A shutdown, then a takedown
On July 23, 2026, at 4 p.m., the Union Home Secretary suspended mobile internet within a 1.5-kilometre radius of Jantar Mantar in New Delhi, citing "public safety" and the prevention of "incitement to the commission of any offence" (Republic World). The order targeted the site of a five-week-old sit-in by the Cockroach Janta Party, where students have been demanding the resignation of Union Education Minister Dharmendra Pradhan over alleged NEET and CBSE examination irregularities. The shutdown did not end protesters' ability to coordinate. It sent them to Bitchat, Jack Dorsey's open-source Bluetooth-mesh messaging app, which routes messages phone-to-phone without SIM registration, a central server, or a live internet connection. India reportedly accounted for roughly 85% of the app's global downloads during the unrest (TechCrunch).
Seven hours after the shutdown began, at 11:16 p.m., India's Cyber Crime Coordination Centre (I4C), under the Ministry of Home Affairs, issued Notice No. 11072601011432 to GitHub, ordering it to disable access to three Bitchat repositories — the main project, its Android build, and its releases page — within three hours (The Wire). The legal basis cited was Section 79(3)(b) of the Information Technology Act, 2000, read with Rule 3(1)(d) of the IT Rules, 2021 — a provision that conditions an intermediary's liability shield on acting against unlawful content once notified, not a general power to order software removed.
The case for the order — and where it breaks down
There is a real problem the government is gesturing at. Mesh-messaging apps that require no phone number or central log genuinely do make lawful interception harder, and coordination tools that persist through an official shutdown can also coordinate a riot, not just a protest. A state facing a five-week occupation that turned violent on July 20 — injuring both protesters and police, according to Republic World's reporting — has a legitimate interest in knowing whether a communications tool is being used to organise unlawful assembly, and Section 79(3)(b) exists precisely so intermediaries can't claim ignorance once told.
But the notice does not identify unlawful assembly, incitement, or any specific unlawful message inside the repositories. Instead, per reporting cited by TFTC, it objects to what the app enables "even during network restrictions" and how its architecture "significantly impedes lawful interception, attribution, and investigation." That is a description of the software's design, not evidence of an offence — the equivalent of ordering a locksmith's manual removed because burglars could read it.
The Internet Freedom Foundation's July 24 statement, republished by The Wire, laid out why this matters procedurally as much as substantively. Section 79(3)(b) is a safe-harbour condition, not a blocking power; the Supreme Court's Shreya Singhal v. Union of India (2015) ruling directed that content blocking run through Section 69A and the 2009 Blocking Rules, which require a designated committee, written reasons, and an opportunity to be heard before an order issues. None of that occurred here. IFF also noted the order invoked Section 43 — a civil damages provision — alongside criminal statutes, against a platform that merely hosts code it did not write.
The timing compounds the defect. A three-hour deadline issued at 11:16 p.m., as Section 79 of the IT Act itself makes clear is meant to be a content-specific notice-and-takedown mechanism, leaves no realistic window for GitHub — or Bitchat's maintainers — to seek judicial review before compliance is due. The Supreme Court's Anuradha Bhasin v. Union of India (2020) ruling, arising from the Kashmir internet shutdown, set a four-part proportionality test for restrictions on internet access and speech: a legitimate aim, a suitable measure, no less-restrictive alternative, and a benefit that isn't outweighed by the harm. A midnight ultimatum with no hearing fails that test on its face, regardless of how one weighs the underlying security concern.
An order that doesn't do what it claims to
Even judged on its own terms, the notice is a poor tool. GitHub told TechCrunch it had not confirmed receiving the order and that its public takedown log — which it says lists all actionable government requests — showed no recent Bitchat entry; the repositories remained reachable from India days later. And as IFF pointed out, deleting a GitHub repository does nothing to the copies of Bitchat already installed on protesters' phones — the mesh network keeps functioning without any server or code host at all. Mishi Choudhary of SFLC.in put the core problem plainly: the cited provisions don't authorise removing an entire software project for how it works, as opposed to specific unlawful content.
That gap between what the order can accomplish and what it purports to justify is the real story. Treating an app's resistance to shutdowns as the offence, rather than any content it carried, sets a precedent that would reach far beyond Bitchat — to Signal, Briar, or any tool engineered to survive a network blackout. India has legitimate law-enforcement interests in attribution and lawful interception, and Parliament has already built a blocking process — Section 69A — with the procedural safeguards those interests need. Reaching instead for an intermediary-liability clause designed for pirated films and defamatory posts, at midnight, with a three-hour clock, buys the government a headline and a fight with Jack Dorsey, not a working remedy.