Connected vehicles, systemic risk and national security: The need for India’s automotive cyber resilience framework

By Mohit Anand, Founder & CEO, Mitigata

In July, the government asked Apple and Google to pull seven apps from their stores. The apps let owners of certain electric vehicles monitor their battery packs over Bluetooth, checking charge level, voltage and cycle life. Someone had worked out that the same connection could be used to disable a vehicle’s battery remotely, without the owner knowing. The Ministry of Heavy Industries followed with an advisory to SIAM and the component makers’ body, asking manufacturers to audit their battery management systems, review default configurations and check authentication.

Nobody called it a national security incident, and on its own, it probably wasn’t one. But it is a useful marker for what has actually changed. A decade ago, when a vehicle’s electronics went wrong, it was one car’s problem, nothing more. Today, the same electronics sit behind an app, a cloud backend and a charging network that is also connected to the electricity grid. When something goes wrong, it no longer stays contained to one vehicle. It travels through whichever system connects that vehicle to everything else.

This is where India’s conversation on the subject falls short. We keep discussing connected vehicle security as a consumer protection question: whether a hacker can unlock a car or track its location. That is real, but it is the smaller version of the problem. The larger version is what happens when the same vulnerability sits in a fleet of ten thousand vehicles instead of one, or in the software managing a state transport corporation’s electric buses, or in the firmware running thousands of charging points built by a single vendor and never patched since. At that point, it has shifted from being a car problem alone to an entire transport infrastructure, and infrastructure is where cybersecurity conversations usually turn into national security conversations, whether or not we are ready to have them that way.

This isn’t hypothetical elsewhere. In February this year, a US Senate hearing pushed Waymo to admit that some of the human operators who guide its robotaxis through difficult situations are based in the Philippines, not the US. Senator Ed Markey called it a straightforward safety and cybersecurity question: foreign operators, on foreign networks, quietly influencing how vehicles behave on American roads.

India’s own response is still taking shape, and it is worth being fair about how far it goes. AIS-189 and AIS-190, developed by the Automotive Industry Standards Committee under ARAI, set out what a manufacturer’s cybersecurity management system and software update management system should look like, closely modelled on the UN’s R155 and R156 regulations already enforced in Europe, Japan and South Korea. The Ministry of Road Transport and Highways has proposed making both mandatory through new Rules 125-T and 125-U under the Central Motor Vehicles Rules, with a phased timeline. Vehicles with Level 3 automation or higher come first, from October 2026 for new models and April 2027 for existing ones. Vehicles with over-the-air update capability will follow through 2028. Everything else is expected to comply by October 2029.

That is a reasonable sequence on paper. It gives manufacturers a runway, and it borrows credibility from a global standard rather than inventing one from scratch. But three years is a long time. By one industry estimate, India will have over ten million connected vehicles on its roads by 2028, and the timeline barely touches everything sitting just outside the vehicle itself. A car built to AIS-189 can still be exposed through a charger that was never built to any standard at all, because right now, nothing requires it to be.

There is also a coordination question the framework does not fully answer. MoRTH owns the vehicle standard, and the Ministry of Heavy Industries issues its own advisories on EV and battery security, as the recent episode showed. CERT-In sits above both as the national incident response body, but automotive isn’t yet treated the way banking or telecom are, with defined reporting timelines and a single point of contact. If a fleet operator’s backend were compromised tomorrow, it wouldn’t be obvious which of these bodies should hear about it first, or quickly enough for it to matter.

None of this means India should slow down. It means widening the scope before the current approach becomes permanent. A framework worth the name would give CERT-In a defined role in automotive incident reporting, the way it already has one in finance, and would match the vehicle rollout with an equivalent timeline for charging infrastructure. It would also look closely at the supply chain: much of the software and hardware inside an Indian vehicle comes from outside the country, and a resilience framework that ignores where that code comes from is only solving half the problem.

Insurance is another blind spot worth naming. In the UK, several premium manufacturers sell branded motor insurance through Managing General Agents, yet cover for software-driven failures, a bad over-the-air update, a ransomware-style lockout, often falls outside a standard accident and theft policy. Tesla has taken the opposite approach, running its own insurance so it can price policies off its own driving and safety data, but that only concentrates the risk in one place: if a software flaw hits the whole fleet at once, the losses land on a single balance sheet instead of being spread across many. India’s own motor cyber covers are still new and narrow. Before connected vehicles scale further here, someone needs to settle, in writing, who pays when a software fault or a cyberattack causes the loss, the manufacturer, the software vendor, or the insurer.

India got the sequencing right with data protection and financial regulation, and it’s worth remembering why that discipline mattered. When a bank gets breached, money is at risk, and money can be traced, insured, even recovered. When a vehicle gets breached, a person is at risk, on a road, at speed, with no way to undo what happens next. That is exactly why automotive cybersecurity deserves the same seriousness those sectors got, not less. The rules for this are still being written. Better to get this right now, while there’s still time, than after a breach that hits a whole fleet instead of just one car.