Autonomous Cyber Response in Electricity Systems

1. Introduction

Autonomous Cyber Response in Electricity Systems means the use of automated technologies to detect, analyse and respond to cyber threats affecting electricity infrastructure. Modern electricity systems increasingly depend on digital technologies such as SCADA systems, smart meters, intelligent electronic devices, automated substations, artificial intelligence (AI), cloud platforms and communication networks.

A cyberattack on these systems can interrupt electricity supply, damage equipment, manipulate operational data or threaten grid stability. An autonomous cyber-response system can therefore detect suspicious activity and automatically take protective action.

For example, if an automated system detects unauthorised commands being sent to a substation, it may isolate the affected communication channel, block the suspicious connection, preserve evidence and alert the system operator.

2. Meaning and Main Functions

An autonomous cyber-response framework generally performs four functions:

Detection

Sensors and cybersecurity software continuously examine network traffic, system commands and operational data to identify abnormal activity.

Analysis

Artificial intelligence or rule-based systems assess whether the activity resembles malware, unauthorised access, data manipulation or another cyber threat.

Automatic Response

The system may block access, isolate a compromised device, change network routes or move an affected component into a protected operating mode.

Recovery and Reporting

The system records the incident, alerts responsible personnel and assists in restoring normal electricity operations.

The objective is to reduce response time and protect grid reliability, rather than to replace human legal and operational responsibility.

3. South African Legal Framework

The Electricity Regulation Act 4 of 2006 (ERA) establishes the national regulatory framework for electricity generation, transmission, distribution, trading and related activities. It also makes NERSA the custodian and enforcer of the national electricity regulatory framework.

The South African Grid Code provides important operational requirements. NERSA's Grid Code governance framework identifies NERSA as the administrative authority responsible for ensuring that the Grid Code is compiled, implemented and complied with.

Cybersecurity also interacts with the Cybercrimes Act 19 of 2020, which creates cybercrime offences and provides mechanisms concerning investigation, reporting and prevention of cybercrime.

Therefore, an autonomous cyber-response system must operate within both technical electricity regulation and general cyber law.

4. Relevant Case Laws

Eskom Holdings v Sonae Arauco (2024)

In Eskom Holdings SOC Ltd v Sonae Arauco (Pty) Ltd, the Supreme Court of Appeal considered the legal status of the Grid Code and electricity-system stability. The court confirmed that the relevant Codes form part of licence conditions. It also recognised the System Operator's obligation to take prompt remedial action where an abnormal condition threatens reliable grid operation.

This principle is important for autonomous cyber response. If a cyberattack creates an abnormal condition threatening grid stability, automated protective measures may form part of the operational response, provided they are consistent with applicable legal and technical requirements.

United Democratic Movement v Eskom (2023)

In United Democratic Movement and Others v Eskom Holdings SOC Ltd and Others, the High Court considered Eskom's obligations under its licences and the South African Grid Code. The judgment noted that the Grid Code and related standards require protection of the operational integrity of the electricity system.

For autonomous cyber-response systems, this demonstrates that cybersecurity cannot be separated from the broader obligation to maintain a reliable electricity grid.

Eskom Holdings v Vaal River Development Association (2022)

The Constitutional Court's decision in Eskom Holdings SOC Ltd v Vaal River Development Association is important for understanding electricity regulation, licence conditions and public-law responsibilities. The case demonstrates that electricity-system decisions operate within statutory and constitutional requirements.

Accordingly, an automated cyber-response mechanism should not operate as an uncontrolled private decision-maker. Its authority must ultimately come from the applicable regulatory and operational framework.

E.M. v Eskom Holdings (2025)

In E.M. and Another v Eskom Holdings Limited, the High Court considered liability under section 25 of the Electricity Regulation Act in relation to an electrical accident involving vandalised infrastructure. The court examined issues of foreseeability, causation, statutory responsibility and negligence.

Although the case was not about cyberattacks, its principles are relevant to autonomous systems because automated protective decisions may affect physical electricity infrastructure. Operators therefore need to consider foreseeable risks and maintain appropriate safety controls.

5. Legal Requirements for Autonomous Cyber Response

Lawful Authority

An automated response must be authorised by applicable legislation, licence conditions, grid codes or valid operational rules.

Human Oversight

High-impact actions, such as widespread disconnection of electricity infrastructure, should have appropriate human supervision and emergency override mechanisms.

Audit Trails

Every automated action should be recorded, including the detected threat, decision rule, response taken and system recovery process.

Cybersecurity Testing

The autonomous system itself must be protected from manipulation. An attacker who controls the response mechanism could cause more damage than the original attack.

Proportionality

The response should correspond to the identified threat. A minor cyber anomaly should not automatically cause unnecessary large-scale electricity interruption.

6. Challenges

Autonomous cyber response creates several legal and technical challenges. False positives may cause unnecessary disconnection. False negatives may allow attacks to continue. AI systems may also produce decisions that are difficult to explain.

Another issue is responsibility. If an automated system incorrectly isolates a major electricity facility, questions may arise concerning whether responsibility belongs to the software developer, system operator, licensee or regulator.

Clear allocation of responsibility is therefore essential.

7. Conclusion

Autonomous Cyber Response can significantly strengthen electricity-system security by allowing threats to be detected and contained within seconds. It can isolate compromised network nodes, protect substations, preserve operational integrity and reduce the consequences of cyberattacks.

However, automation must remain subject to electricity law, cybersecurity law, Grid Code requirements, safety principles, accountability and human oversight.

The reasoning in Eskom Holdings v Sonae Arauco, United Democratic Movement v Eskom, Eskom Holdings v Vaal River Development Association and E.M. v Eskom demonstrates the importance of reliable system operation, lawful regulatory authority, safety and responsibility.

The appropriate legal model is therefore “autonomous response with accountable human governance.” Technology may detect and respond to cyber threats automatically, but electricity licensees and responsible authorities must remain legally accountable for the design, supervision and consequences of those systems.