Metering Homes: Do Energy Efficiency and Privacy Need to Be in Conflict?

The European directive on energy efficiency requires that all meters in multi-apartment buildings installed after 25 October 2020 shall be remotely readable devices where technically feasible and cost effective in terms of being proportionate in relation to the potential energy savings. We observed that some manufacturers produce meters that monitor energy consumption in very short intervals, for example, a minute, even though the directive expects to provide billing information to consumers only once a month starting from 2022. This paper reviews privacy and security risks stemming from the high-frequency readouts and provides recommendations for manufacturers and suppliers. The paper focuses on Wireless M-Bus metering devices sold and advertised as a solution to fulfil the directive on energy efficiency requirements. We responsibly disclosed four issues in the metering devices to Common Vulnerability Exposure database; real-world deployments are vulnerable. Many recommendations and observations are also applicable to other protocols or deployments.