The I4C takedown order that requires GitHub to delete Bitchat’s code repositories not only rests on shaky law — it bans a piece of software because of what it might one day be used to do. Not only is this unfounded in law, it has backfired in ways that the Government did not anticipate.
At 23:16 on the night of 23 July, a nodal officer at the Indian Cyber Crime Coordination Centre (I4C) issued a takedown order to GitHub, giving the company just three hours to comply. While we have seen many such orders before, what was remarkable about this one was that, instead of identifying a message, post or piece of content to be taken down, it targeted the code repositories of a peer-to-peer messaging application called Bitchat.
Bitchat is an open-source application that lets phones communicate directly over Bluetooth. Messages hop from device to device even when none of them has access to a mobile network or wi-fi, with no need for a central server or for users to create accounts. A protocol like this is especially invaluable when communication infrastructure fails — in times of natural disaster or large-scale network outages. But it is precisely these features that the order objects to, asserting, in the process, a power it has no authority to invoke: the prohibition of an item of software because of what it might be used for.
Takedown
The order invokes Section 79(3)(b) of the IT Act—a provision that, on the face of it, confers no power to do anything. It is just a condition attached to a safe-harbour protection that says that immunity could be removed if an intermediary refuses to take down information that the government has notified them is being used to commit an unlawful act. Last September, the Karnataka high court changed that by holding that Section 79(3)(b) can be read with Rule 3(1)(d) of the IT Rules to operate as a takedown mechanism in its own right, creating a new procedure that runs parallel to that under Section 69A. While this ruling has been appealed to a division bench and will likely go all the way to the Supreme Court, this notice to GitHub seems to be the first significant action taken under this new interpretation.
To be successful, such a takedown order must show that the information in question (in this case, the Bitchat source code) is being used to commit an unlawful act. For that, it has to identify both the act in question and the law under which committing it would be illegal. The I4C notice does no such thing. Instead, it points to the fact that Bitchat relays messages over a Bluetooth mesh without phone numbers, servers or logs, and treats the fact that these features prevent lawful interception and attribution as itself unlawful. But this identifies no act that is being committed—and there is no legal requirement that a communication tool must be designed to enable interception.
In the case of Shreya Singhal vs Union of India, the Supreme Court specifically read down Section 79(3)(b) to state that it can apply only in respect of unlawful acts relatable to Article 19(2)—the reasonable restrictions on the fundamental right to speech and expression. These restrictions make no mention of restricting the instruments by which speech is transmitted.
A Tool Not a Crime
I am more concerned about this direction of travel and all that it implies than the shaky foundations on which the order rests. The fact that a tool can be misused has never been reason enough to ban it. A knife can be used to slice a fruit and slit a throat, but we have never seen it fit to ban the use of knives for that reason. Instead, we prosecute those who use the knife to commit a crime. Along similar lines, we should not be banning Bitchat, but instead the people who use it to carry out an unlawful act.
Since Puttaswamy, privacy has been the rule and surveillance the exception, permitted only where it is legal, necessary and proportionate. This order reverses that priority. It proceeds on the presumption that we owe the state an architecture it is able to listen in on.
If software can be taken down merely because it possesses features that are “capable of being exploited” to evade surveillance, where will this line of reasoning end?
Virtually every general-purpose technology can be put to an unlawful use. A courier service, the railway network, even the electricity grid that charges the phone on which an offence is composed, can each be used to carry illegal goods or in the commission of an unlawful activity. By the logic of this order, since every one of them sits upstream of some potential crime, they are all fair game.
Own Goal
The irony is that deleting the repository will achieve nothing. Bitchat code is open source and has already been mirrored and forked widely around the world. If GitHub complies with the order and deletes the repositories, they will continue to live on various alternative sites that are trivial to access. The app itself is already on phones, and since it operates on a mesh network, there is no central server to switch off.
India accounted for about 85% of Bitchat’s global downloads between 17 and 23 July, compared with about 1% over the previous 30 days, with daily downloads jumping an extraordinary thirty-two-fold on 19 July. That surge was already underway before the notice went out. The I4C order will likely accelerate it.
There is a phenomenon called the Streisand Effect—named after the actor whose attempt to suppress a photograph of her home only drew the world’s attention to it. It describes how attempts to hide, remove or censor information often have the unintended consequence of increasing public awareness of that information.
That is what will happen with this I4C notice. And it might go down as the biggest own goal in the history of Indian technology regulation.