India's EV Policy Push Exposes Critical Cybersecurity Gaps in Charging Infrastructure

A silent race is underway across India. From the national capital's draft EV Policy 2026-30 to Telangana's mandates for charging infrastructure in apartment complexes, state governments are competing to electrify their transportation sectors. Concurrently, at diplomatic outposts like the Consulate General in Shanghai, Indian officials are engaging with international business leaders, including the Chair of the US Chamber Auto Committee, to align strategies and attract investment. The momentum is undeniable, but a dangerous blind spot threatens to undermine this entire green transition: the pervasive lack of cybersecurity considerations for the emerging EV ecosystem.

The Policy Push: Ambition Overlooks Security

The draft Delhi EV Policy 2026-30 exemplifies the trend. It sets aggressive targets for electrification, focusing on subsidies, manufacturing incentives, and the rapid deployment of public and private charging stations. Similarly, in Telangana, authorities are reviewing policies to mandate EV charging infrastructure in residential buildings, aiming to remove a key barrier to consumer adoption. These are necessary steps for adoption, but they treat charging points as simple electrical outlets rather than the complex, networked cyber-physical systems they are.

Each public charging station is a potential ingress point. It typically consists of an Industrial Control System (ICS) or IoT device managing high-power electrical flow, a payment processing system, and a network connection for remote monitoring and management. This convergence of Operational Technology (OT), Internet of Things (IoT), and financial transaction systems creates a multi-layered attack surface. Yet, policy documents analyzed show no mention of mandatory security certifications, secure software development lifecycles for charging management systems, or protocols for secure grid communication.

The Cybersecurity Infrastructure Gap: A Tangible Threat

The risks are not theoretical. An insecure EV charging network presents several clear and present dangers:

1. Grid Disruption and Destabilization: Charging stations, especially high-power DC fast chargers, represent significant, controllable loads on the electrical grid. A coordinated cyber-attack could command thousands of chargers to simultaneously draw maximum power or switch on and off erratically. This could cause localized blackouts, frequency instability, and damage grid infrastructure, turning a climate solution into a tool for sabotage.

1. Data Integrity and Privacy Breaches: EVs and their charging sessions generate sensitive data: vehicle identification, location patterns, charging habits, and payment information. This data ecosystem is a goldmine for espionage, profiling, and fraud. Insecure data transmission between the vehicle, charger, and backend cloud servers could lead to massive privacy violations.

1. Physical Safety and Ransomware: Attackers could potentially manipulate charging parameters to cause battery damage or, in extreme cases, create fire hazards. More likely is the proliferation of ransomware targeting charging network operators, locking citizens out of essential infrastructure and demanding payment to restore service—a direct attack on public mobility.

1. Supply Chain Compromise: The international discussions highlighted in Shanghai underscore the global nature of the EV supply chain. Charging station hardware and software components are sourced worldwide. Without robust supply chain security mandates, adversaries could implant vulnerabilities at the manufacturing stage, creating a backdoor into critical national infrastructure.

Bridging the Gap: A Call for 'Secure-by-Design' Policy

The current policy trajectory, focused solely on quantitative deployment, is building a digital house on sand. The cybersecurity community must advocate for the integration of security into the foundation of EV policy 2.0. This requires:

• Mandatory Security Standards: Policies must reference and enforce existing frameworks like ISO/SAE 21434 (road vehicles cybersecurity) and IEC 62443 (OT security) for charging infrastructure. New, sector-specific standards are urgently needed.
• Certification and Auditing: A national certification regime for charging equipment and backend management software should be established, requiring independent security audits before deployment.
• Incident Response Mandates: EV infrastructure operators must be legally required to have cybersecurity incident response plans and participate in sector-specific Information Sharing and Analysis Centers (ISACs).
• Secure Grid Integration Protocols: Grid operators and charging network managers must collaborate to define and implement secure communication protocols (e.g., using the Open Charge Point Protocol - OCPP with mandatory TLS encryption and certificate pinning) that prevent unauthorized control signals.

The dialogue in Shanghai shows India is thinking globally about EV policy. It is now imperative to think securely. The race to electrify must not be a race to the bottom on cybersecurity. Policymakers must pivot from viewing cybersecurity as a technical afterthought to recognizing it as a non-negotiable pillar of resilient national infrastructure. The alternative is a future where the very systems built to ensure energy independence and environmental health become our most vulnerable points of failure.