Chinese vehicle control unit poses remote shutdown risk for India's electric buses
Connected EVs can be remotely immobilised or even moved if vehicle control software or its source code is from a neighbouring country, warns Eka Mobility's Sudhir Mehta.
- Jul 21, 2026,
- Updated Jul 21, 2026 3:29 PM IST
Days after the government issued an urgent advisory to India’s automobile industry on critical vulnerabilities in electric vehicles following viral videos of e-rickshaws grinding to a halt on Indian streets with misuse of Chinese apps, Sudhir Mehta, the chairman and managing director of Pune-based e-bus maker Eka Mobility, has warned that electric buses that rely on China for vehicle control units remain vulnerable to remote shutdown risks.
"Vehicle control software fundamentally has to be sovereign. We need control of that software residing in India,” Mehta tells Business Today in an interview.
In the era of connected vehicles, EVs come with a vehicle control unit (VCU) that governs critical functions such as battery management, motor control, power electronics, vehicle movement and over-the-air software updates. “One who controls the VCU can immobilise the vehicle and also make the vehicle move on its own,” cautions Mehta.
MUST READ | BT Explainer: How EV kill switch BAT-BMS app works and how to prevent misuse
The recent government advisory on critical vulnerabilities in EVs has raised alarm bells in the industry. BAT-BMS, an app developed by China’s Shenzhen Grenergy Technology, was used to unexpectedly shut down moving e-rickshaws in India.
Several electric bus makers in India have partnered with Chinese companies for critical technologies. Hyderabad-based Olectra Greentech has a technology tie-up with China’s BYD. Besides battery cells and packs, Olectra imports battery management systems (BMS) and some components of motors from China. Similarly, Gurugram-based PMI Electro has a technical collaboration with China’s Beiqi Foton Motor Co. KKR-backed PMI Electro bagged the biggest order of 5,210 electric buses under the Rs 10,900 crore PM E-Drive scheme.
Queries sent to Olectra Greentech and PMI Electro on localisation of critical components remained unanswered. While Eka Mobility also sources battery cells from China, Mehta says that his company has “invested significantly” with a clear focus on owning and controlling its vehicle control software. Eka Mobility has also secured an order to deliver around 3,500 e-buses under the government’s electric vehicle adoption scheme.
India's rapidly growing fleet of electric buses could remain vulnerable if the underlying vehicle control software is developed and controlled outside the country.
DON'T MISS | Can Chinese apps like BAT-BMS remotely disable Your EV? What vehicle owners should know
If the vehicle control software originates outside India and automakers do not possess the source code, they become dependent on external entities for software modifications and troubleshooting, says Mehta. “In a worst-case scenario, a compromised vehicle could even be remotely controlled, creating significant safety and security risks,” he warns.
National security implications
Mehta's concerns extend beyond cybersecurity to national security.
He warned that connected vehicles continuously generate operational data, including location, movement and usage patterns. Public transport vehicles such as electric buses often transmit additional information, including camera feeds and operational data, making software security even more critical.
“In public transport, additional safety-related information, such as camera data, is also transmitted to government authorities where required. Protecting this information is essential,” says Mehta, adding that the industry should work towards developing indigenous vehicle control software within India.
MUTS READ | Why e-rickshaws are suddenly stopping on the road? The Chinese BAT-BMS app behind it
To safeguard India’s electric vehicle ecosystem from cyber threats, the government, in its recent advisory, told the industry to take immediate steps. It urged automakers to audit their battery communication interfaces, eliminate unsecured default settings, weak authentication, and unprotected over-the-air pathways.
As India targets large-scale electrification of public transport through government subsidies, Mehta argues that securing the digital brains of electric vehicles may prove just as important as selling the vehicles themselves.
“If OEMs do not have complete ownership and control of this software, it raises serious concerns around cybersecurity, vehicle safety, and operational control,” warns Mehta.
Days after the government issued an urgent advisory to India’s automobile industry on critical vulnerabilities in electric vehicles following viral videos of e-rickshaws grinding to a halt on Indian streets with misuse of Chinese apps, Sudhir Mehta, the chairman and managing director of Pune-based e-bus maker Eka Mobility, has warned that electric buses that rely on China for vehicle control units remain vulnerable to remote shutdown risks.
"Vehicle control software fundamentally has to be sovereign. We need control of that software residing in India,” Mehta tells Business Today in an interview.
In the era of connected vehicles, EVs come with a vehicle control unit (VCU) that governs critical functions such as battery management, motor control, power electronics, vehicle movement and over-the-air software updates. “One who controls the VCU can immobilise the vehicle and also make the vehicle move on its own,” cautions Mehta.
MUST READ | BT Explainer: How EV kill switch BAT-BMS app works and how to prevent misuse
The recent government advisory on critical vulnerabilities in EVs has raised alarm bells in the industry. BAT-BMS, an app developed by China’s Shenzhen Grenergy Technology, was used to unexpectedly shut down moving e-rickshaws in India.
Several electric bus makers in India have partnered with Chinese companies for critical technologies. Hyderabad-based Olectra Greentech has a technology tie-up with China’s BYD. Besides battery cells and packs, Olectra imports battery management systems (BMS) and some components of motors from China. Similarly, Gurugram-based PMI Electro has a technical collaboration with China’s Beiqi Foton Motor Co. KKR-backed PMI Electro bagged the biggest order of 5,210 electric buses under the Rs 10,900 crore PM E-Drive scheme.
Queries sent to Olectra Greentech and PMI Electro on localisation of critical components remained unanswered. While Eka Mobility also sources battery cells from China, Mehta says that his company has “invested significantly” with a clear focus on owning and controlling its vehicle control software. Eka Mobility has also secured an order to deliver around 3,500 e-buses under the government’s electric vehicle adoption scheme.
India's rapidly growing fleet of electric buses could remain vulnerable if the underlying vehicle control software is developed and controlled outside the country.
DON'T MISS | Can Chinese apps like BAT-BMS remotely disable Your EV? What vehicle owners should know
If the vehicle control software originates outside India and automakers do not possess the source code, they become dependent on external entities for software modifications and troubleshooting, says Mehta. “In a worst-case scenario, a compromised vehicle could even be remotely controlled, creating significant safety and security risks,” he warns.
National security implications
Mehta's concerns extend beyond cybersecurity to national security.
He warned that connected vehicles continuously generate operational data, including location, movement and usage patterns. Public transport vehicles such as electric buses often transmit additional information, including camera feeds and operational data, making software security even more critical.
“In public transport, additional safety-related information, such as camera data, is also transmitted to government authorities where required. Protecting this information is essential,” says Mehta, adding that the industry should work towards developing indigenous vehicle control software within India.
MUTS READ | Why e-rickshaws are suddenly stopping on the road? The Chinese BAT-BMS app behind it
To safeguard India’s electric vehicle ecosystem from cyber threats, the government, in its recent advisory, told the industry to take immediate steps. It urged automakers to audit their battery communication interfaces, eliminate unsecured default settings, weak authentication, and unprotected over-the-air pathways.
As India targets large-scale electrification of public transport through government subsidies, Mehta argues that securing the digital brains of electric vehicles may prove just as important as selling the vehicles themselves.
“If OEMs do not have complete ownership and control of this software, it raises serious concerns around cybersecurity, vehicle safety, and operational control,” warns Mehta.