommendation just far enough that a large share of drivers converge on one site inside a short window.
Where two well-defended systems meet
Traffic management platforms that route and monitor cars, and grid platforms that balance generation against demand, each tend to be competently run on their own. The exposure appears at the seam between them, where vehicle behaviour is read as a control signal. Demand that bunches into a few minutes can trigger local outages or leave a feeder with far less headroom than operators planned for.
The authors published in IEEE Transactions on Transportation Electrification. Their proposed fixes lean on spotting unusual price and traffic readings, tightening the links between the two domains, and flagging odd recommendation patterns before drivers act on them.
The soft part is public
What makes the scenario awkward is that the entry point sits in consumer software. Charger locator apps are built for convenience and carry little of the authentication that utility control traffic does, so a meaningful slice of grid risk now rests on products that few operators count as critical infrastructure.
