TL;DR
India mandated cybersecurity testing for EV Battery Management Systems after Bluetooth apps were used to remotely drain e-rickshaws mid-journey. Delhi's EV policy (effective July 2026) mandates electric-only three-wheelers from January 2027. As connected vehicles become the norm, your car shares more data than ever — but the one thing it still can't do is let a bystander contact you about a parking issue or emergency. That gap is what VahanTag fills.
The Incident That Changed India's EV Cybersecurity Policy
In mid-2026, a string of e-rickshaw breakdowns across Delhi triggered a government investigation. The cause was unexpected: Bluetooth-based mobile applications were being used to remotely interfere with the Battery Management Systems (BMS) of e-rickshaws — in some configurations draining batteries mid-journey without the driver's knowledge.
The government's response was immediate. The Ministry of Road Transport and Highways moved to extend cybersecurity norms to electric two-wheelers and three-wheelers, mandating that BMS security be tested before any new vehicle receives type approval. The rules, previously applied to larger connected commercial vehicles under AIS-189, were expanded to cover the entire EV ecosystem.
The broader implication is significant: India is acknowledging, officially, that vehicles are now networked devices — and networked devices have attack surfaces.
Delhi EV Policy 2026: What Every Three-Wheeler Owner Needs to Know
Delhi's new Electric Vehicles Policy, notified on June 30, 2026 and effective from July 1, brings major transitions:
- From January 2027: Only electric three-wheelers and N1-category light goods vehicles can be newly registered in Delhi
- From April 2028: The mandate extends to new two-wheelers
- EV sales in India crossed 3.27 lakh units in July 2026 alone — up dramatically year-on-year
- Every new EV sold in India is, by design, a connected device — factory-fitted with cellular, Bluetooth, and often Wi-Fi connectivity
For auto-rickshaw drivers, delivery riders, and small fleet owners — this transition from ICE to EV comes bundled with a connectivity layer they may not have explicitly signed up for.
What Your Connected Car Already Shares — And With Whom
Modern EVs and connected ICE vehicles with telematics units continuously generate and transmit data. Here is what flows, and where:
To the OEM (Manufacturer)
- GPS location in real time or at intervals
- Battery state of charge, charging patterns, and degradation (EVs)
- Speed, acceleration, and braking behaviour
- Diagnostic fault codes and service alerts
- Ambient temperature, odometer, and usage patterns
To Insurance Companies (If You've Enrolled)
- Driving behaviour scores — hard braking, late night driving, highway vs. city mix
- Mileage data for usage-based insurance
- Crash event triggers
To Third-Party Service Apps
- Cab aggregators (Ola, Uber, Rapido) access real-time location and trip data
- Fleet management software accesses driver behaviour and route data
- EV charging apps may access battery state and charging history
The Gap That None of This Connectivity Fills
Here is what all this connected vehicle data cannot do:
- It cannot let a bystander who finds your car blocking their exit send you a message
- It cannot let a Good Samaritan at a crash scene alert your family
- It cannot let a security guard tell you your lights are on
- It cannot let someone who found your accidentally unlocked vehicle reach you
Telematics data flows to manufacturers and fleet systems. It does not flow to random bystanders who encounter your vehicle in a parking lot, on a road, or at an accident scene. Those people have no access to your vehicle's digital systems — nor should they.
This is the contactability gap. It exists regardless of how connected your vehicle is. A bystander with a phone camera is the lowest-friction actor at most real-world vehicle incidents — and they have no way to reach you unless your vehicle gives them one.
The Privacy Paradox of Connected Vehicles
India's EV cybersecurity rules reveal an interesting contradiction: the government is working to protect vehicle systems from unauthorized access (the right instinct), while many vehicle owners simultaneously expose their personal phone numbers on their dashboards to every stranger who walks past.
India's DPDP Act treats phone numbers as protected personal data. The EU's GDPR treats vehicle location data as personal data. Vehicle OEMs anonymize telemetry for aggregate analytics. And yet: millions of Indian drivers write their mobile number on a piece of paper and stick it on the dashboard — broadcasting it to every criminal, stalker, and scammer in every parking lot they use.
The connected vehicle era makes privacy-first contactability not just a nice-to-have but an imperative. Your vehicle's digital systems are being secured. Your personal contact information should be treated with the same care.
VahanTag: The Privacy-First Contact Layer for the Connected Vehicle Era
VahanTag is not part of your vehicle's connected systems — it works independently of your vehicle's electronics. This is a feature, not a limitation.
- No OBD port, no app integration, no Bluetooth: A physical QR tag on your vehicle. No attack surface. Cannot be remotely drained, hacked, or disabled.
- Works with any phone camera: No app needed for the scanner. Works independently of your vehicle's connectivity state — dead battery, no cellular signal on the vehicle side, doesn't matter.
- Your number stays private: Bystanders contact you through an anonymous relay. You receive the alert. Your phone number is never exposed.
- SOS works even if your vehicle's systems are offline: A bystander scanning your tag triggers your emergency contacts — independently of whether your EV's telematics are working, whether your phone has signal, or whether you're conscious.
As EVs become the standard in Indian cities — starting with Delhi's three-wheeler mandate in 2027 — every new vehicle will come loaded with connected systems. VahanTag adds the one layer those systems don't: human-readable, bystander-accessible, privacy-first contactability.
For Auto and E-Rickshaw Drivers: What This Means Practically
If you drive an auto-rickshaw or e-rickshaw in Delhi or any other city transitioning to electric three-wheelers, your new vehicle will have a BMS with Bluetooth connectivity — now subject to cybersecurity testing. But it will not have a built-in way to let a passenger in distress, a parking authority, or a bystander contact the driver or owner.
VahanTag Digital E-Tag at ₹299 covers exactly this. Stick it on your auto — front and rear. Anyone can scan and reach you anonymously. If there's an emergency with a passenger, the scan can trigger an SOS alert to your emergency contact with live location.
Your EV is connected. Your contact layer should be private.
Get VahanTag — the bystander-accessible, privacy-first contact layer that works on every vehicle regardless of its electronics. Physical Tag ₹499 or Digital E-Tag ₹299 + GST.