India’s cybercrime agency has ordered GitHub to disable access to Bitchat, the offline Bluetooth mesh messaging app released as open source by Jack Dorsey — and the order does not stop at the iOS project. Two of the three URLs it names are the Android side of the app: the bitchat-android repository and its releases page, which is where the signed APK that people sideload actually lives.
The notice was issued late on Thursday, 23 July, by the Indian Cyber Crime Coordination Centre (I4C), a unit of the Ministry of Home Affairs, and gave GitHub three hours to take the pages down. It was sent under Section 79(3)(b) of the Information Technology Act, 2000, read with Rule 3(1)(d) of the IT Rules, 2021 — the safe-harbour route that makes a platform liable if it does not act on a government notice.
What the Bitchat order actually objects to
Read closely, the order is not about a specific message, account or piece of content. It objects to how the software is built. Per the document as reported by MediaNama and reviewed by CoinDesk, it argues that Bitchat allows communication without registration, phone-number verification or centralised logging; that its architecture impedes lawful interception and attribution; that there is no central operator from whom subscriber records can be demanded; and that it could be used to keep communicating through officially imposed internet shutdowns. MediaNama reports the notice also invokes IT Act Sections 43, 84B and 84C, and Sections 61, 196 and 197 of the Bharatiya Nyaya Sanhita, 2023.
The timing is not incidental. Student demonstrations over a national exam scandal have run in Delhi since 20 July, with repeated internet suspensions around the protest sites, and protesters have been documented switching to Bluetooth mesh apps once the connection drops. Dorsey responded on X on 24 July with a single line:
the government of india does not like technologies like bitchat and wants it taken down
Is Bitchat still up? What we found
Compliance is unconfirmed. MediaNama reported that GitHub took the links down; TechCrunch reported that the repositories were still reachable from India and that GitHub neither confirmed receiving the notice nor logged it in its public takedown repository; CoinDesk said it could not establish whether the three-hour deadline was met.
Our own check, run from a Delhi broadband connection at around 4pm IST on 25 July, found the bitchat and bitchat-android repositories and the Android releases page all loading normally, with full page content and no country-restriction notice. The official Play Store listing (package com.bitchat.droid, the one the project links from its own Android README, published by Verse Communication PBC) also loaded. That is one connection on one ISP at one moment — blocks in India are often applied network by network — but as of writing, nothing we tested had gone dark.
Why Android users elsewhere should care
Strip out the politics and a precedent is left that matters well beyond India: a state asking a code host to delete a project because of its design, rather than asking anyone to remove unlawful content. Legal experts and digital-rights groups quoted by TechCrunch, including Mishi Choudhary of SFLC.in and the Internet Freedom Foundation, make the point from different angles — that the cited provisions were not written to erase whole software projects, and that removing a repository does not remove the app from phones that already have it.
For Android it lands on an already-narrowing path. Google is preparing to require verified developer identity for sideloaded apps, with enforcement piloting in Brazil, Indonesia, Singapore and Thailand from September. Squeeze the sideloading route at one end and the code host at the other, and the answer to “where do I get an app a government dislikes” gets shorter. Mesh messaging is also what still works in a blackout, an earthquake or a stadium with no signal — which is exactly the property being treated here as the problem.
Sources: MediaNama, CoinDesk, TechCrunch
