On July 23, 2026, at 11:16 p.m. IST, India's Indian Cyber Crime Coordination Centre (I4C) — operating under the Ministry of Home Affairs — sent a takedown notice to GitHub. The notice number was 11072601011432. The deadline was three hours. The target: three repositories under the "permissionlesstech" account — the main BitChat project, its Android build, and the Android releases page.

Jack Dorsey, who launched BitChat in July 2025, posted a copy of the notice on X the following day. His summary: "the government of india does not like technologies like bitchat and wants it taken down."

The Internet Freedom Foundation (IFF), India's leading digital rights nonprofit, responded the morning of July 24. Their position, stated directly: "The blocking of BitChat's code on GitHub is unconstitutional and authoritarian."

What BitChat Is

BitChat is a decentralized peer-to-peer messaging app with a dual-transport architecture. For local, offline communication, it uses Bluetooth Low Energy mesh networking — messages hop between nearby phones with no internet connection required. For global reach, it uses the Nostr protocol over public relays. No accounts. No phone numbers. No central servers. No mandatory user registration. No centralized logging of communications.

The Android implementation is at github.com/permissionlesstech/bitchat-android. 7,500 stars, 1,800 forks, 815 commits. GPL-3.0 licensed. The iOS version is protocol-compatible. The app is on Google Play. It works on Wear OS. The Bluetooth mesh uses Noise Protocol sessions with forward secrecy. Peer identities are derived from static keys. The packet format is compact binary with fragmentation, TTL routing, and deduplication. There's a foreground service to keep the mesh alive within Android's background execution limits.

The architecture is the product. BitChat works when the internet is down, when mobile networks are jammed, when cell towers are shut off, when SMS is blocked. That is the use case. That is also the threat model — not to users, but to states that want the ability to cut connectivity on demand.

What the Order Says

The I4C notice states that BitChat "enables anonymous communication without mandatory user registration, phone number verification, or centralized logging of communications," which "significantly impedes lawful interception, attribution, and investigation by law enforcement agencies."

Read that sentence carefully. The offense is not content hosted in the repositories. The offense is what the code is capable of enabling. The notice identifies no specific unlawful content. It targets the application's architecture.

The government argued the platform could be exploited for "coordinating unlawful assemblies, violent protests, dissemination of misinformation, and criminal conspiracies." The IFF's response was direct: "the reasons in the order are circular." The order asserts the repositories contain information "prohibited under any law" without naming any such information. It rests on what the application is capable of, not what it has done.

The Procedal End-Run

IFF's core legal objection is procedural. I4C issued the order under Section 79(3)(b) of the Information Technology Act, 2000 — an intermediary liability provision — rather than under Section 69A, the formal statutory mechanism for website blocking. Section 69A includes procedural safeguards: notice, hearing, review. Section 79(3)(b) does not. IFF demanded withdrawal of the notice and publication of all takedown orders issued under Section 79(3)(b).

The distinction matters. Section 69A is the law designed for blocking. It has safeguards because blocking speech is a serious act that a democracy should not do without process. Section 79(3)(b) is a liability shield for intermediaries — it says platforms lose their safe harbor if they fail to act on certain notices. Using it as a blocking mechanism bypasses the safeguards that the blocking statute was built to provide. IFF's argument is that I4C weaponized a liability provision to do what the blocking statute was designed to make harder.

As of the reporting in late July, MediaNama indicated the repository links had been taken down. GitHub had not issued a public statement confirming compliance. The BitChat app remained available on Google Play.

The Precedent That Travels

This is where the story stops being about a messaging app and starts being about every permissionless protocol your community might operate.

The I4C notice could be reissued tomorrow with "Matrix homeserver" substituted for "BitChat repository" and the logic holds identically. A self-hosted Matrix server with end-to-end encryption, no phone number requirement, and no centralized logging — that's the same architecture the notice describes. The notice doesn't say "BitChat enabled specific people to coordinate a specific crime and here's the evidence." It says the app's design impedes lawful interception. So does every E2EE messaging system. So does Matrix. So does XMPP with OMEMO. So does Signal. So does any protocol that doesn't build in a wiretap.

The logic applies to Nostr relays — public or self-hosted message relays that don't log user identities. It applies to Tor exit nodes. It applies to VPN operators. It applies to any community organization running a communication service that doesn't retain the metadata a government might later want.

India's move also demonstrates the pressure-point strategy. States don't need to ban permissionless tools outright. They pressure the intermediaries: GitHub, app stores, ISPs, hosting providers. Platform intermediary liability does the work. GitHub received a three-hour deadline with no due process and no judicial review. The precedent is not that BitChat was banned — it wasn't. The precedent is that a government can issue a three-hour takedown demand to a major code-hosting platform, cite no illegal content, target the architecture, and the platform complies.

China ordered BitChat pulled from Apple's App Store in April 2026. India is the second large state to move against it. China also banned Dorsey's Nostr-based Damus app in 2023. The pattern is consistent: states move against permissionless communication tools in sequence, testing platform compliance along the way. Each compliance makes the next demand easier.

Why BitChat Survived

Removing GitHub repositories doesn't kill open-source software. The code is mirrored. The forks exist. The app remained on Google Play. The Bluetooth mesh network has no server to shut down. The Nostr relays are distributed. There is no kill switch because there is no switch.

This is the structural argument for permissionless architecture. A centralized platform can be pressured. A repository can be removed. An app store listing can be pulled. But when the protocol has no center, the state has to go after every node — and there are too many nodes. BitChat's architecture is its defense. That's not a side effect. It's the design.

For community infrastructure, this is the lesson. Federation and decentralization are not just about avoiding vendor lock-in. They are about structural resilience against pressure that can be applied to centralized intermediaries. A community running its own Matrix homeserver is not dependent on GitHub's compliance with a foreign government's takedown notice. A community running its own Gitea or Forgejo instance is not dependent on GitHub at all.

What to Watch

IFF has demanded three things: withdrawal of Notice No. 11072601011432, publication of all Section 79(3)(b) takedown orders, and restoration of internet connectivity around Jantar Mantar (a protest site in New Delhi) alongside disclosure of the legal authority for jammer deployment there.

The falsifiable thesis is narrow. If I4C amends the notice to cite specific illegal content in the repositories, or if an Indian court upholds the Section 79(3)(b) application as lawful procedure rather than a bypass, that would indicate normal content moderation operating within legal guardrails. The notice as written offers no basis for that reading.

What to watch: whether GitHub issues a public response explaining its compliance decision. Whether any Indian court takes up a challenge to the notice. Whether other governments cite the I4C precedent in their own takedown demands. Whether the pattern of targeting architecture rather than content spreads to other jurisdictions and other protocols.

What This Means for You

If you operate community infrastructure — a Matrix homeserver, a Nextcloud instance, a Gitea, a Mastodon server, an XMPP server with OMEMO encryption — the BitChat notice is about you. The legal theory is the same. The architecture that makes your deployment useful (end-to-end encryption, minimal metadata retention, no phone number requirement, federation without central control) is the architecture the notice describes as an impediment to lawful interception.

This is not a hypothetical. Canada's Bill C-22, currently in the Senate, compels electronic service providers to build interception capability and retain metadata. Its definition of "electronic service provider" is broad enough to capture a community organization running a Nextcloud instance. The Indian notice and the Canadian bill are two expressions of the same demand: communication infrastructure must be interceptable, and if it isn't, that's the violation.

The defense is the same defense we've been building. Self-hosted. Federated. End-to-end encrypted. Minimal retention by design. FOSS-licensed so the code can be inspected. Operated by the community it serves, on hardware the community controls. Not because it's illegal to do otherwise — because the architecture itself is the position. When the notice comes, there is no central point to serve it on. When the takedown demand arrives, the code is already mirrored. When the platform complies, the network keeps running.

BitChat stayed up because it was built to stay up. That's the standard. That's what community infrastructure should aim for. Not the app — the property.

Sources: I4C Notice No. 11072601011432 (published by Jack Dorsey, July 24, 2026); Internet Freedom Foundation statement (July 24, 2026); TFTC reporting (July 30, 2026); Bitcoin Magazine (July 30, 2026); MediaNama (July 2026); github.com/permissionlesstech/bitchat-android.