The government's decision to block multiple battery management system (BMS) applications allegedly misused to remotely interfere with the operation of certain electric vehicles has also drawn attention to the origin of the software ecosystem powering parts of India's low-cost EV segment.
Publicly available developer information reviewed by Autocar Professional shows that three of the four battery management applications publicly identified so far are linked to developers based in China. BAT-BMS is developed by Shenzhen Grenergy Technology Co. Ltd., Lossigy by Shenzhen LOSSIGY Lithium Energy Technology Co. Ltd., while SMART BMS is also associated with a Chinese developer. The fourth application, Epoch Li-ion, is currently published by US-based EDG Sales International LLC.
The findings come after the Ministry of Electronics and Information Technology (MeitY) directed app stores to remove several battery management applications following concerns that they were allegedly being misused to remotely interfere with the functioning of certain electric vehicles. Authorities are also examining whether additional safeguards are required to prevent similar incidents.
Autocar Professional was the first publication to report on the misuse of such battery management applications against electric rickshaws and low-speed electric two-wheelers, highlighting how they could be used to remotely disrupt vehicles while they were plying on public roads. The publication had deliberately withheld the names of the applications at the time to avoid facilitating misuse.
Industry experts note that battery management applications are commonly supplied alongside Bluetooth-enabled battery management systems, allowing users to monitor battery health, charging status, and other operating parameters. However, where such systems lack adequate authentication or continue to rely on default credentials, they may become vulnerable to unauthorised access.
Beyond the nationality of individual applications, the episode has highlighted India's dependence on imported battery management hardware and software across parts of the affordable EV ecosystem. As vehicles become increasingly software-defined, cybersecurity risks can emerge not only from vehicle manufacturers but also from components, battery suppliers, and associated mobile applications.
The latest action also comes barely a week after India proposed mandatory cybersecurity and software update management requirements for connected vehicles through draft amendments to the Central Motor Vehicles Rules. The proposed framework would require manufacturers to establish Cyber Security Management Systems (CSMS) and Software Update Management Systems (SUMS), signalling that cybersecurity is becoming an integral part of vehicle safety and regulatory compliance.
Taken together, the government's action and the proposed regulatory framework indicate that cybersecurity is rapidly emerging as a mainstream automotive policy issue in India. As connected and software-defined vehicles become more prevalent, the industry is expected to place greater emphasis on secure software architecture, stronger authentication mechanisms, and lifecycle cybersecurity management to protect vehicles from unauthorised digital access.