What is BAT-BMS, the Chinese app being used to stop e-rickshaws remotely?

A little-known smartphone application meant for monitoring lithium batteries has come under scrutiny after viral social media videos showed people allegedly using it to remotely disable e-rickshaws, triggering safety concerns and panic among drivers who depend on the vehicles for their livelihood.

What is the BAT-BMS app?

The app, BAT-BMS, is a legitimate battery management application developed by China's Shenzhen Grenergy Technology for Bluetooth-enabled lithium battery packs.

It is designed to help users monitor battery health, voltage, temperature, charging and discharging status, state of charge, cycle life and other parameters without requiring a separate battery monitor.

According to its description on the Google Play Store, the application is intended only for "Smart Bluetooth lithium battery" systems and allows users to wirelessly connect to compatible batteries within an operating distance of up to 15 metres. It also enables users to switch between multiple connected batteries from a single phone.

However, the app has become the centre of controversy after videos surfaced online showing teenagers and young adults allegedly connecting to nearby e-rickshaw batteries via Bluetooth and switching them off while the vehicles were moving or waiting in traffic.

Several viral clips show stranded drivers struggling to restart their vehicles, with some pushing them for long distances after being unable to identify the cause of the sudden shutdown.

Social media users have alleged that many low-cost lithium battery packs used in e-rickshaws are equipped with Bluetooth-enabled Battery Management Systems (BMS) that lack password protection or authentication, allowing anyone within Bluetooth range to access battery controls through compatible applications.

Since several inexpensive lithium batteries do not have password protection, people can connect to them from within about 15 metres and remotely switch off the battery, posing a potential road safety risk if an e-rickshaw stops abruptly in traffic.

{{X: 2072759362612088940}}

{{X: 2072589231806157240}}

An influencer, Amaan Siddiqui, posted a video in which he claimed to have demonstrated how the app could reconnect with a stranded e-rickshaw.

Speaking to ANI, Siddiqui said he noticed a driver towing his disabled e-rickshaw with another vehicle and suspected the battery management app was responsible.

"I asked him to stop and told him that his rickshaw would now restart. He broke down and told me that he had lost an entire day of earning. He had taken the rickshaw on rent. I got emotional too. His rickshaw had been at the same spot for an entire day. What is being done by people is wrong," he said.

Is remotely accessing e-rickshaw's battery illegal?

The controversy has also raised cybersecurity concerns.

Cyber law expert Pawan Duggal told ANI that unauthorised access to an e-rickshaw's battery management system could amount to an offence under Sections 43 and 66 of the Information Technology Act, 2000.

"Today an e-rickshaw is not just an e-rickshaw; it is a computer system. This is not a game. Entering into the computer system of an e-rickshaw without the consent or knowledge of the owner is punishable with imprisonment and fine," Duggal said.

Are all e-rickshaws vulnerable to this issue?

Industry experts say the problem does not affect all e-rickshaws.

The vulnerability is understood to be limited to certain Bluetooth-enabled lithium battery packs whose Battery Management Systems do not require authentication before allowing remote access.

Older lead-acid battery-powered e-rickshaws do not have Bluetooth capability, while several lithium battery manufacturers use proprietary software that is incompatible with third-party applications such as BAT-BMS.

The app itself is not malicious and was developed as a battery management tool for authorised users.

Sandeep K. Shukla, director of the International Institute of Information Technology, Hyderabad, that connectivity features can be exploited if authentication is not implemented correctly, reported Hindustan Times.

“Legal and regulatory vacuum and a lack of guardrails vis-à-vis cybersecurity and consumer protection is a problem,” Shukla said, adding: “It’s not only a Chinese import problem. Any consumer device coming into the country, if not regulated for security, could have such issues.

What has the government said?

Following the viral videos, Delhi Transport Minister Pankaj Singh said the department has been asked to verify the issue and examine the claims after concerns were brought to his notice.

"We are aware of the matter on social media and the government is looking into it. I believe police will also take action on their own about this, as it is illegal to do so," Singh told PTI Videos.

BAT-BMS app appears to have been removed from Apple’s App Store, but it remains available on Google Play.