Why the removal of e-rickshaw battery management apps is a wake-up call for smart mobility? Expert answers

India's decision to direct Apple and Google to remove the BAT-BMS smartphone applications from their app stores has thrown the spotlight on a growing cybersecurity challenge within the country's electric mobility ecosystem.

The move followed concerns that the BAT-BMS app could be used to remotely disable certain e-rickshaws equipped with vulnerable battery management systems, after videos circulated online appearing to show users switching off vehicle batteries through a Bluetooth connection. While the takedown targets the applications, cybersecurity experts point that the incident exposes far deeper weaknesses in the connected technologies powering modern electric vehicles.

The incident has renewed questions about how secure battery management systems are as electric vehicles become increasingly reliant on digital technologies for monitoring, diagnostics and remote management.

The bigger problem lies beneath the apps

According to Mandar Patil, Executive Vice President, Cyble, the Ujjain e-rickshaw incident illustrates how the rapid digitisation of transport can introduce new security risks if connected systems are not designed with cybersecurity in mind from the beginning.

More from Tech

"The Ujjain e-rickshaw incident is a clear example of how digital transformation in transportation can unintentionally create serious cybersecurity vulnerabilities when security is not built into connected systems from the outset," Patil said.

Battery management systems, commonly known as BMS, play a crucial role in monitoring battery health, controlling charging and discharging, and communicating with companion mobile applications. Many modern e-rickshaws also connect with GPS modules, fleet management software and cloud platforms that allow owners to track vehicle status remotely.

While these features improve maintenance and operational efficiency, they also create additional entry points for attackers if they are not adequately secured. Weak Bluetooth implementations, exposed application programming interfaces (APIs), outdated firmware and factory-set default passwords can all provide opportunities for unauthorised access.

In the Ujjain case, Patil said the reported attack appeared to exploit unsecured Bluetooth-enabled battery management systems, allowing the battery's discharge function to be disabled remotely. Although the alleged motive appears to have been financial extortion rather than widespread disruption, he believes the incident demonstrates how software vulnerabilities can translate into real-world operational risks.

The episode also reflects a broader shift in cybercrime, where connected devices are increasingly becoming attractive targets as more industries adopt Internet of Things (IoT) technologies.

Smart mobility brings new cyber risks

The episode also underscores how the digital transformation of transport is reshaping cybersecurity priorities.

Connected mobility now extends well beyond vehicles themselves. Charging infrastructure, battery-swapping stations, telematics systems, payment platforms, cloud services and IoT sensors all exchange data continuously to keep electric transport networks running efficiently. That connectivity delivers operational benefits but also broadens the potential attack surface.

Preliminary findings by government officials also indicate that the application connects to supported lithium Battery Management Systems (BMS) via Bluetooth, enabling users to access data such as battery voltage, temperature and overall battery status.

Officials say a significant number of low-cost e-rickshaws in India are equipped with Chinese-made Battery Management Systems that do not incorporate essential security features such as authentication or password protection. In the absence of these safeguards, anyone within Bluetooth range may be able to connect to the battery system and modify certain settings without the owner's knowledge or consent.

A successful compromise could expose location histories, payment information, fleet operations and personal data, explained Patil. In commercial deployments, a single weakness may place hundreds of vehicles connected to the same management platform at risk.

Patil said cybersecurity in transport should increasingly be viewed as part of critical infrastructure protection rather than simply an IT concern.

The warning comes against the backdrop of rising cybercrime across the country. Reports filed through the Ministry of Home Affairs' cybercrime reporting mechanisms have crossed 24.65 lakh, highlighting the growing scale of digital fraud and cyber-enabled crime in India.

As vehicles become more software-driven, experts say cyber resilience must evolve alongside advances in electrification and connectivity.

Building security into connected vehicles

Rather than relying solely on reactive measures such as removing applications after vulnerabilities emerge, specialists argue that manufacturers need to integrate cybersecurity throughout the development lifecycle.

Patil said organisations should adopt a security-by-design approach covering mobile applications, battery management systems, cloud infrastructure and IoT devices.

That includes stronger authentication, encrypted communications, secure APIs and digitally signed firmware to reduce the risk of unauthorised access. Regular vulnerability assessments, penetration testing, continuous network monitoring and secure over-the-air software updates should also become standard practice.

He also advocated a Zero Trust security model, where every user, application and device must be continuously verified before receiving access to critical systems.

“The supply chain remains another area requiring closer scrutiny. Third-party hardware and software incorporated into connected vehicles can introduce vulnerabilities that manufacturers may not immediately detect,” he said.

Beyond technology, Patil said awareness among manufacturers, fleet operators, dealerships and consumers will play an equally important role. Using authorised applications, replacing default passwords with unique credentials, keeping software updated and monitoring systems for unusual activity are among the basic practices that can reduce cyber risks.

As India's electric mobility sector continues to expand, the Ujjain incident serves as a reminder that digital safety is becoming as fundamental to vehicle design as mechanical safety. For connected transport to inspire public confidence, cybersecurity may need to be treated with the same importance as brakes, airbags and other critical safety systems.

In the wake of this case, Delhi Transport Minister Pankaj Singh thanked News18 India for highlighting the BAT BMS app issue, saying the channel brought it to the government's attention at the right time.

Following the Centre's decision to ban the app, he said the Delhi Transport Department would take appropriate action in line with the law. "We have received information that the government has banned the app. The Transport Department will act in accordance with the law," Singh said.