At 11:16 pm on 23 July, India's Cyber Crime Coordination Centre, part of the Home Ministry, gave GitHub three hours to disable three repositories, the public folders where a program's source code lives. The code was Bitchat's, a messaging app that works with no internet, no servers and no phone number, passing encrypted messages from handset to handset over Bluetooth.
The order points to no illegal message, no user and no specific crime. It points to what the program makes possible, and it says so in its own words: Bitchat "enables anonymous communication without mandatory user registration, phone number verification, or centralized logging", and out of that could come "unlawful assemblies, violent protests, misinformation dissemination, and criminal conspiracies". The same document adds the part that really stings, that the app keeps working during network restrictions. Translated, the problem is not what somebody wrote, it is that people can still write when the state switches off the network.
The legal basis that lawyers say does not exist
The notice invokes Section 79(3)(b) of India's Information Technology Act and threatens GitHub with the loss of its intermediary status, the protection that shields a platform from answering for what its users put there. SFLC.in, an Indian digital rights organisation, replies that this section confers no blocking power at all, a power that lives in another section, 69A, which comes with procedure, record-keeping and a right of appeal; by knocking on the wrong door, the order works as a way around the safeguards the right door would have required. The Internet Freedom Foundation called it "unconstitutional and authoritarian", noting that the order asserts prohibited content exists without naming any content at all, resting instead on what the application is "capable of".
Mishi Choudhary, founder of SFLC.in, summed up the leap being made: the provisions cited "do not clearly authorize authorities to seek the removal of an entire software project because of how it works rather than any specific illegal content".
The timing explains the hurry. Since 20 July, New Delhi has seen student demonstrations over an alleged leak of national exam papers, and authorities have repeatedly suspended internet access around the protest sites. Over the previous thirty days roughly 1% of Bitchat's global downloads came from India; between 17 and 23 July it was 85%, more than 91,000 downloads in five days, with more than 330,000 daily active users in the country. Jack Dorsey, who released the app as open source in July 2025, wrote on X that "the government of india does not like technologies like bitchat and wants it taken down". That is how the case became known, because the Indian government published no copy of the order.
Deleting the repository does not delete the network
Here is the technical mistake no legal team caught. The three repositories targeted are the main project, the Android build and the releases page, and it is fair to say that deleting them would close the door through which new Android installs arrive, yet none of them is the application. Deleting them removes the program from no phone that already carries it, does not stop the Bluetooth mesh, which needs no servers by design, and does not prevent anyone who cloned the code from publishing it somewhere else. Two days after the order the three repositories were still up, GitHub had not even confirmed receiving the document, and the request had not appeared in the public register where the company lists the takedowns it acts on.
Raman Chima, of the Association for Progressive Communications, named the real target, which is not only whoever provides the service, it is the idea that "open source development of this type of product should not occur".
A Bluetooth mesh is not a service, it is a protocol, and a protocol has no switch. Demanding the switch from someone who does not have one ends up revealing which switch was really wanted, the one on the network.
Before we file this away as an Indian problem, the map is worth a look. Access Now counted 313 internet shutdowns across 52 countries in 2025, a record that beat the previous year's 304, and India accounted for 65 of them on its own. The European Union does not cut networks over a protest, but the debate brushes the same place: the European Commission's ProtectEU strategy plans a technology roadmap on encryption this year, to assess ways of giving authorities lawful access to encrypted data, and wants to equip Europol with a new decryption capability from 2030, even though the European Court of Human Rights ruled in February 2024, in Podchasov v. Russia, that weakening encryption violates the Convention.
What this asks of you
You do not have to live in a country with network shutdowns to take something practical from this:
- Install before you need it. A mesh app is only useful if it is already on the phone, because on the day the network goes down the app stores go down with it.
- No internet does not mean invisible. Bluetooth announces presence and proximity, and encryption protects the content of the message, not the fact that you are there.
- In open source, the value is in the code. Anyone who cloned a repository holds a complete and verifiable copy, which is exactly why a takedown order achieves so little.
- Read the orders, not the press releases. It was SFLC.in and the Internet Freedom Foundation that made this order public and took it apart, and it is Access Now that counts network shutdowns year after year.
Three repositories are not a network, and an order that confuses the two says less about Bitchat than about a state that already counts on silence as an instrument of government.
Sources: TechCrunch, CoinDesk, SFLC.in, TFTC, The Week.
#StaySafe
🙏🖖
