India’s move against Jack Dorsey’s Bitchat sparks legal debate

India did not ask GitHub to remove a post, a message, or a repository containing unlawful material. It asked GitHub to remove the code itself. The notice, dated July 23 and issued by the Indian Cybercrime Coordination Centre under the Home Ministry, argues that Bitchat's anonymous, decentralized, Bluetooth-powered architecture could facilitate unlawful activity. It argues that the app's ability to function during internet shutdowns makes it possible to circumvent lawful restrictions. It argues that the architecture hampers lawful interception, attribution, and traceability. The notice does not identify a single illegal act committed on the platform. It targets the protocol.

This is a departure. Before 2021, Indian authorities relied on Section 69A of the IT Act and the 2009 Blocking Rules to order nationwide content removal. Those provisions require specific content to be identified. The Bitchat notice cites different provisions and skips the identification step entirely. Mishi Choudhary, founder of digital rights advocacy group SFLC.in, says the cited provisions do not clearly authorize removal of an entire software project because of how it works. The distinction matters. A government that can delete code because of its architecture can delete any tool that resists surveillance.

The timing is not accidental. Weeks of student-led protests in New Delhi over alleged examination paper leaks — the "cockroach" movement — drew thousands demanding the resignation of Education Minister Dharmendra Pradhan. Authorities restricted marches toward parliament. They suspended internet services. Protesters downloaded offline messaging apps. Bitchat and Briar became lifelines. Sensor Tower data shows India accounted for 85 percent of Bitchat's global downloads between July 17 and July 23, up from 1 percent the previous month. Downloads jumped thirty-two-fold on July 19 alone. More than 91,000 installs in five days. Daily active users in India topped 330,000 by Thursday. The government noticed. It moved to cut the supply line.

Jack Dorsey posted the notice on X Friday. The document gave GitHub three hours to restrict access to three repositories. Three hours. The urgency signals that authorities understood the dynamic: every hour the code remained available, more protesters installed it. More devices joined the mesh. More conversations disappeared from the interception net. The notice frames this as a feature facilitating unlawful activity. Protesters call it a feature preserving the right to assemble and speak when the state pulls the plug on the public square.

The legal theory is thin. The notice cites provisions that appear designed for intercepting communications, not for banning the tools that enable them. It conflates the capability to communicate during shutdowns with the intent to commit crimes. By that logic, a walkie-talkie is a criminal instrument. A mesh network is a conspiracy. The government is not arguing that Bitchat hosts illegal content. It is arguing that Bitchat's existence creates operational difficulty for law enforcement. Operational difficulty is not a legal standard for prior restraint on software distribution.

GitHub has not publicly confirmed compliance. The repositories remained accessible as of Friday evening. But the notice carries the weight of the Home Ministry. GitHub has complied with Indian takedown orders before. The platform's incentives favor compliance over confrontation. If the repositories fall, the code survives — it is open source, mirrored, forked. But the friction increases. The next protester searching for an offline messenger finds a 404 instead of an APK. The government knows this. It counts on friction.

The broader implication extends beyond India. Democracies everywhere are watching. The European Union's Digital Services Act contemplates orders against "systemic risks" posed by platform architectures. The UK's Online Safety Act empowers Ofcom to mandate scanning of encrypted communications. The US EARN IT Act threatened liability for encryption that prevents lawful access. India's move is blunter. It skips the legislative process. It issues an administrative notice citing a cybercrime unit's interpretation of existing law. It targets a single app by name. It does so because that app solved a problem the state created.

Students did not choose Bitchat for its architecture. They chose it because it worked when the internet did not. The state created the condition — shutdown — then criminalized the adaptation. This is the logic of the ratchet. Restrict the network. Ban the workaround. Restrict the workaround. Ban the next one. The endpoint is a communications environment where only state-readable channels function. Bitchat is the canary. The mine is every protest, every dissent, every assembly that depends on unreadable speech.

The notice demands removal within three hours. It does not offer a hearing. It does not specify an appeal. It cites no court order. It is an executive fiat wrapped in the language of cybercrime coordination. If the legal basis holds, any open-source project with a decentralized architecture becomes removable on the same theory. Briar. Session. Berty. The next mesh protocol built by developers who have never heard of India. The code does not need to be used for crime. It needs only to be capable of resisting interception.

Choudhary is right that the provisions cited do not clearly authorize this. But clarity has rarely stopped a determined state. The test is whether GitHub resists, whether Indian courts intervene, whether developers treat the notice as a bug report and route around it. The architecture that India fears is the same architecture that makes the notice ineffective in the long run. Code replicates. Repositories mirror. Protocols evolve. The government can delete the repository. It cannot delete the capability. It can only raise the cost of access. For the 330,000 daily active users in India this week, the cost just rose. The question is whether they — and the next wave — will pay it.