A ‘battery management system’ is a small microcontroller inside a lithium-ion pack. It regulates charge and discharge, and in the cheap packs powering most of Delhi’s e-rickshaws, it exposes its settings over Bluetooth as readable and writable.
One of these toggles the switch connecting the battery to the motor. The pack pairs by a method that a Bluetooth specification calls “Just Works,” a connection with no authentication requirement that was chosen because the pack has no keypad for a code and it saves power. It was built to answer any device within a range of about 15 metres and never to ask who is asking.
So, when e-rickshaws across India’s capital began stopping dead last week, and strangers demanded ₹200 (or even a beer once) to restart them, nothing was hacked in the real sense. A legitimate diagnostic application altered an open setting. The fault is not in the code. It is in the specification of an unauthenticated command that happens to cut off traction power.
It is tempting to read this as a rickshaw story, but is better read as a small visible instance of a large invisible fact. Almost every machine that matters today has a controller with a communication channel and whoever commands this channel can command the machine.
Sovereignty over the device has detached from ownership and re-attached to the wire or radio signal that reaches it. Lecturing in Munich in 1919, Max Weber defined ‘the state’ as a community that successfully claims a monopoly over the legitimate use of physical force within a territory. That formulation presumed the state as the strongest actor within its borders.
An embedded controller that obeys an external command relocates a sliver of that force to whoever holds the channel, whether he stands 15 metres away or sits on another continent.
Change the range and the stakes, and the same problem reappears at the scale of, say, a power grid. A solar inverter connects panels and batteries to the grid, and for this, it must speak over the internet with the grid and its maker.
China builds most of the world’s inverters, led by Sungrow and Huawei. In May 2025, engineers stripping down Chinese-made inverters reported undocumented cellular radios able to skirt a utility’s firewall and switch the inverter off from far away.
This is the 15-metre Bluetooth link again, but extended across continental distances. Worryingly, the hand on the switch may belong to a state whose National Intelligence Law of 2017 obliges every organization to assist its intelligence work.
Inverters are not all. A joint report of two United States House committees in September 2024 found unrequested cellular modems on the Shanghai Zhenhua cranes that handle close to 80% of American port traffic.
A US Commerce Department rule of January 2025 will bar—from model year 2027 onwards—any connectivity or self-driving software in passenger vehicles with a Chinese or Russian nexus on the reasoning that a car is now a networked computer on wheels.
Routers, drones, smart meters... the list of vulnerable devices has lengthened, especially since hidden links are rarely flagged on boxes.
Consider e-rickshaws, grids, cranes and cars, and four implications follow.
First, the point of exposure is the supply chain, not the perimeter. The vulnerability is imported, pre-installed and activated later.
Second, range is the only real variable. An unauthenticated Bluetooth link and an undocumented cellular radio are one form of risk: an external command is obeyed by the device without asking its operator, separated only by how far the commander stands.
Third, cheapness is the trap. The supplier who wins on price becomes the single point through which a whole category can fail, so the instinct to buy the cheapest product that works concentrates risk, its effect deferred to the day the machine obeys someone else.
Fourth, the worst exposed are those least able to choose otherwise, while the lever to undo the exposure runs through foreign firms and law.
For India, which imports the bulk of its battery cells, four things follow.
First, secure the interface as part of the standard. Automotive Industry Standard 156, amended from 1 October 2022, requires the battery management system to guard against over-voltage, over-heating and short circuits. It covers hazards of physics but none of intention; the same clause is missing for inverters, meters and cranes.
We must mandate authenticated, encrypted control over anything that can interrupt power supply, prohibit Just Works pairing and require a disclosed bill of materials so that including an undocumented radio would be an offence.
Second, govern the channel, not the shop. Blocking some apps under Section 69A of the Information Technology Act of 2000 only removes web pages, not a protocol.
Third, count concentration risk as a cost. A single dominant supplier results in strategic exposure, regardless of its national flag.
Fourth, enforce a negative list. Ban undisclosed capabilities, not the devices used; and regulate the lock, not the locksmith.
Weber’s definition of a state rested on it being the strongest actor. If the machines that move a city merely need an instruction to go against the city’s interests, then the territory in question goes beyond land. It includes the channel, even if much of it is made elsewhere.
A government can order an application out of a shop and an inverter off a procurement list. It is harder to order a device to forget how to listen.
The author is a public policy professional.