How easy is it to hack an e-bike?
Attempts to control London's rental e-bikes are apparently being thwarted by hackers
Morning — now we’re definitely, definitely, definitely not recommending you look them up, but TikTok recently blew up with videos that claim to show how London’s rental e-bikes can be hacked. And that’s really annoying councils trying to keep things under control. We explore the world of e-bike hacking after your Sunday briefing below.
Plus: the Met’s reckoning with its toxic cops continues, while Lambeth council faces a damning report over its handling of social housing.
By the way: we’ve seen some crazy subscriber growth over the past week — welcome to all of you! If you enjoy today’s issue, please consider sharing us with other Londoners who want news about their city in their inbox, using the button below.
What we’ve spied
📱 Two Met officers have been sacked over “discriminatory and offensive” WhatsApp messages, including some that made fun of Katie Price’s disabled son Harvey. The serving officers were found guilty of gross misconduct on Friday for their messages, shared in a group called “Secret Squirrel S**t” between May 2016 and June 2018.
🍸 A Canary Wharf bar that served underage girls has just about kept its licence. Police submitted a licence review for the Cocktail Club in Cabot Square after an incident in December, in which a group of girls were allowed to drink in the venue for six hours, with one eventually vomiting. Tower Hamlets council has now voted to let the bar keep its licence subject to certain conditions.
👶 Londoners faced a ‘postcode lottery’ when it came to maternity care during the pandemic, a report has found. The London Assembly’s health committee says there are lessons to be learned about the big disparities between the city’s NHS trusts and their enforcement of Covid restrictions on maternity wards.
🤖 Plans to put AI-generated art on a wall near Piccadilly Circus have come under fire. Developer Land Securities wants to spend £2m on metal artwork representing a leaf blowing in the wind that was created by artificial intelligence on the busy central street, but the Soho Society thinks the art is inappropriate for the area.
🏠 A disabled child will never be able to stand up again because of Lambeth council’s delays in finding wheelchair-accessible accommodation. The local government ombudsman has found the council repeatedly ignored requests from the child’s family to be moved into a council house with space for a wheelchair, hoists and specialist equipment, which were essential for the child’s recovery from an operation.
🚌 TfL has pulled a zero-emissions bus advert following claims it was misleading. The ad stated that all of London’s buses were either “low or zero-emission at the tailpipe”, with the words “zero-emission” in a significantly larger font. A City Hall politician pointed out that only about 10 per cent of buses were actually zero emission, and TfL have now said the ad will be replaced.
🔵 A London councillor who said an alleged rape victim was probably a prostitute has been expelled from the Conservatives. Shaun Slator, who had represented the party on Bromley council, has now been thrown out of the party after a complaints process.
London’s e-bikes are being ‘hacked’
Let’s cut to the chase: it’s not that easy to hack an e-bike. At least, not if you want it to work properly, like if you actually paid for it. None of the methods now circulating online examined by the Spy seem to give full access to the bike. Hackers are usually left without the electric boost, brakes or the ability to stop and start again.
But it’s still easy enough to worry Westminster council, which called out e-bike hacking this week as part of its battle to stop them being dumped haphazardly in central London. In a statement issued on Thursday, the council said it was “concerned about the apparent ease with which these bikes can be hacked and essentially used for free. There are videos across social media which demonstrate how to hack Lime bikes, and we hope that all dockless bike companies will do more to tackle this.”
We’ve delved into this TikTok underbelly ourselves and can confirm there are lots of videos with lots of views. We’ve not verified if the methods shown actually work though — and we suggest you don’t test this out either. If not outright illegal, it almost certainly violates companies’ terms of service.
One hack being shared is the so-called ‘push method’, with instructional videos viewed at least 130,000 times on TikTok. This hack doesn’t involve any software — hackers essentially use brute force to unlock Lime bikes. They can then cycle on the bike for as long as they like, though with no electric boost. And as soon as they stop, the bike locks up and they must hack it again. One of the telltale signs of this hack is a loud clicking noise, emitted from the bike’s back wheel as it glitches out.
Others are using what we’re calling the ‘quick cancel’ method — seen at least 55,000 times on TikTok — where the hackers unlock a bike using the app but instantly cancel once riding. Once the app catches on, the bike’s electric boost dies, but the hacker is able to keep cycling. It’s not clear this is really a hack though. As suggested by many commenters on the videos, the bike companies can detect if accounts are doing this, and then issue bans. So some are resorting to burner phones and prepaid cards to dodge this.
Then there are much more extreme examples of outright tampering with e-bike wires and cables. Videos watched more than 880,000 times walk viewers through which bits of the hardware to cut to unlock the bike. One of the most daring clips from earlier this month sees hackers doing this in broad daylight to three e-bikes, flipped over by the side of a busy road. The catch: it looks like it’s the actual brake wires being cut for this hack to work.
What’s frustrating councils like Westminster is that these hacks potentially mean e-bikes are moving around London off the grid, unable to be traced. And that’s thwarting recent attempts to control where they end up being parked. Westminster claims it’s now getting complaints from residents about abandoned e-bikes on pavements on a daily basis. The result of Paris’s recent referendum on scooter rentals is a case in point of how fed up people can get.
Regulation of e-bikes in London is still a bit of a wild west at the moment and there’s no central policy for the entire city, nor even the UK. Instead bike companies are entering into agreements with individual boroughs. Some still have blanket bans on dockless e-bikes. But others, like Westminster, are trying to come up with ways to keep them parked considerately, in the absence of a dock similar to that which Santander bikes have.
That’s recently culminated in Westminster’s ban on leaving e-bikes in Soho and Covent Garden. Lime has agreed to fine users £10 if they leave them in the new no-parking zones, while Human Forest charges £15. But hacked bikes slip through the net. “Our priority has always been the safety of residents and visitors to the city and keeping our pavements clear,” Westminster council said in its statement. “If these bikes are hacked, the rider is untraceable and the bikes can simply be dumped with impunity.”
The bike companies are trying to fix the hacks at least. A Lime bikes spokesperson said: "We are aware of a limited issue related to unlocked bikes being ridden without any power in London, and have worked to identify hardware solutions to prevent it, which are now being tested.
"We also have other extensive measures in place to prevent our bikes from being tampered with, which includes wheel locks, tamper alarms, and enhanced cybersecurity for our cloud operations system.”
Thanks for reading London Spy! Subscribe for free to receive new posts and support our work.