Inside the Lawless New World of Electric-Scooter Hacking

Welcome to the new Wild West.

If major corporations and voting infrastructure can be hacked, then it stands to reason that one could also, and much more easily, hack a $400 electric scooter. And in their rush to make dockless, app-enabled two-wheelers a way of life across every urban neighborhood worldwide — while throttling the competition — startups Bird, Lime, Scoot, Skip and Spin have caused localized backlashes while putting their tech at risk of both clever and stupid exploits.

What’s funny is that the companies tend to dismiss these vulnerabilities as insignificant. Lime’s director of government relations and strategic development, Sam Sadle, told the Dallas Observer this summer that theft and vandalism of scooters is rare because they’re so often in use. Reacting to complaints that hacking has become common, he added: “It hasn’t in any way limited our ability to operate in the markets in which we do operate.”

That sure makes it sound like open season for anyone bent on getting around the user agreements. After all, people are ignoring pretty much every regulation in place already — not wearing helmets, scooting on the sidewalk or with multiple riders and simply ignoring the “18 and older with a valid driver’s license” requirement for usage.

The true scooter-haters, of course, are trashing (and in some cases pooping on) the vehicles, at a seemingly much higher rate than the investment-rich industry is willing to acknowledge. In fact, broken Birds and Limes are a frequent sight wherever they’re popular, with the sport of destroying them celebrated in social media accounts, including Instagram’s @birdgraveyard. There, you can watch people chuck scooters off tall buildings, ride them into the ocean, stuff them in port-a-potties or set them on fire.

These admittedly hilarious acts of anarchy appear to have gone unchecked as the demand for scooter repair services has skyrocketed. I’m guessing few offenders immediately reported the “accident, crash, damage, personal injury, or stolen or lost” scooter as instructed by the brand. It’s almost as if dumping these things on the street without cooperation or consent from municipal authorities makes them sitting ducks.

When it comes to changing the functionality of the scooters, you can still go analog: Slapping a sticker on the QR code used to unlock the gizmo effectively disables it. Cutting brake lines has proven popular where anti-scooter sentiment is strongest. Cracked-open Birds, meanwhile, are a source of lithium batteries and brushless motors, according to the tech blog Hackaday.

The scooter’s “brain” includes a Particle Electron board, which is worth around $70, and by popping out a SIM card or disconnecting the modem, you can presumably avoid GPS tracking. (The tracking feature also turns off once the battery is dead.) And while simply knocking the controller off the handlebars disconnects the electric motor, it’s apparently possible to activate it once more. “Every homeless person has like three scooters now,” Michael Ghadieh, owner of an electric bike store in San Francisco, told CNET. “They take the brains out, the logos off and they literally hotwire it.”

Revenge on Silicon Valley and gentrifiers is rarely so easy or pure.

For a stretch this summer, moreover, folks were scamming unlimited free rides on the scooters thanks to a little glitch in the activation process. By syncing with a Bird and then pulling it off the ground, riders could “cancel” a ride without turning the motor off and scoot as far as they wanted without paying. The new Bird models are said to protect against this loophole, but how long will it be until someone figures out the next? Given the available tutorials on how to jump-start Birds — or modify its base model, the Xiaomi M365, in order to increase the maximum attainable speed — I’m guessing scooter hacking and piracy is still in its early stages. Even the built-in security alarm is pretty ineffective: You can muffle it by taping over the speaker or blasting loud music.

Where you can really game the scooters, though, is as a “charger” or “juicer.” These gig minions are the ones who collect the scooters for recharging every night; they get paid for each scooter they revive. It’s become such a cutthroat business, however, that juicers go to ridiculous lengths to consolidate their holdings. Here’s a dude who got busted by cops for trying to move a mountain of loose Birds in his convertible:

The big scheme on their end is to hoard the Birds until they power down and go off the grid, at which point the bounty for “finding” it goes up. The turf wars have escalated in recent months, and many see tricking the charger app as a lucrative option. It’s a problem emblematic of a product that flooded the market with scant regard for the practicalities of city space (like scooters being left on sidewalks to be tripped over) or weird late-capitalist frictions. As with everything else that’s gone wrong with this grand experiment, the startups have tended to ignore or downplay the charger issues.

We couldn’t have expected anything else of a connected vehicular toy provided at mass scale with almost no warning or meaningful oversight: These scooters were made to be broken — and broken into.

Somehow, this tampering epidemic is usually overlooked in financial projections. The average Bird in Santa Monica earns $16 a day, recouping its cost in 20 days, as calculated in a Quartz article on the company’s viability, but the reporter added this caveat: “The real question is what a scooter costs to service and maintain.” Ordinary wear and tear alongside sustained levels of theft and vandalism may be more than enough to doom the enterprise. By then, however, the entrepreneurs will have made their bundle and scooted off to the new disruptive concept in tech.

I’m hoping it’s a Jet Ski–sharing app.

---

Miles Klee

Miles Klee is MEL’s resident tank-top dirtbag, shitposter and meme expert. He’s also the author of the novel ‘Ivyland’ and a story collection, ‘True False.’