A Three-Hour Order, at Midnight
On the night of July 23, 2026, at 11:16 pm, India's Ministry of Home Affairs — acting through the Indian Cyber Crime Coordination Centre (I4C) — sent GitHub a notice ordering it to disable access to three repositories belonging to Bitchat, the Bluetooth mesh messaging app built by Twitter co-founder Jack Dorsey. GitHub had three hours to comply. It did, geoblocking the repositories inside India while leaving them visible everywhere else (Rest of World).
The timing was not incidental. Students had been camped at Jantar Mantar in New Delhi since June, protesting exam irregularities, and authorities had suspended mobile internet around the protest site. Bitchat — which routes messages phone-to-phone over Bluetooth with no cell network, Wi-Fi, or central server required — became the protesters' workaround. In the week of July 20–26, India accounted for roughly 74% of the app's global downloads, and it hit an estimated 430,000 daily active users in the country on July 26 (Rest of World). Digital rights groups say this is the first known case of a government geoblocking an open-source code repository, as opposed to blocking an app from a commercial app store.
The Legitimate Concern, Stated Fairly
Governments confronting mass protests do have a real problem here, and it's worth stating plainly before dismissing the response. A shutdown is a blunt instrument precisely because it's supposed to slow the coordination of unlawful assembly or violence during a volatile moment; a tool that lets thousands of people organize in real time regardless of network status defeats that purpose entirely, by design. Bitchat's own decentralization — no server to subpoena, no account to suspend, no company to lean on — means there is no conventional lever once the app is on people's phones. From a law-and-order standpoint, going after the one remaining chokepoint, the code's distribution point, is a rational response to a tool built specifically to survive network-level control.
Where the Order Breaks Down
The problem is which law India reached for. The takedown notice cited Section 79(3)(b) of the Information Technology Act, 2000 — the provision that conditions an intermediary's safe-harbour immunity on removing content after gaining actual knowledge it's unlawful (Section 79, IT Act 2000) — read with Rule 3(1)(d) of the IT Rules, 2021. That is not a blocking power. India already has one: Section 69A, which the Supreme Court upheld in Shreya Singhal v. Union of India (2015) specifically because it comes with procedural teeth — the government must record reasons in writing, a review committee must examine the order, and those reasons can be challenged under Article 226. Section 79(3)(b), by contrast, was designed to strip a platform of legal immunity after it fails to act on a specific piece of unlawful content someone has flagged — not to compel takedown of an entire codebase in three hours with no hearing.
The Internet Freedom Foundation, which called the order "unconstitutional and authoritarian," makes the sharper point: the notice never identified any unlawful message, file, or line of code inside the three repositories (The Wire). It treated the architecture — decentralized, serverless, unblockable — as the offense. That inverts the logic Section 69A was built around, and it collides directly with the Supreme Court's 2020 ruling in Anuradha Bhasin v. Union of India, which held that restrictions on internet access and communication must be proportionate, time-bound, and the least restrictive option available — not a blanket response to a tool's capabilities (Anuradha Bhasin judgment). A midnight deadline that gives a company three hours to comply is close to the opposite of the deliberative process Bhasin demanded.
Why the Precedent Matters More Than the App
Bitchat itself survived the order intact — its code was mirrored to Radicle and other platforms within hours, and GitHub's geoblock only affects access from India, not the software's existence. In that narrow sense, the takedown didn't work. But the tactic did something more durable than block one app: it demonstrated that a government can direct a code-hosting platform to erase a specific project's visibility without naming unlawful content, without a review committee, and without the safeguards Parliament and the Supreme Court built for exactly this kind of restriction. As Tech Policy Press's analysis puts it, states facing circumvention of shutdown-based control are moving "one step up the technology stack" — from blocking networks, to blocking apps, to now blocking the repositories that build them (Tech Policy Press).
That is the part that should concern anyone who builds or depends on open-source software, not just protest-adjacent tooling. If "this code enables behavior we'd rather prevent" is sufficient grounds for a repository-level geoblock under an immunity provision never meant to function as one, the same request can reach encryption libraries, VPN clients, or any project whose only offense is working as designed. India doesn't need a new law to solve the problem it identified in July — it needs to use the one it already has, with the hearing and the written reasons that make the difference between a blocking order and a threat.