Can I connect a CAD to my smart meters if OVO open the Home Area Network (HAN)?

On the contrary @TerryE

The *only* way to get bullies like people in charge at Ovo to fulfil their regulatory duties *is* to publicise their behaviour and so threaten the one thing (appearances) that they actually care about.

My CAD was paired back in January.

This was a combination of the folks in charge at Ovo realising that their reputation was at risk...and Her Majesty's Government tapped them on the shoulder and suggested that life would be easier if they discharged their regulatory duties.

Don't confuse me negotiating in public with me venting frustration. ;-)

There was an element of frustration yes, but the purpose of documenting how outrageous their behaviour was in public was more about negotiation. And equipping others with the collateral needed to negotiate on more equal terms with a large utility company. 🙂

Your call, but if you do it in a way that gets a smile out of the forum agents, then you might at least get a supporter on the inside.

Fo me life is too short (literally) 🙂

The forum agents are in the same tricky situation as the frontline customer support staff and the smart metering team.

They all know that was I was asking was easy and reasonable.
They all know I asked very nicely the first time.
And they all know that management were complete punks about it.
They should know that I know they've got orders to follow.
They should know that I know management will be bullying them to censor/suppress this thread.
And they should know that I don't hold this against them.

i.e. The forum / frontline support / smart metering people are doing a good job in spite of management's best efforts. This doesn't go unnoticed.

I doubt there'll be any friends on the inside for myself now; whether looking at boiler efficiency is useful or otherwise.

@TerryE I don't believe I've been hostile at any point in my contacts with OVO. The point of my thread title ('I'm not asking to the moon on a stick') was to try and kickstart some action from OVO.

From my perspective, I was glad to see Marko doing the heavy lifting, throwing in a comment where I could.

Once Marko had got his CAD paired I would have expected getting my CAD, same make, model and firmware, would be a simple process as type approval would already be in place. But it seems I was wrong and OVO are choosing to want to go through the whole process again. This is a quote from their last email response to me:

Quote:
Secure will not allow us to add your device until all 3 companies involved are on the same page. Your CAD manufacturer, Hildebrand, also need to liaise with Secure to sort out the authorisation of the device on Secure's network. We are currently in talks with both companies to resolve this as quickly as possible, but given part of this resolution is outside of our control, this hasn't happened as quickly as we'd have liked.

Are they going to do this for every customer that wants to connect a third party device t0 the HAN?

For me scrapping off the web site does not give me the resolution I want.

It's a "discussion" over who pays; be this for the admin hassle or the fleet management system they'll be needing to implement to keep track of this all.

Ovo will want the CAD supplier to foot any bill for pairing the devices. They can't say this out loud. BEIS and Ofgem would be alarmed at them for even thinking that this is acceptable. They can keep bullshitting their way through the delays though.

Technically it's a piece of cake that takes 2 minutes. Management won't allow the smart metering team to do it.

Architecturally the the whole CAD concept seems flawed to me in one area: its security model. This seems to be closed sourced and proprietary, and the vulnerabilities and financial exposure if the system is compromised are absolutely enormous. So for Secure, the disclosure of identification protocols to third party suppliers is a severe risk and it has a duty of care to its customers and to end-users that must be appropriately mitigated. This is all going to take ages.

Keeping their data inside a private network and passing it back to the the energy provider to present in the cloud is far simpler and easier. The security is then all open-source and already the world's standard.

All I then need is to do is to agree an identification moniker with my supplier and sign a consent form to allow it to make my metering data accessible over HTTPS. This could be a very simple request form on the current OVO website. In my case, I can then use access this with a 4 node flow in NodeRED with three standard nodes and one a dozen line function.

Why make it complicated, when simple standard does everything that you need?

Security is a non-issue for a CAD. (it's read only)

Security is a big deal for a PPMID. (you can change things with this)

CADs are easy to authorise, safely, using the smart metering architecture designed by the utilities. The ownership of data and the right of access are set in stone too.

PPMIDs will indeed take ages and need to be carefully vetted.


The smart meter provides lots of data. It isn't feasible (cost effective) to pull this back via the mobile phone network.

It is feasible to pull it back via wired internet using a CAD or PPMID. If Ovo's head end system were capable of ingesting this data and providing an API for others to access and Ovo made this available then I agree this would be grand. Much easier.

Ovo's head end system is not capable of ingesting this data or providing an API for others to access. Half hourly data yes. Real time data no. So we're back to the CAD to access this stuff.


It only matters for gas. For electricity you can easily ignore the "smart" meter and install your own clamp meter with local voltage reference to get *proper* real time data. (see Verv from Green Running etc)

Security + non-issue is an oxymoron. For example just google "ZigBee security vulnerabilities" and start browsing. I don't want to get side-tracked by PPMID discussions. Let's stick the the CAD.

First of all are you sure that you don't care if someone reads your data?

Second, has the supplier formally proven that the Access Device doesn't have some exploitable update back channel? Could this in turn introduce a back channel to attack the smart meter? Even if its "just" a DoS attack on it. STUXnet targetted Iranian SCADA systems controlling Uranium enrichment. What if someone did a similar viral bot to take out CAD linked electricity / gas meters? I am not saying I know hwo to do this, but do I think that someone might find some attack? If the possibility is there, then some goon will find it.

So let's agree to disagree, eh? 🙂

I couldn't give a fudge if a 3rd party accessed the meter data without my consent. It's sat outside the house in the snow accessible from the street. ECV and display.

The CAD is remotely update-able and outside the control of the meter. If there'a vulnerability in the meter via the API for the CAD that's a problem for the meter manufacturer.


Large security risks are:

1) The utility industry for turning a "meter" into a "load control" device. (installing remotely operable disconnection devices inside the meters - a risk that wasn't present previously and isn't necessary)

2) Giving control of these "load control" devices to humans. (high turnover and lightly vetted call centre operatives using machines that aren't well locked down)

3) Meter manufacturers trying to do communications and control. (see: making such schoolboy errors like using the same key on every meter that GCHQ has to intervene)


The bigger security risk is IoT consumer devices. It'll be easier to hack a 500,000 "smart kettles" or "smart toasters" or "smart heating controls" knocked up in a shed in China (see also: IP camera botnets) than it is to hack the "load control" devices in the meters. Turn 'em all on slowly. Flip 'em all off. Flip 'em all on again. That +/-/+ 1 GW swing takes down the grid.

No regulation there. No security checks. A cakewalk in the not too distant future.

EVs are the other one likely to bring down the grid. Big loads that consumers and hackers alike are free to flip on and off in a coordinated manner.

Gas grid won't care. Hard to take that out.

On your first point, yes the energy majors could act in this way, but I am personally more concerned about unknown third parties exploiting some other security vulnerability to do this.

The bigger security risk is IoT consumer devices.
I am one of the core developers for one of the ESP8266 firmware platforms, and I happen to agree with you on that which is why (all except one) of my IoT devices are on an isolated control LAN, run open source firmware and have no direct access to the Internet. The exception is one Chromecast device, but even that has got me doing what my Ma always told me to do: I power off the TV and chromecast at the wall when I am not watching it. I am also thinking of replacing it by one of the OpenSource Linux SBC systems, even though it is only used for watching a couple of hours cloud content a day on a TV.

But now we are totally off topic and time to stop 🙂