A Notice at 11:16 PM
At 11:16 pm on July 23, 2026, India's Indian Cyber Crime Coordination Centre (I4C), an arm of the Ministry of Home Affairs, sent GitHub Notice No. 11072601011432. It ordered the Microsoft-owned platform to disable access to three repositories belonging to Bitchat — the Bluetooth mesh-messaging app built by Twitter co-founder Jack Dorsey — within three hours. The repositories included Bitchat's source code, its Android application, and its release files. GitHub did not confirm receipt of the notice, and the repositories remained reachable from India days later (Rest of World; The Wire).
The trigger was Delhi's NEET-UG protest movement, which had occupied Jantar Mantar since June 2026 over alleged examination irregularities. After police forcibly removed hunger-striking activist Sonam Wangchuk on July 18 and used tear gas against a July 20 march on Parliament, authorities suspended mobile internet around the protest site at least five separate times starting July 17, alongside signal jammers deployed by Delhi Police (Human Rights Watch; The South First). As protesters turned to Bitchat's offline mesh network to coordinate through the blackouts, the government moved against the code itself — not a server, not an account, but the repository where developers store and share it. Digital rights researchers say this is the first known instance of an Indian government trying to geoblock an open-source repository rather than a specific piece of content (Rest of World).
The Steelman
Start with the government's strongest case. India's home ministry has a real interest in maintaining lawful-interception capability during civil unrest, and Bitchat's design — no accounts, no central servers, encrypted device-to-device relay — is architecturally built to survive exactly the shutdown orders the state was issuing. A tool that reliably defeats a legal shutdown order is a genuine policy problem, not a hypothetical one, and governments facing fast-moving unrest do not have the luxury of a multi-week review cycle. If the concern were narrowly about attribution and traceability during an active public-order emergency, a time-boxed, judicially reviewable order would be defensible.
Why the Legal Route Matters
That is not the order India issued. The notice was grounded in Section 79(3)(b) of the IT Act, 2000 — the clause that strips an intermediary of safe-harbor immunity if it fails to act on "actual knowledge" of unlawful content — read with Rule 3(1)(d) of the IT Rules, 2021. It did not invoke Section 69A, the IT Act's actual blocking power, which is bound to the Information Technology (Procedure and Safeguards for Blocking for Access of Information by Public) Rules, 2009. Those 2009 rules require an inter-ministerial committee review, a notice to the content's originator, and a recorded justification before a block issues (PRS India).
The distinction is not procedural trivia. In Shreya Singhal v. Union of India (2015), the Supreme Court upheld Section 69A precisely because it came bundled with those safeguards, while striking down the vaguer Section 66A for lacking them — and it held that any takedown must trace to a court order or a government notification confined to Article 19(2)'s enumerated grounds, not an intermediary's own judgment call under threat of losing immunity (Shreya Singhal v. Union of India, Supreme Court of India). Using Section 79(3)(b) as a blocking mechanism inverts that logic: a clause written to define when a platform loses legal protection is repurposed as a takedown order, with none of the committee review, hearing, or written reasoning Section 69A requires. The Internet Freedom Foundation put it bluntly: the order never identified any unlawful information in the repositories, only that Bitchat's decentralized architecture let it work without internet access — reasoning IFF compared to sealing a telephone exchange because a phone could theoretically be misused (The Wire).
A Three-Hour Deadline Forecloses Review
The compliance window compounds the problem. A three-hour, midnight-issued deadline leaves no room for GitHub, or anyone else, to seek judicial review before the order takes effect — the kind of proportionality check the Supreme Court demanded for shutdown orders generally in Anuradha Bhasin v. Union of India (2020), which required internet suspension orders to be published, time-bound, and periodically reviewed. And the order was self-defeating on its own terms: deleting a GitHub repository does not remove an app already installed on thousands of devices, which is precisely why the protest-era surge in Bitchat usage continued regardless of the notice (Rest of World).
The Precedent Problem
The durable risk here isn't Bitchat — it's the template. If a safe-harbor clause can compel removal of open-source code based on what the software is capable of rather than what any specific user did with it, the same logic reaches VPN clients, Tor bridges, or any encryption library that makes lawful interception harder. Mishi Choudhary of SFLC.in noted the cited provisions don't clearly authorize pulling an entire software project over its functionality (TechCrunch). If India's home ministry has a genuine case that Bitchat facilitated unlawful coordination during the Jantar Mantar protests, Section 69A and its 2009 procedural rules already provide the tool — a committee review, a hearing, and a reasoned order. Routing around that process because it's slower doesn't strengthen the state's authority; it hands every future court challenge a cleaner target, and it tells every open-source maintainer that shipping code capable of working offline is now a liability under Indian law.