The Ministry of Home Affairs has directed code hosting service GitHub to disable repositories that contain Bitchat, an open-source messaging application. The order from the Indian Cyber Crime Coordination Centre, issued late July 23, mandates that the Microsoft-owned service remove three links associated with the app within three hours.
Officials are arguing that keeping the code accessible through the platform will endanger GitHub’s statutory safe harbor protections under intermediary guidelines. Section 79(3)(b) of the Information Technology Act and Rule 3(1)(d) of the 2021 IT Rules are cited in the legal notice as justification for immediate removal.
The co-founder of Twitter and developer of the Bitchat app, Jack Dorsey, shared a screenshot of the government communication on X, stating that Indian officials wished to remove the application due to their “dislike of technologies that operate the way the world, and technology, should.” The removal order is a direct attempt by the federal government to prevent access to the source code of software designed to work without traditional network or cellular infrastructure.
Bluetooth mesh technology allows users to sidestep internet blackouts
Bitchat works using Bluetooth mesh technology. Instead of using cellular towers or internet service providers for communication, data packets are broadcast between adjacent phones until they reach the intended recipient. There is no need for a registered mobile number, an account, or sending private data to any server.
The app rose in popularity within Delhi amid recent protests at Jantar Mantar, led by the Cockroach Janta Party and student organizations. Demonstrators were in the capital to protest the frequent leak of national exam papers and to hold politicians accountable. When local authorities cut off internet service to areas around the protest sites to quell the demonstration, protesters began using the Bluetooth mesh software to communicate with one another in close proximity.
Because messages are sent directly between two devices, the software is capable of operating as long as users are within a close distance of each other. Because of this technology, authorities found it impossible to prevent communication between individuals through internet shutdowns or signal jammings.
Law enforcement agencies have expressed concerns about lawful interception
The cybercrime unit stated in the notice that these structural elements are a risk to law and order, and to the general public. They argued that by not having any central logging, servers, or tracking of user communication, it is impossible for investigative bodies to trace any messages and their origins.
Law enforcement stated that the decentralization of offline mesh tools “hinder the process of lawful interception and real time surveillance in matters related to public order.” The government said that intelligence reports provided by law enforcement show that decentralized communication channels like this are being used to communicate, coordinate violent assembly and disseminate unverified content during times of war, unrest, or riots.
Officials stressed that even though it is necessary for the government to shut down the internet during times of unrest or extreme violence in a controlled area to protect public safety, any application that bypasses these restrictions to permit communication creates significant blinds spots for authorities, and that this type of vulnerability can be easily exploited by terrorist organizations or groups responsible for violence.
Digital rights advocates and developers criticize government order
Digital rights advocates and legal researchers condemned the order in a public statement from the Internet Freedom Foundation. They argue that Section 79(3)(b) is not a valid basis for the order since it doesn’t grant the government broad content-blocking abilities.
These advocates explained that for the government to effectively block access to a website or app formally they would have to follow the procedure in Section 69A of the IT Act, which outlines formal processes and documented reasoning. They also highlighted that no actual illegal content is identified on the source code repositories, and the government order was issued based on the potential for the software to be misused.
Developers familiar with similar software note that the removal of source code repositories from the platform does not erase the application from the devices in which it is currently installed. They also emphasize that, by its nature as a decentralized application, the source code can still be hosted elsewhere and shared peer to peer.
