Late on 23 July 2026, India's cybercrime agency gave GitHub three hours to delete the code repositories of Bitchat, Jack Dorsey's offline mesh messenger. Takedown orders usually target content: a post, a video, an account. This one targeted code, for what it can do rather than anything it said. That distinction is the whole story, and it concerns every company that ships software
The facts first, because they are precise and documented. Notice No. 11072601011432 was issued by the Indian Cyber Crime Coordination Centre at 11:16 pm on 23 July under Section 79(3)(b) of the IT Act, directing GitHub to disable access to three Bitchat repositories within three hours or risk losing its intermediary protections, per CyberInsider's report. GitHub complied, per Medianama. The stated rationale, per The Week's coverage of the order, is that the app "significantly impedes lawful interception, attribution, and investigation". The order came amid the Delhi student protests, where mobile internet had been suspended around the protest site and Bitchat's phone to phone mesh reportedly kept working, the physics we covered here.
Code is not a post
Read the notice carefully and the escalation is plain: it does not identify a single unlawful message, video or account. The Internet Freedom Foundation, which called the order "unconstitutional and authoritarian", noted exactly that, and that the government bypassed India's formal blocking process with its procedural safeguards, per Cointelegraph's report on the IFF statement. What was ordered removed was capability: source code, targeted because of what compiled software can enable. Medianama's analysis draws the conclusion for the industry: a precedent where governments can order code itself off hosting platforms "puts all software companies at risk", because nearly all useful software is dual use. An encrypted messenger, a VPN, a mesh radio, a camera app: each has a use a government somewhere dislikes.
It also did not work
Within hours of GitHub complying, the repositories had been mirrored on decentralized code platforms, and the app itself remained live on both the Apple and Google app stores, per Decrypt. Dorsey published the takedown notice to his millions of followers, converting a quiet compliance order into a global story. And the precedent for what happens next is recent: during Nepal's protests in September, Bitchat recorded 48,781 downloads in a single day, per CoinDesk. The community reflex was visible in real time on r/privacy, where the top comment, from u/CounterSanity at 401 upvotes, pointed past the app to the whole category: "Since offline messaging makes the governments of the world nervous: meshtastic.org - Get em while you can folks." Suppressing open source code is not like suppressing a broadcast. The artifact is copyable, the takedown is the advertisement, and the demand it signals is exactly the demand it fails to remove.
What builders should actually change
- Treat your host as a jurisdiction, not just a service. GitHub complied in three hours because its intermediary protections in a large market were on the line. Any single platform will make the same choice. If your project matters, mirror the repository somewhere with different legal exposure, the same discipline we already apply to model weights in our open weight supplier risk checklist.
- Distribute releases beyond one channel. Bitchat survived the order because the app stores, the mirrors and the installed base all sat outside GitHub. Release artifacts that only exist in one place are one notice away from not existing.
- Know the intermediary law in your markets. Section 79(3)(b) style orders target the platform, not you, and the platform will not fight your case. The IFF's objection that no formal process was followed is precisely the kind of gap that gets tested on someone's code first and everyone's code later.
- Write the capability honestly. The order cited what the software enables. If you build dual use technology, the honest public framing of who it is for and why it exists is not marketing copy, it is part of your defence when someone characterises the capability for you.
Frequently asked questions
Can a government remove code from GitHub?
It can order GitHub to geo-block or remove repositories, and platforms usually comply where their legal protections in that market are at stake, as GitHub did with Bitchat in India in July 2026. What it cannot practically do is delete open source code from the internet: Bitchat's repos were mirrored within hours.
Is Bitchat banned in India?
The GitHub repositories were ordered removed and GitHub complied, but as of late July 2026 the app remained available on the Apple and Google app stores, and the code is mirrored on other platforms. The Internet Freedom Foundation is contesting the order's legality.
What should developers of dual use software do about takedown risk?
Mirror repositories across platforms with different legal exposure, distribute release artifacts through more than one channel, understand intermediary liability law in major markets, and state the software's intended purpose honestly and publicly before someone else characterises it for you.
© 2026 Dinimiciuil Labs. All rights reserved. Written on the build floor in Dublin. You are welcome to quote a short excerpt with a link back; please do not republish the full article without permission.