TECHNOLOGY & NATIONAL SECURITY
At 11:16 pm on 23 July, the Indian Cyber Crime Coordination Centre sent GitHub a notice numbered 11072601011432. It gave the platform three hours to disable three repositories belonging to BitChat, an open source messaging app that moves encrypted text between nearby phones over Bluetooth. Similar notices went to Google, told to pull BitChat, Briar and Bridgefy from the Play Store, and to Apple. MediaNama reported that telecom operators received parallel directions to block Bluetooth-enabled messaging apps and related URLs.
The following day, officials informed those same companies verbally that they need not comply. Nothing was withdrawn on paper.
Read the notice and one thing stands out. It names no unlawful post, no account, no message. It objects to how the software is built: no registration, no phone number verification, no central logging, no operator from whom subscriber records can be demanded. The offence is the architecture. That same architecture, communication that survives the loss of infrastructure, is a capability the Indian state is currently paying to acquire.
An order against a property
The notice was issued under Section 79(3)(b) of the Information Technology Act read with Rule 3(1)(d) of the 2021 intermediary rules, and referenced Sections 43, 84B and 84C of the IT Act alongside provisions of the Bharatiya Nyaya Sanhita. The Internet Freedom Foundation called it unconstitutional, arguing that Section 79 sets the conditions under which a platform keeps its safe harbour and hands the government no independent power to block, a reading the group traces to the Supreme Court in Shreya Singhal. IFF also invoked Anuradha Bhasin, noting that a three hour deadline issued near midnight leaves no room for the proportionality assessment the court required.
There is a blunter problem. Deleting a repository does not delete the application from a phone that already carries it, and a serverless mesh keeps forwarding messages regardless of what GitHub hosts. What the takedown actually removes is the source code, which is the part outside researchers can inspect.
The same property, procured
In October last year, the Indian Army signed its first contract for indigenously designed software-defined radios, developed by DRDO and produced by Bharat Electronics. The Army’s own account of the purchase highlighted mobile ad hoc network capability, which is mesh networking under a military name. Each radio is a node and a router. The network forms itself, heals around losses, and keeps working when fixed infrastructure is gone.
The property that the home ministry described as an impediment to lawful interception is, in a different building in the same capital, a procurement requirement. This is less hypocrisy than an unexamined split, and the line falls on who happens to be holding the device. The technology does not know the difference.
Chatroo, twice
Jammu and Kashmir has recorded roughly 449 internet suspensions since 2012 on the SFLC tracker, more than any other part of India. In late January, mobile internet was cut across three areas of Kishtwar district, Chatroo among them. On 1 August, a cloudburst tore through the Chatroo belt before dawn, blocking the Kishtwar to Sinthan highway and sweeping away vehicles and shops. In mid-July, between those two events, the administration suspended landline, mobile and broadband services across the whole of Doda for five days, and local reporting noted that UPI payments went down with the network.
The union territory has recorded 35 cloudbursts this summer with 31 deaths, concentrated in the Chenab valley, and power and communication were affected in several of the areas hit. This is the part of India where a phone-to-phone relay needing no tower has the clearest civilian case, and the part most likely to be inside a shutdown when that case arises.
The precedent is the product
The durable output of 23 July is not the fate of one messaging app. It is a template. If the objection is that a protocol has no operator to compel, the same reasoning reaches offline payment tools, self-hosted servers and any future protocol designed to work without permission. IFF’s second demand matters most: publish every direction issued under Section 79(3)(b), Rule 3(1)(d) and the Sahyog portal, with reasons recorded for each. An order sent in writing and cancelled by telephone cannot be counted, challenged or appealed. Enforcement without a record is enforcement without a ceiling.
There is an uncomfortable parallel. In April, the Cyberspace Administration of China had Apple remove BitChat from its store there, citing rules covering services with social mobilisation capability. India reached the same conclusion about the same application three months later through a different statute. Researchers who study platform regulation have long argued that blocking mechanisms converge on similar reasoning whatever the political system housing them.
The case for the notice
The counter argument deserves a hearing. Mesh messaging is genuinely attractive to organised crime and to armed groups, and in a region with an active insurgency the inability to attribute a message is no abstraction for the officer investigating it. Lawful interception has a statutory basis and a real purpose. Security researchers have publicly criticised Bridgefy’s cryptography, so official suspicion of the category is not invented.
The reply is that the notice fails on its own terms. It disables no mesh and removes no installed app. It reaches only the artefact that allows public scrutiny of the code, and it does so through an instrument the Supreme Court has read narrowly. A capability-based ban that leaves the capability intact buys nothing except precedent. Interception powers already exist under Section 69, with procedure attached. Reaching for the safe harbour clause instead trades review for speed.
Bottom Line
India is building a state that assumes connectivity for governance and disconnection as an instrument of order. Mesh networking sits precisely on that contradiction, which is why it drew a midnight order and an informal retreat inside eighteen hours. The government has not said the notice was wrong. It has said, off the record, that nobody needs to obey it. The reasoning survives, available for the next protocol that answers to nobody. Kashmir, which loses its networks to administrators and to weather alike, will be among the first to learn what that costs.
(The author studies Computer Science and Artificial Intelligence at Rutgers University, New Jersey, USA. He is interested in emerging technologies and innovation, and can be reached on LinkedIn at @arssh-kumar14)
