Over the last few days, several e-rickshaws across Delhi were brought to an abrupt halt after pranksters allegedly used a Bluetooth-enabled smartphone app to remotely switch off their battery management systems (BMS).
The app was originally designed for battery owners, fleet operators, and service technicians to monitor battery health, diagnose faults, and perform maintenance. However, it was instead used by people who simply connected to nearby battery packs over Bluetooth. They disabled the discharge function, which instantly cut power to the vehicles.
The incidents left drivers stranded in the middle of their trips, disrupted passengers’ rides and raised broader concerns about the cybersecurity of connected electric vehicles.
After the videos went viral, the Ministry of Electronics and Information Technology (MeitY) directed Apple and Google to remove multiple battery management apps, including BAT-BMS, Lossigy and Epoch Li-ion, from their app stores and launched an investigation into the security loopholes that enabled the misuse.
However, the issue doesn’t stem from the app itself but from poor implementation by companies that manufacture or assemble lithium-ion battery packs and configure their BMS.
Why We Shouldn’t Be Surprised
Shishir Dey, an engineering consultant who has worked extensively on automotive protocols and embedded systems, tells AIM that the Chinese apps were designed with a default configuration such that an additional layer of security would be added by battery players in India, which they failed to do in this case.
“These apps provided by Chinese OEMs allow users to connect to compatible BMS over Bluetooth without authentication,” he adds. “The Chinese vendors largely delivered what they promised.”
These OEMs, Dey says, provide documentation on how to configure or secure the interface.
The problem, however, arises when manufacturers simply import BMS modules, assemble battery packs, and sell them without securing the Bluetooth interface.
Thus, if the default configuration is left unchanged, the vendor’s app will work for anyone within the Bluetooth range.
To demonstrate how exposed these systems are, Dey analysed an older version of a battery management app from XiaoXiangElectric to understand how it communicates with compatible batteries over Bluetooth.
He then used Anthropic’s Claude to build a simple program that could talk to the battery in the same way.
“It worked without any special access,” says Dey, adding that the exercise shows the vulnerability stems from unsecured Bluetooth implementations rather than sophisticated hacking.
Unorganised Sector Leads E-Rickshaw Sales
The failure is largely due to Indian resellers and manufacturers who failed to secure the Bluetooth interface before selling the battery packs. The problem compounds given the nature of the country’s e-rickshaw market.
The Council on Energy, Environment and Water (CEEW) noted in a report last year that India’s e-rickshaw market remains largely unorganised, with vehicles often assembled by small manufacturers using components sourced from multiple suppliers.
According to the think tank, this fragmented ecosystem has contributed to inconsistent product quality, weak adherence to standards and limited oversight across the supply chain.
In 2024, Business Standard, citing the Ministry of Road Transport and Highways’ Vahan database, reported that India has 479 electric three-wheeler manufacturers.
Beyond a handful of established brands, however, the sector is dominated by small-scale assemblers, with more than 279 manufacturers having sold fewer than 100 e-rickshaws.
Similarly, a report by JMK Research last year notes that the Electric Vehicle Manufacturers Society (EVMS) estimated around 4.75 lakh electric rickshaws were operating without registration, fitness certification or insurance in mid-2025.
The report argues that this large informal fleet not only poses safety and regulatory challenges but also understates the true size of India’s e-rickshaw market in official registration data.
Connectivity Security Should Not Be an Afterthought
Shrinath Acharya, CEO of Excelfore, a company that provides connectivity solutions for the automotive industry, tells AIM that some embedded automotive products still expose privileged functions. Some teams choose the simplest implementation that works rather than the most secure one appropriate to the threat model.
Acharya says this scenario points to the cost and time pressures that lead to the integration of cheap software and the tendency to treat security as something to add on later.
“Cheap hardware and unsecured software compounded the problem, but the deeper issue was an architecture that did not treat security as a core design requirement from the start.”
Besides, Acharya says another common misconception is that encrypting Bluetooth communications is enough to secure the system.
While encryption protects data exchanged between the battery and the app from interception, it does not verify that the device sending commands is actually authorised to control the battery.
Without proper authentication and access controls, an unauthorised user can still issue legitimate commands over an encrypted connection.
What Next?
In addition to ordering the removals, MeitY asked app stores to exercise greater scrutiny before listing applications that can interact with critical vehicle systems.
Acharya says the responsibility now lies with manufacturers to harden these maintenance interfaces.
“Suggested controls included avoiding publicly discoverable Bluetooth links, using obscure device naming that does not reveal function, requiring mutual certificate- or token-based authentication, and adding protections against replay such as nonces and timestamps,” he adds.
He also emphasises adding physical or contextual gating, for example, allowing privileged wireless commands only when the vehicle is stationary, when the ignition is turned off, or when a physical unlock action or even the use of a hardware key switch.
Similarly, Dey suggests that there are two levels of fixes to the issue. The one that requires less effort is for battery assemblers or manufacturers to work with BMS vendors to enable stronger security.
The harder one, Dey says, is to “Invest in engineering and build a custom hardware/software stack with proper security from the start.”
He compares it to other Bluetooth devices we use in our daily lives. “You can’t install a random app and read someone else’s heart rate from a Fitbit or Apple Watch. Battery management systems should follow a similar security model,” says Dey.
Your reaction
Discussion
What's your take on this story?
No comments yet — be the first to share your view.