The Indian Cybercrime Coordination Centre (I4C), functioning under the Ministry of Home Affairs (MHA), has directed the code repository platform GitHub to disable access to three repositories hosting the source code of BitChat, a peer-to-peer messaging application that operates entirely offline using Bluetooth mesh technology. The directive, issued under Section 79(3)(b) of the Information Technology Act, 2000 read with Rule 3(1)(d) of the IT Rules, 2021, gave GitHub a three-hour window to comply. The move marks one of the first instances where India’s takedown framework has been applied to software source code rather than online content.
What Is BitChat and How Does It Work?
BitChat is a decentralised, peer-to-peer encrypted messaging app conceived by Doris Lima and developed by Jack Dorsey, the co-founder of Twitter (now X) and the CEO of Block, Inc. It was announced in July 2025 and works without internet connectivity, cellular service, user accounts, phone number verification, or central servers.
The app operates over Bluetooth Low Energy (BLE) mesh networks. In a Bluetooth mesh network, every participating smartphone acts as both an endpoint and a relay node. When a user sends a message, it hops from one device to another within Bluetooth range, creating a chain of communication. Each device that receives the packet forwards it to nearby devices until the message reaches its intended recipient. This store-and-forward mechanism allows messages to travel well beyond the standard 10-to-100-metre range of a single Bluetooth link.
BitChat uses a dual-transport architecture. For local communication, it relies entirely on Bluetooth mesh. For global reach, it also integrates the Nostr protocol, an internet-based decentralised messaging standard. Direct messages between users are end-to-end encrypted using the Noise Protocol Framework. The app also features a panic mode that erases all stored data upon three taps of the logo.
Why Did I4C Order the Takedown?
The I4C’s directive came against the backdrop of ongoing protests at Jantar Mantar in New Delhi, where demonstrators had been using Bluetooth-based messaging apps to coordinate after temporary mobile internet restrictions were imposed around the protest site. While law enforcement agencies have not publicly confirmed whether BitChat was specifically used, the incident drew regulatory attention to decentralised, offline messaging platforms more broadly.
Investigative Challenges Raised by the Government
In its notice to GitHub, the I4C outlined several security and investigative concerns:
- Impediment to attribution: BitChat’s architecture significantly hinders lawful interception and attribution by law enforcement. Since messages travel directly between nearby devices without passing through any central server, there is no service provider from whom subscriber details or communication records can be requested.
- Bypassing lawful restrictions: The platform can be used to evade surveillance or circumvent internet suspensions imposed during situations involving public disorder, riots, terrorism, organised crime, or unlawful assemblies.
- Absence of metadata: Without a central service provider or server logs, investigators cannot retrieve subscriber information or communication records during criminal inquiries.
The I4C’s order stated that “intelligence inputs indicate that such decentralised communication platforms are capable of being exploited for coordinating unlawful assemblies, violent protests, dissemination of misinformation, radicalisation, criminal conspiracies and other activities prejudicial to the sovereignty and integrity of India.”
The agency alleged that BitChat violates Sections 43, 84B, and 84C of the IT Act, 2000, along with Section 61 read with Sections 196 and 197 of the Bharatiya Nyaya Sanhita (BNS).
The Legal Basis for the Takedown
The takedown order was issued under Section 79(3)(b) of the Information Technology Act, 2000, read with Rule 3(1)(d) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
Section 79 of the IT Act provides a “safe harbour” to intermediaries such as GitHub. This means an intermediary is not held liable for third-party content hosted on its platform, as long as it fulfils certain conditions. However, Section 79(3)(b) carves out an exception: if the intermediary receives actual knowledge from the appropriate government agency that content is being used to commit an unlawful act, it must remove or disable access to that content. Failure to comply results in the loss of safe harbour protection, making the intermediary liable for the hosted content.
Rule 3(1)(d) of the IT Rules, 2021, requires intermediaries to remove or disable access to content that violates the rules within 36 hours of receiving a complaint. However, government directives under Section 79(3)(b) have typically demanded faster compliance, as was the case here with a three-hour deadline.
The MHA designated the I4C as an authorised agency to issue such takedown notices in 2024, centralising the power that was previously dispersed across multiple entities including the Ministry of Electronics and Information Technology (MeitY).
The Sahyog Portal, a government platform launched to automate the issuance of takedown notices under Section 79(3)(b), is also used for such directives.
Beyond BitChat: Offline Mesh Apps and Global Precedents
BitChat is not the first offline mesh messaging app to attract government scrutiny. Its predecessors include FireChat and Bridgefy, both of which gained prominence during protest situations.
| App | Year | Notable Use | Government Response |
|---|---|---|---|
| FireChat | 2014 | Used extensively during Hong Kong’s Umbrella Movement protests, enabling communication without internet | China requested Apple to remove FireChat from the App Store |
| Bridgefy | 2019 | Saw 3,685% downloads surge during Hong Kong protests; used by protesters to bypass internet monitoring | Subject to scrutiny in multiple countries |
| BitChat | 2025 | Used in Madagascar (70,000 downloads in one week), Nepal (50,000 downloads in a single day), Uganda and Iran during internet blackouts | Apple removed BitChat from its App Store in China in April 2026; India’s I4C ordered GitHub takedown in July 2026 |
BitChat was previously taken down from the Apple App Store in China in April 2026 at the request of the Cyberspace Administration of China (CAC). The app also saw heavy usage during protests in Madagascar in September 2025, with 70,000 downloads in a single week, and in Nepal during its protests the same month, where nearly 50,000 downloads were recorded on 8 September 2025 alone.
Digital Rights Concerns and the Debate Ahead
The takedown order has drawn sharp criticism from digital rights organisations. The Internet Freedom Foundation (IFF), an Indian digital rights advocacy group, called the directive “unconstitutional and authoritarian.” IFF argued that the government’s real concern is not any specific unlawful content on the app, but rather the fact that BitChat enables citizens to communicate with each other even when the internet has been switched off.
The IFF has made four specific demands: that the takedown notice to GitHub be withdrawn; that the government publish every content-removal order issued under Section 79(3)(b), Rule 3(1)(d), and the Sahyog Portal along with the reasons recorded for each; that full internet connectivity be restored around Jantar Mantar; and that the government disclose the legal basis for the internet suspension and the reported use of signal jammers at the site.
Jack Dorsey himself responded publicly on X, stating: “The government of India does not like technologies like Bitchat and wants it taken down.”
The order also raises questions about the expanding scope of India’s intermediary liability framework. By extending takedown directives to source code repositories rather than just social media posts or online content, the government has signalled a broader interpretation of what constitutes “content” under the IT Act. Critics argue that this could have a chilling effect on open-source development and innovation in India, while the government maintains that such measures are necessary to address emerging security challenges posed by technologies that can evade lawful surveillance.
Key Takeaways
- The Indian Cybercrime Coordination Centre (I4C) directed GitHub to disable three repositories hosting BitChat source code under Section 79(3)(b) of the IT Act, 2000.
- BitChat is a decentralised, peer-to-peer encrypted messaging app developed by Jack Dorsey that works without internet using Bluetooth Low Energy mesh networks.
- The I4C cited risks including inability to attribute messages, bypassing of internet suspensions, and absence of central server metadata as reasons for the takedown.
- The order was also linked to ongoing protests at Jantar Mantar in Delhi where offline mesh apps were reportedly used after mobile internet restrictions were imposed.
- Digital rights group IFF called the order “unconstitutional and authoritarian”, arguing it targets the ability of citizens to communicate during internet shutdowns.
- Similar precedents include China’s request to Apple to remove BitChat from its App Store in April 2026 and previous scrutiny of apps like FireChat and Bridgefy during Hong Kong protests.
