India’s lithium shift rolls into a stalled e-rickshaw lot: what the cybersecurity warning actually says

The Indian Express published a cybersecurity warning on 16 July 2026 that cuts against the official line on the country’s electric-mobility push: the lithium-ion battery packs now standard in Indian e-rickshaws and electric two-wheelers are, by default, network-connected devices, and the protocols that govern them were not designed with adversarial use in mind. The piece, carried by the newspaper’s Telegram channel at 08:52 UTC, lands at an awkward moment for a sector that has spent two years promising both a manufacturing boom and a clean-air dividend.

The practical stakes sit in a parking lot, not a server room. Thousands of e-rickshaws in Indian cities sit idle because operators cannot make the financing work, batteries and vehicles cannot be serviced on the promised schedules, and depot charging has not been built out to match the fleet on the road. A fleet that was meant to be the cheapest, cleanest rung of urban mobility is, for many drivers, simply not moving. The cybersecurity warning adds a layer that the policy discussion has not yet absorbed: every idle battery is, in principle, a node on a network, and most operators have no idea what that network is doing.

What the warning actually says

The Express piece is careful with its claims. It does not allege a specific breach or a state actor. What it does is itemise the defaults: telemetry modules that broadcast battery state-of-charge, cell voltage, and GPS location to manufacturer servers; firmware update channels that, in several models on the Indian market, are unsigned or signed only by the vendor; and remote-disable functionality that operators have, in some cases, activated without the driver’s knowledge when financing terms slip. None of this is exotic. It is the standard architecture of a connected battery.

The warning matters because Indian policy has, until now, treated the e-rickshaw fleet as a mechanical and electrical question, not a software one. Battery standards, swappable-form-factor rules, and the Production-Linked Incentive scheme for advanced chemistry cells all proceed from the assumption that the hardware is the product. The Express piece effectively asks: what happens to that assumption when the hardware is, increasingly, a peripheral?

The counter-narrative from the industry

Indian manufacturers have a ready answer, and it is not unreasonable. Connected batteries let them monitor cell health, push over-the-air fixes for early-life defects, and disable packs that have been re-sold into grey markets after write-offs. Operators, the argument runs, benefit from the same telemetry: warranty service that anticipates failure rather than waiting for a breakdown in the middle of a shift. The Ministry of Heavy Industries, which oversees the Faster Adoption and Manufacturing of Electric Vehicles (FAME) framework and its successors, has so far treated telematics as a feature, not a vulnerability.

There is also a candid structural defence: India is not the only market where this architecture is standard, and comparable warnings have surfaced in Europe and the United States without halting the transition. Chinese battery makers, who supply a substantial share of the cells used in Indian assembled packs, run similar connected platforms at far larger scale. The implicit argument is that India should not invent a uniquely restrictive regime that slows its own deployment in pursuit of a threat whose probability has not been demonstrated.

Why the warning still lands

The Express piece is not asking for a rollback. It is asking for the obvious: a domestic cybersecurity standard for connected battery management systems, mandatory disclosure of what data the pack transmits and to whom, and an operator-facing kill switch on remote-disable functions during financing disputes. Each of these is the kind of regulatory plumbing that an industry accustomed to moving faster than the rulebook has, predictably, not built for itself.

The timing matters. India’s electric two- and three-wheeler segment is no longer a pilot. Tens of thousands of vehicles are on the road, financed by a mix of bank credit, non-banking finance companies, and informal arrangements. The fleet is also the segment of the EV market where the per-unit cost is lowest and the operator’s margin thinnest, which is to say the segment where a single well-publicised remote-disable event, or a single leak of route data from a depot, would do the most political damage to the broader transition. The warning is, in effect, an attempt to get ahead of that damage.

What to watch next

Two dates will shape whether this becomes a story or a footnote. The first is the next meeting of the Bureau of Indian Standards committee on secondary lithium cells for automotive applications, which has been sitting on a draft that touches exactly this architecture; a publication date has not been announced. The second is the Bharat Mobility Expo in early 2027, by which point the country’s first commercial hydrogen train, run by Indian Railways as part of its 173-year push to modernise rolling stock, will be visible enough to set the public benchmark for what "clean, Indian-built, and Indian-run" is supposed to look like in practice. The hydrogen programme, flagged by the Express in a separate 16 July piece on Indian Railways’ anniversary, is being held up as proof that the country can run a corridor on its own standards. The battery question is whether the standards arrive before the fleet does.

One thing the sources do not settle: how many of India’s idle e-rickshaws are idle because of software locks, and how many because of plain old debt and a charging network that has not kept up. The Express warning raises the first possibility; operators on the ground, in the same paper’s reporting, point to the second. Both can be true at once, and a serious policy response will have to address both.

Desk note: Monexus read this as a policy gap story, not a scare story. The Express is doing the unglamorous work of asking what a connected fleet means for a regulator that has, until now, been regulating batteries as objects rather than as endpoints.

Wire provenance

This editorial synthesis draws on the following public wire/social posts:

• https://en.wikipedia.org/wiki/E-rickshaw