politics · 2026-07-04
India Bans Apps That Shut Off E-Rickshaws
0d3dd262-3895-4b3f-b689-d03ead8d6a91
MeitY removed two apps from stores that were used to remotely disable e-rickshaws mid-journey, causing stoppages across cities.Remotely disabling vehicles is a criminal offense under IT Act sections 43 and 66, punishable by 3 years in prison and ₹5L fine.E-rickshaw drivers who rent vehicles and depend on daily earnings face income loss, while passengers face safety risks from sudden mid-road shutdowns.
How did these apps disable e-rickshaws?
E-rickshaws run on digital controllers with Bluetooth or wireless modules. The two apps exploited these communication channels to send shutdown commands remotely, without the owner's consent. Pranksters filmed themselves switching off vehicles mid-ride. MeitY Secretary S Krishnan confirmed both apps were pulled from app stores within a day of discovery.
What wireless protocol did the apps exploit?
Most budget e-rickshaws use generic Bluetooth Low Energy modules to communicate with motor controllers. These modules often ship with default pairing codes like 0000 or 1234. The apps likely scanned for these open BLE signals and sent standard shutdown commands. Premium EVs like Ather 450X use encrypted, proprietary protocols that block such access.
Were these apps listed as tools or as pranks?
Reports suggest the apps were listed as entertainment or prank tools, not explicitly as vehicle-disabling software. This is why app store review processes missed them. MeitY has now asked Google and Apple to tighten checks for apps that interact with vehicle hardware, similar to how stores already flag apps accessing health data.
Did manufacturers know about this weakness?
Several low-cost e-rickshaw makers use off-the-shelf controllers from Chinese suppliers like Kelly or Sabvoton. These controllers prioritize cost over security, shipping without encryption. Larger EV makers like Tata and Bajaj use proprietary systems. The gap highlights a two-tier EV market where budget vehicles lack basic cybersecurity standards.
Could this happen to other electric vehicles?
The vulnerability exists because many e-rickshaws use generic, unsecured controller boards with open wireless protocols. Similar boards appear in e-scooters and e-bikes from brands like Ather and Ola. Without encrypted communication between apps and motor controllers, any connected EV could theoretically face remote interference, making this a sector-wide firmware security gap.
Does the IT Act cover vehicle cyber attacks?
Section 43 of the IT Act covers unauthorized access to any computer system. Since e-rickshaw controllers qualify as computer systems, remote shutdown is illegal. Cyber law expert Pawan Duggal confirmed this carries 3 years imprisonment and ₹5L fine. However, enforcement is difficult because perpetrators are often anonymous social media pranksters.
How would encrypted controllers change costs?
Adding encrypted BLE or proprietary wireless modules costs roughly ₹500-800 per unit. For an e-rickshaw costing ₹1.5-2L, that is under 0.5% of total price. But manufacturers compete fiercely on cost, and even ₹500 matters in a price-sensitive segment. A govt mandate, similar to AIS-140 GPS standards for commercial vehicles, could force adoption.
What stops copycat apps from appearing?
App stores use automated review plus manual spot checks. Determined developers can disguise vehicle-control apps as flashlight or utility tools, bypassing keyword filters. MeitY's ask for tighter checks mirrors India's approach to loan-shark apps, where Google removed over 2K predatory lending apps in 2023 after govt pressure. Continuous monitoring, not one-time removal, is needed.
Who bears the cost when a driver's day is lost?
Drivers who rent e-rickshaws typically pay ₹300-500/day in rental fees regardless of earnings. One viral video showed a driver stranded for hours, unable to earn. He still owed that day's rent. The vehicle owner also loses, since repeated shutdowns can damage battery management systems. Neither party has insurance covering cyber-induced downtime.
Who rents e-rickshaws and at what daily cost?
Most e-rickshaw drivers are migrant workers or daily-wage earners who cannot afford the ₹1.5-2L purchase price. Fleet operators in cities like Delhi and Lucknow rent vehicles at ₹300-500/day. Drivers typically earn ₹600-800/day, leaving thin margins. A single day of downtime can wipe out a week's savings.
Are passengers covered if injured mid-ride?
E-rickshaws in most states operate in a regulatory grey zone. Unlike registered autos, many lack commercial insurance. If a sudden app-triggered shutdown causes an accident, passengers have limited legal recourse. Delhi's Motor Vehicle Department requires third-party insurance, but enforcement is weak. Only about 3 in 10 e-rickshaws in Delhi carry valid policies.
Could drivers collectively push for safer tech?
E-rickshaw driver unions exist in cities like Patna and Kolkata, but they focus on route permits and police harassment, not vehicle tech standards. A collective demand for encrypted controllers would require coordination with manufacturers. The All India E-Rickshaw and E-Cart Association has flagged the issue but lacks leverage to mandate hardware changes without govt backing.
Source: livemint.com