India Orders GitHub to Pull Jack Dorsey's Bitchat Code

India's cyber crime agency has ordered GitHub to take down the source code for Bitchat, the Bluetooth mesh messaging app built by Jack Dorsey, giving the platform three hours to comply. The notice went out late on Thursday July 23 and became public on Friday when Dorsey posted a screenshot of it. The order has a problem baked into it: Bitchat does not need GitHub, or any server, to keep working.

The notice came from the Indian Cyber Crime Coordination Centre (I4C), a unit of the Ministry of Home Affairs. It cites Section 79(3)(b) of the Information Technology Act, 2000, read with Rule 3(1)(d) of the IT Rules, 2021, and names three GitHub repository URLs. The government's stated concern is that the app allows communication that cannot be lawfully intercepted, since it has no phone number verification, no accounts and no central logging.

RelatedEdge 150 Adds Focusgroup and PWA Origin Migration

What exactly was ordered, and under what law?

The specifics matter here, because the legal route chosen is the part civil liberties groups are objecting to most loudly.

• Issuing body: I4C, under the Ministry of Home Affairs, not the Ministry of Electronics and IT that normally handles content blocking.
• Legal basis: Section 79(3)(b) of the IT Act plus Rule 3(1)(d) of the 2021 intermediary rules. Section 79 governs when a platform loses safe harbour, and it is not written as a general blocking power.
• Deadline: three hours from receipt, which is aggressive even by the standards of Indian takedown practice.
• Target: three repository URLs hosting Bitchat code, not any specific message, post or piece of content.

That last point is the crux of the Internet Freedom Foundation's objection. The digital rights group called the order unconstitutional and authoritarian, arguing that it identifies no unlawful content at all and instead targets a tool because of what it enables. IFF also argues the order sidesteps Section 69A, the provision that actually carries a blocking procedure with its own review committee and record keeping.

Why can a code takedown not stop the app?

Bitchat is not a service. There is no Bitchat server to seize, no account database to subpoena and no domain to null route. Phones running the app talk to each other directly over Bluetooth Low Energy, and each phone acts as a relay for its neighbours. A message hops device to device until it reaches its destination, with a time-to-live counter capping how far it travels.

The practical range is short. A single Bluetooth LE link covers roughly 10 to 30 metres. Chain enough handsets together and the effective reach stretches to something like 300 metres, which is exactly the scale of a crowd standing in one place. Sessions are end to end encrypted using the Noise Protocol Framework in its XX pattern, and peer identifiers rotate roughly every 24 hours. The app also has an internet transport built on Nostr for when connectivity exists, but the Bluetooth path is the one that matters when the towers go quiet.

What we checked ourselves

Two things are verifiable without waiting for anyone's statement, so we checked both at 15:36 UTC on July 24, roughly a day after a three-hour deadline.

First, the repositories. Both flagship Bitchat repos under the permissionlesstech organisation returned HTTP 200 to our request: the Swift client at 26,583 stars and the Kotlin Android client at 5,683 stars. Neither showed a takedown placeholder. That is a request from one vantage point, not proof of what a user in Delhi sees, since GitHub's usual response to a country-specific order is a geographic block rather than a global deletion. But it does rule out the simplest reading, that the repos were pulled outright.

Second, the paper trail. GitHub maintains a public repository, github/gov-takedowns, where it publishes the government notices it acts on. Its India folder currently holds exactly one 2026 entry, a Tamil Nadu notice dated May 12. There is no Bitchat filing there yet. GitHub has historically published these with a lag, so absence is not a verdict, but it is the place a compliance record would eventually surface, and it is empty today.

How did this become a protest story?

The order did not appear out of nowhere. Since June 6, students and the Cockroach Janta Party, a satirical youth movement founded by Abhijeet Dipke, have held sustained demonstrations at Jantar Mantar in central Delhi over the 2026 NEET paper leak and CBSE marking irregularities, demanding the resignation of Education Minister Dharmendra Pradhan. The government has repeatedly suspended mobile internet in a 1.5 km radius around the protest site under the Telecommunication Act, 2023.

1. Jun 6Protests begin at Jantar Mantar over the NEET paper leak student groups and CJP
2. Jul 17First mobile internet suspension around the protest site 1.5 km radius
3. Jul 23Fifth shutdown since July 17, Connaught Place ordered shut by 6:30 pm protesters turn to offline tools
4. Jul 23I4C sends GitHub a three-hour notice naming three Bitchat repos Section 79(3)(b)
5. Jul 24Dorsey publishes the notice, IFF calls it unconstitutional repos still resolving
6. NextWhether GitHub geo-blocks, refuses, or discloses the notice watch gov-takedowns

Each shutdown made the app more useful, which is the pattern anyone who has followed protest tooling will recognise. Bitchat has been through this before. It surged in Iran during connectivity cuts and again during demonstrations in Indonesia and Nepal in 2025, the year Dorsey released it.

Which lever actually does what?

It helps to separate the mechanisms, because they are frequently conflated in coverage of this kind of order.

Only the last row touches the mesh, and it is a policing action rather than a platform one. Everything a regulator can do to an intermediary sits in the top three rows, and none of those rows reaches a phone that already has the software. Open source compounds this: the code has been forked more than 2,900 times, so the three named URLs are not the only copies in existence.

RelatedMicrosoft 365 Down: SharePoint Is 78% of the Complaints

Who this actually affects

Not the protesters, in the short term. Anyone at Jantar Mantar already running Bitchat keeps running it. The people affected are developers and platforms.

For GitHub, this is the awkward category of request: a demand to remove code, not content. Complying sets a precedent that a general safe-harbour clause can be used to pull a repository because of what the software does. Refusing risks its safe harbour in one of its largest markets. India has roughly 17 million GitHub users, second only to the United States, so this is not a market it can shrug off.

For Indian developers, the signal is broader than one app. A takedown that names no unlawful content but objects to a capability, encrypted communication without identity verification, describes a large amount of software. Tor, Briar, Meshtastic, Signal and a long list of research projects share the same property.

Our take

The order reads as a category error. Blocking a website removes something people need to reach; removing source code removes a way to obtain something people may already have. Bitchat's whole design premise is that it survives the loss of infrastructure, which means the one intervention guaranteed not to work is an intervention aimed at infrastructure.

There is a genuine state interest here worth stating plainly. A network that cannot be intercepted is a real problem for law enforcement, and governments are not wrong that these tools are used to coordinate around restrictions. But the tool chosen does not solve that problem, and it establishes something durable: that a safe-harbour provision can be pointed at a repository over a capability rather than a piece of content. The precedent outlasts the protest, and it lands on every developer publishing security or privacy software from India.

Dorsey's reaction was four words longer than it needed to be. His post said the government of India does not like technologies like Bitchat and wants it taken down. On the evidence, the first half is clearly true and the second half is the part that will not work.

Original analysis by GenZTech. Repository status and takedown-log checks performed independently at 15:36 UTC on July 24, 2026. Reporting on the notice via CoinDesk and The Week.