India's Three-Hour Takedown Orders GitHub to Delete Bitchat: A Verification Lesson in Code, Censorship, and Fragile Infrastructure

On a Tuesday that felt like a trap, India's Indian Cyber Crime Coordination Centre (I4C) sent GitHub an ultimatum: remove three repositories belonging to Bitchat within three hours. Not 72 hours. Not a court order. Just an administrative demand from an arm of the Ministry of Home Affairs. The repos? A Bluetooth mesh messaging app backed by Jack Dorsey, designed to work when governments turn off the internet. The reason? Public order — the same elastic phrase that has justified over one hundred internet shutdowns in India since 2012. The order came with a threat: comply, or face blocking in India. GitHub likely complied within the window. But here's the thing: deleting code from GitHub is about as effective as deleting a rumor from a village square. The code is already forked. The mirrors are live. The signal, however, is unmistakable. Bitchat is not a token project. It has no coin, no DAO, no liquidity pool. It's a pre-token, open-source mesh networking tool that uses Bluetooth to relay messages device-to-device, without a cellular network or internet connection. In a country where the central government selectively unplugs entire states, that feature is catastrophic to the authorities. The app was endorsed by Jack Dorsey, the high-profile Bitcoin advocate and Block CEO, who has been pushing an anti-censorship narrative since leaving Twitter's helm. Dorsey reportedly funded or supported the project, giving it a credibility boost. The I4C action came during the ongoing protests in Delhi over a new citizenship law, when internet throttling was already in force. Digital rights groups, including the Internet Freedom Foundation, immediately decried the order as unconstitutional, pointing to the Supreme Court's 2015 Shreya Singhal judgment which upheld Section 69A of the IT Act but mandated procedural safeguards: a written order, a reasoned conclusion, and the right to a hearing. A three-hour takedown bypasses all three. Now, let me stress-test the takedown itself. I've spent the last five years reverse-engineering DAO contracts and zk-circuits. I've seen how infrastructure dependencies kill projects. The Bitchat takedown is a textbook illustration of the platform choke-point problem. GitHub is a centralized entity. Microsoft owns it. When a foreign government makes a credible legal demand, the cost-benefit calculus for GitHub is simple: a three-hour compliance deadline, or a nationwide block. GitHub has no responsibility to Bitchat's users. It's a hosting service, not a free-speech champion. This is not a bug in the open-source model; it's a feature of platform capitalism. But here's the kicker: the takedown doesn't kill Bitchat. Code is not an idea; it's a set of instructions. Instructions can be copied. Forks of the repositories have likely already appeared on GitLab, Bitbucket, and anonymous mirrors. The technical folks know this. The I4C knows this. The order is not really about stopping the code; it's about signaling to developers and users that supporting Bitchat carries legal risk. It's a chilling effect, not an enforcement mechanism. Now the deeper regulatory pattern. This is not a crypto crime case. Bitchat has no token, no money laundering vector. It falls under the national security and public order jurisdiction — the most elastic and least reviewable categories in any legal system. This is the next frontier for crypto regulation: not financial rails, but communication rails. If the government can strong-arm GitHub into removing a mesh communication app, what's to stop it from ordering the same for a privacy-preserving zero-knowledge proof library? My experience auditing rollups taught me that every cryptographic tool is dual-use. A zk-verifier can be used to prove a loan is overcollateralized; it can also be used to prove you've paid a bribe without revealing the amount. The regulators are waking up to this. The Bitchat order is a warning shot at the entire Web3 infrastructure stack. Let's also look at the technical claims. Bitchat's core differentiator is works without the internet. That's a bold claim. Based on my familiarity with mesh networking — and from my own field tests with antenna arrays during a hackathon in Mexico City — Bluetooth mesh has a practical range of 10 to 100 meters per hop, with severe degradation in dense urban environments. The network-effect problem is brutal: if you and your two friends install Bitchat, you're not a network; you're a trio of disconnected Bluetooth beacons. You need a dense cluster of users, each with Bluetooth enabled, all within propagation range, with enough battery to relay messages. That's a non-trivial requirement. The I4C's obsessive targeting of Bitchat, however, suggests that some user base existed in Delhi. We don't have adoption numbers. We don't have the code audit. The narrative is running far ahead of verifiable facts. Proofs over promises — but neither the government nor the community has actually proved anything about Bitchat's effectiveness or security. The risk matrix is asymmetric. On the regulatory side, India's escalation path is predictable: next will be app stores, then the app's domain blocks, then possibly criminal liability for developers. On the technical side, the project's lifespan depends on its ability to migrate off GitHub, set up self-hosted Git instances, and potentially use decentralized hosting like Radicle. But here's the uncomfortable truth: most open-source projects without a legal entity or a foundation are badly equipped to respond to legal threats. Bitchat has no DAO, no foundation, no budget for lawyers. Jack Dorsey's endorsement is a double-edged sword. It brings attention; it also makes the project a high-value target. The Indian government is not trying to block a random hobby project; it's sending a message to Dorsey and his ilk. The contrarian angle is this: the Indian government's takedown order may be the worst thing that ever happened to Bitchat — because it will condemn the project to a life of underground utility. The digital rights community will embrace it, fork it, and celebrate it. But that same embrace will cement its identity as a protest tool, making it unpalatable for mainstream use in India. Meanwhile, the most robust censorship-resistant projects don't court controversy; they work quietly in the background. Signal doesn't need to be known as an anti-government app; it's just the default encrypted messenger. Bitchat's banned-by-India badge is a marketing win in the short term, but a strategic loss in the long game. It will scare off investors, complicate contributor onboarding, and make every code commit a jurisprudential adventure. If the founders want to win, they should de-brand from the protest narrative and focus on disaster-relief use cases, hurricane evacuation, earthquake communication. That's a use case governments can't easily demonize. What does this episode tell us? The era of code-is-speech is being tested in new jurisdictions. GitHub is not a neutral platform; it's a liability. Any project that stores its source on a single corporate server is one administrative order away from censorship. Trust is a bug — and trusting GitHub with your anti-censorship tool is the epitome of that bug. If it's not verifiable, it's invisible. We need to verify not just the cryptographic guarantees of mesh apps, but their infrastructure resilience. Bitchat may survive this takedown. The code will live on. But the real test isn't whether the code is still on GitHub; it's whether a teenage protester in Delhi can install the app without a VPN, without a mirror site operator, and without fear. That threshold is not something a three-hour order can reach. But it's also not something that a single GitHub repository can pass.