What the order does and why it matters
The Trump administration just signed an executive order that prohibits U.S. entities from buying foreign‑made hardware and firmware for any bulk‑power system rated at 69,000 volts or higher. That covers substations, control rooms, generating stations, reactors and the software that runs them.
Why now? In the past month water utilities in at least a dozen states reported cyber intrusions, and the federal cyber‑defense agency logged malicious activity against more than 100 internet‑exposed water and wastewater plants. A small British power plant was knocked offline for four days – a stark reminder that the energy sector is a ripe target.
Technical scope of the ban
The order zeroes in on three categories:
- Physical equipment that handles 69 kV+ electricity – transformers, switchgear, protection relays.
- Control‑system software and firmware that operate that gear.
- Any associated devices in substations, control rooms, generators, or reactors.
Defense, Commerce and Energy departments now have 120 days to draft rules, catalog at‑risk gear, and submit mitigation plans to the White House.
Recent cyber chatter
The FBI recently dismantled a Chinese‑origin botnet that had been used to breach the Federal Reserve, NASA and several other federal agencies. At the same time, the NSA and FBI issued an advisory warning of an AI‑powered “active threat” targeting a specific brand of operational technology used across energy, water and agriculture – the brand name was not disclosed and the claim remains unconfirmed.
OpenAI, Google and dozens of fintech firms have also warned that a narrow window exists to harden defenses against AI‑enabled attacks. The advisory’s implication that state‑backed actors are already field‑testing AI tools is speculative.
Who’s affected?
Any U.S. utility or industrial operator that relies on high‑voltage gear – from regional transmission operators to municipal water districts – must audit its supply chain. Foreign manufacturers that currently sell into the U.S. market will need to pivot or face a de‑facto ban.
Practical steps for defenders
- Inventory every piece of equipment rated ≥69 kV and trace its origin.
- Isolate internet‑exposed control systems; enforce strict network segmentation.
- Apply all vendor‑issued firmware patches immediately; if patches are unavailable, consider temporary removal or air‑gap.
- Monitor for Indicators of Compromise (IOCs) tied to the known Chinese botnet – look for unusual outbound traffic to known command‑and‑control IPs.
- Run a tabletop exercise that simulates an AI‑assisted intrusion on OT assets.
Bottom line: the order is a policy hammer aimed at reducing supply‑chain risk, but the real battle will be in how quickly operators can cleanse their networks and lock down legacy gear.