Centre orders removal of BAT-BMS apps amid probe into e-rickshaw shutdown claims

The Centre has directed Apple and Google to remove two smartphone applications from their respective app stores after concerns emerged that one of them could be used to remotely disable certain e-rickshaws fitted with vulnerable battery management systems.

The move follows growing scrutiny over the BAT-BMS application after videos circulating online appeared to show users switching off the battery output of parked and moving e-rickshaws through a Bluetooth connection. The incident has triggered questions about the security of connected electric vehicle components and the safeguards built into battery management software.

Speaking on the sidelines of a Confederation of Indian Industry (CII) Cybersecurity Summit on Friday, IT Secretary S Krishnan confirmed that action had been taken once the applications came to the government's attention.

"That is right...there are a couple of apps, which came to our notice yesterday and both of them have been taken down from the app stores," Krishnan said, according to PTI.

More from Tech

Government widens scrutiny over app store approvals

Krishnan said the latest development also highlighted the need for stronger checks before applications are made available through digital marketplaces. He indicated that the government would engage with app store operators to ensure greater scrutiny of software that could pose security risks or be misused.

Authorities have not alleged that the application itself was created for malicious purposes. Instead, officials are examining whether its features were exploited because of weak security protections in some battery management systems used in low-cost electric vehicles.

The Delhi government has also begun looking into the matter. Transport Minister Pankaj Singh has directed the transport department to verify claims surrounding the BAT-BMS application after complaints surfaced, even though no formal written complaint had been filed.

The investigation is expected to determine whether the reported incidents stemmed from flaws in battery hardware, software design or a combination of both.

Focus shifts to vulnerable battery systems

According to preliminary assessments by government officials, the application communicates with compatible lithium battery management systems over Bluetooth, allowing users to monitor information such as battery voltage, temperature and overall health.

Officials believe that many inexpensive e-rickshaws operating in India use Chinese-made Battery Management Systems that lack basic security measures, including password protection or user authentication. Where those protections are absent, nearby individuals may be able to connect to the battery and alter certain settings without the owner's permission.

BAT-BMS was developed by Shenzhen Grenergy Technology in Shenzhen, China, as a battery monitoring and management tool for compatible lithium battery packs. While such applications are commonly used for diagnostics and maintenance, investigators suspect that one of its remote control functions may have been misused against unsecured vehicles.

Videos shared widely on social media appeared to demonstrate users disabling the battery's discharge function, leaving some e-rickshaws unable to move. Some drivers reportedly claimed they had to seek outside assistance and, in certain cases, pay individuals to restore their vehicles after they had been targeted.

The episode has drawn attention to a broader cybersecurity challenge facing connected mobility devices, particularly as electric vehicles become increasingly dependent on wireless communication between smartphones and onboard systems.

Although the BAT-BMS applications have now been removed from both the Google Play Store and Apple's App Store, the government said the matter remains under investigation as authorities continue to assess the potential risks and monitor developments.