BAT-BMS is a Bluetooth app built to monitor lithium-ion batteries. This week, strangers used it to stop e-rickshaws in the middle of traffic.
Videos of the trick went viral across India, filmed by people who found they could kill a moving rickshaw’s power with a few taps on their phone. India’s Ministry of Electronics and Information Technology has now ordered Google and Apple to pull the app, along with two others, Lossigy and Epoch i-ion, from their stores.
How the app stops a moving vehicle
BAT-BMS was built to monitor lithium-ion batteries, not sabotage them. Made by Shenzhen Grenergy Technology, it reads voltage, temperature, charge cycles and battery health over Bluetooth. It also lets a user switch a battery’s discharge function on or off, a feature meant for maintenance.
That switch is the problem. Many Indian e-rickshaws run on Bluetooth-enabled batteries with no password, or with a factory-default one nobody changed. Anyone within about 10 to 20 metres can connect and flip the switch. The motor loses power instantly. The ignition key does nothing until someone reopens the app and turns the battery back on.
A driver’s ordeal
One e-rickshaw driver told IANS his vehicle died without warning a few days ago. He first suspected a mechanical fault.
“He said someone had switched off the battery using software,” the driver said, recalling what his mechanic told him. The mechanic reconnected the battery through the app for about Rs 300, and the vehicle restarted.
The relief didn’t last. “Someone switched it off again while I was on the road,” the driver said. He was carrying passengers at the time and had no way to trace who did it.
Not every e-rickshaw is exposed
The panic online overstates the risk. BAT-BMS only works on batteries built with a compatible, Bluetooth-enabled BMS. Many e-rickshaws still run on lead-acid batteries, which don’t broadcast over Bluetooth at all. Newer lithium systems with real passwords or proprietary software are also out of reach. Branded electric cars and two-wheelers layer on encryption that keeps the same trick from working.
The vulnerability sits specifically in cheap, unsecured lithium battery packs, the kind fitted to a large share of India’s low-cost e-rickshaw fleet.
Why the batteries were left open
Mukesh Gupta, founder of MaxVolt Energy, said manufacturers add these Bluetooth BMS units mainly to track battery health and usage, especially on financed vehicles. Owners and operators can see temperature and voltage readings, he said, but “there’s no way to shut it down” through the standard operator access — that control was meant to sit with the company alone.
The videos show how easily that boundary broke down once the battery shipped without a password.
Anurag Singh, CEO of RAH Infotech, said the real issue isn’t the app. “The concern is not the app alone,” he said, pointing instead to safety-critical systems going online without enough security planning behind them.
Kunal Bhogal, chief operating officer at IIRIS Consulting, put it more bluntly: an unsecured battery means “a digital flaw turns into a physical safety threat on public roads.”
Government steps in
MeitY’s takedown order covers all three flagged apps while it reviews the cybersecurity risk. The ban stops new downloads, but it doesn’t fix batteries already running unsecured firmware on the road.
Until manufacturers build in password protection by default, drivers with Bluetooth-enabled batteries are being told to set a strong password if their system allows it, and to avoid leaving the battery open to any nearby phone. For now, an unencrypted battery pack remains an open door — and anyone standing close enough can walk through it.
Support Us To Sustain Independent Environmental Journalism In India.
More Ground Reports
He Was Married as a Child, Now Manish Dangi Helps Stop It for Others
Despite The Ban, How Gutkha Became MP’s Most Common Household Habit
