Bhopal: Mohd Altaf, an e-rickshaw driver in Bhopal, was left shocked when his brand-new vehicle just went dead in the middle of the street on Friday. Losing fare from passengers was just one part; he had to drag the dead vehicle several metres away to let the traffic move smoothly.This is not an isolated incident. E-rickshaw drivers across the country have reported their vehicles suddenly shutting down — at times with passengers aboard in the middle of busy traffic – in the past few days. The drivers suspect the shutdowns are being triggered remotely via Bluetooth.It has now emerged that a smartphone application meant to monitor lithium-ion batteries is allegedly being misused to remotely disable some EVs, and the first known case in Madhya Pradesh has surfaced in Ujjain, where an 18-year-old, Ritesh Bhanupa, a resident of Bhairavgarh, was arrested on Thursday for allegedly locking e-rickshaw batteries and charging drivers Rs 200-300 to get them moving again.The incident has put the spotlight on a little-known security loophole in some Bluetooth-enabled battery management systems (BMS) used in electric vehicles.The accused used the BAT-BMS mobile application to remotely lock the batteries of e-rickshaws while they were on the move. Drivers, unaware of what had caused their vehicles to suddenly stop, were then approached by the accused, who allegedly offered to “repair” and restart them in exchange for Rs 200-300.
Investigators said he learnt the technique through YouTube tutorials and downloaded the application from an app store before targeting drivers.Cyber experts say the issue appears to have begun as a prank, with people experimenting to see whether they could connect to nearby batteries. Once it became clear that the applications could be misused, the technique spread rapidly.Bhopal regional transport officer Jitendra Sharma said e‑rickshaw drivers have been instructed to contact their battery dealers.
He urged drivers to ensure, with their vendors, that batteries cannot be accessed via Bluetooth, and added that authorities are keeping a close watch on the situation.Cybersecurity expert Ritesh Bhatia said the incident is not merely about one mobile application or a handful of e-rickshaws but exposes a broader weakness in the way connected devices are being designed.Bhatia said that while some battery management applications have now introduced password protection following the controversy, the response came after the vulnerability had already become widely known.Even if specific applications are removed from app stores, installation files can continue to circulate through third-party websites and messaging platforms. He also cautioned that BAT-BMS is only one of several battery management applications available in the market, raising questions about whether similar vulnerabilities exist in software used by other manufacturers.He said manufacturers must treat cybersecurity as a core design requirement rather than an afterthought.The incidents, he added, should prompt regulators, including the Indian Computer Emergency Response Team (CERT-In) and the Ministry of Electronics and Information Technology (MeitY), to examine whether connected devices are being subjected to adequate cybersecurity standards and security audits before reaching consumers.