India Orders GitHub To Remove BitChat Over Security Concerns

The Indian Cybercrime Coordination Centre (I4C), under the Ministry of Home Affairs, has ordered GitHub to remove and block access to BitChat, a peer-to-peer messaging platform that functions without internet using Bluetooth mesh technology.

The order, issued late Thursday night, cited concerns that the app allows “anonymous communication without mandatory registration, phone verification, or centralised logging,” which hinders lawful interception, attribution, and investigations by law enforcement.

BitChat enables messages to hop from one nearby device to another within a 30–100 meter range, forming a decentralized network that transmits data end-to-end encrypted between the sender and recipient.

The I4C noted that such a design could allow misuse, including evasion of lawful surveillance, coordination for illegal activities, and circumvention of restrictions during riots, public disorder, terrorism, organised crime, or internet shutdowns.

The app, launched by former Twitter CEO Jack Dorsey, came under scrutiny in India after its use surged during protests following the NEET question paper leak.

Dorsey publicly shared the takedown notice on X (formerly Twitter), stating that the government “does not like technologies like BitChat and wants it taken down.”

The order has sparked criticism from technology and digital rights groups. The Internet Freedom Foundation (IFF) argued that the reasoning was circular, focusing on what the app “could enable” rather than any unlawful content, noting that potential misuse is not a sufficient legal basis for blocking.

Similarly, SFLC.in highlighted that the lack of transparency violates accountability requirements under the Information Technology (Procedure and Safeguards for Blocking for Access of Information by Public) Rules, 2009.

While the government emphasizes national security and public safety, advocates warn that the takedown sets a precedent that could affect other decentralized communication tools, potentially impeding innovation and restricting legitimate use of encrypted messaging platforms in India.

The case raises broader questions around balancing security concerns with privacy rights and due process in the digital space.