The Protocol Always Wins
by Kudzai Kutukwa on 2026-07-25 19:01
On July 23, 2026, India's Cyber Crime Coordination Centre (I4C), operating under the Ministry of Home Affairs, sent a takedown order to GitHub. It gave Microsoft's code-hosting subsidiary three hours to strip three repositories from public view or risk losing its intermediary liability protections under Indian law. The repositories belonged to Bitchat, a Bluetooth-mesh messaging app built by Jack Dorsey and open-source developer Calle. Interestingly the government did not publish this order publicly.
The world learned of it from a post by Jack Dorsey, who uploaded the notice to X with a simple statement, "The Government of India does not like technologies like BitChat and wants it taken down". What followed is a case study in why states can ban apps but cannot ban protocols and why that distinction is going to define the next decade of the fight between digital sovereignty and state power.
Why Bitchat Scared The State
The timing of this ban was definitely not a coincidence. For weeks India had been rocked by the largest* student protests it had seen in years at New Dehli’s Jantar Mantar, organized by the satirical Cockroach Jantar Party (CJP) who were furious over leaked NEET medical entrance exam papers and what they view as systemic corruption. They are demanding the resignation of the Minister of Education and education reforms, among other things. As always, the government’s response to the protests was predictable as they cut off internet access within the protest zones.
Once cellular data went dark, protesters didn't go quiet but they immediately switched to Bitchat and similar offline tools like Briar. The numbers do tell an interesting story as India accounted for roughly 85% of Bitchat's global downloads in the week leading up to the ban, compared to about 1% in the prior month. Downloads jumped thirty-two-fold in a single day. A tool built for disaster resilience became, overnight, the nervous system of a leaderless protest movement and that is precisely what made it intolerable to the state. Bitchat wasn’t targeted for hosting illegal content of any kind, but for enabling communication "even during network restrictions" and of undermining "lawful interception, attribution, and traceability." In other words: the crime wasn't anything said on Bitchat. The crime was that the state couldn't listen in.
To understand why, you have to understand what Bitchat actually is. It isn't a server, an app in the conventional sense, or a company with a headquarters to raid. It's a peer-to-peer Bluetooth mesh network, every phone running the software becomes both a message sender and a relay node, hopping encrypted packets from device to device until they reach their destination, entirely without internet infrastructure.
The Indian government’s ban stems directly from the Information Technology (IT) Rules, 2021, which mandate that "significant social media intermediaries" must possess the technical ability to identify the "first originator" of a message upon the request of law enforcement. The stated motivation is national security and the prevention of crimes ranging from terrorism to the spread of disinformation. BitChat’s architecture makes compliance with this traceability mandate fundamentally impossible. The protocol is designed so that only the intended recipient holds the keys to decrypt the message.
The routing nodes, whether they are other users in the mesh or decentralized relays, see only encrypted ciphertext. This ban was an indirect admission of the fact that the Indian government’s surveillance apparatus is powerless against genuine cryptography. BitChat was a threat not because it facilitates crime, but because it facilitates privacy. That doesn’t mean Bitchat is invincible, but it’s censorship resistant enough to warrant such a ban.
The State of Speech: Censorship in the “World's Largest Democracy”
India’s digital landscape is undergoing a severe contraction in free expression. While the *Constitution guarantees freedom of speech under* Article 19(1)(a), the sweeping exceptions carved out for "public order" and "national security" have been increasingly weaponized to stifle dissent.
Historically, Delhi has leaned on *Section 69A )of the IT Act and the 2009 Blocking Rules a process, however imperfect, that at least nominally involves review committees and documented justification for blocking specific content. This time, the I4C invoked* Section 79(3)(b) )and *Rule 3(1)(d), provisions aimed at intermediary liability, to order the removal of software itself rather than any unlawful content or specific illegal use. Digital rights groups, including the *Internet Freedom Foundation (IFF) and the *Software Freedom Law Centre India, have called the order unconstitutional and argued it bypasses the legal process altogether. Mishi Choudhary of SFLC.in put it starkly: there is no law that clearly grants the government this power, and Bitchat itself broke no law, it's a tool, and holding a tool's maker responsible for how it's used sets a precedent that would make every software company in the world liable for the actions of its users.
By banning tools that guarantee anonymity, the state is not protecting the marketplace of ideas; it is consolidating a monopoly over it. Anonymous speech is the bedrock of whistleblowing and political dissent. Without the shield of anonymity, the speaker becomes the target. The ban is an architectural weapon designed to ensure that all digital discourse occurs on platforms where the state retains a master key.
Protocols > Platforms
Platforms like X, WhatsApp, or YouTube are Web2 constructs. They are centralized, corporate-owned, and rely on client-server architecture. They have terms of service, terms that can be unilaterally changed, and physical servers that can be seized. Platforms are inherently censorious because they have a single point of failure: the company itself, which can be coerced by state actors through fines, threats of imprisonment, or outright bans.
Protocols, on the other hand, are just sets of rules. Bitcoin is a protocol and Nostr is a protocol. They are distributed, open-source, and rely on peer-to-peer consensus. A protocol has no headquarters, no board of directors, and no compliance department. You cannot send a cease-and-desist letter to an algorithm. You can order GitHub to pull three repositories, but you most certainly can’t order the Bluetooth radios in ten million phones to stop talking to each other, and you cannot un-download an APK that's already on a device.
This is the same lesson Bitcoin taught the financial world, that while you can ban an exchange, but you can't ban a protocol running on tens of thousands of independent nodes. Within hours of the GitHub order, Bitchat's code was already mirrored across other hosts, personal servers, and torrents. This is the entire point of open-source licensing and distributed version control; the code doesn't live in one place, it lives everywhere it's been cloned. A state can win a battle against one host but it cannot win a war against a codebase with a thousand copies.
Back in September last year, Nepal banned two dozen social platforms and protesters responded the same way as those in India, with nearly 49,000 Bitchat downloads in a single day in Kathmandu, coordination that outlasted the ban and, weeks later, a government. India will find that banning Bitchat doesn't remove Bitchat; but it only neuters a single distribution channel while pushing users toward mirrors, sideloading, and alternative mesh tools like Briar. Every takedown teaches developers where the next chokepoint is, and the next version routes around it. The deeper issue here isn't Bitchat, or even India. It's the growing global instinct to treat private, unmonitored communication as inherently suspicious rather than as a baseline civil liberty.
Tools that restore that right online aren't loopholes in law enforcement; they're a correction to a decade in which "communication" quietly became synonymous with "surveilled communication." When a government's objection to a tool is that it can't be intercepted, rather than that it's being used for anything unlawful, is the state admitting its actual concern is visibility, not crime.
Privacy is not about concealing wrongdoing, but about preserving your personal autonomy and human dignity. When the state and its partners can read your messages, they can preempt your actions, freeze your assets, and crush any dissent. Preserving privacy in our communication tools is the only way to maintain a power equilibrium between the governed and the governing.
Why Bitchat and Bitcoin Matter
Ultimately, the fight over BitChat is the exact same fight we are waging over Bitcoin. They are two sides of the same cypherpunk coin. Bitchat and Bitcoin share a common thesis which is that critical infrastructure for money and speech; should not have an off switch controlled by a single authority. Both are censorship-resistant not because they hide from the law, but because they don't require permission to function.
Bitcoin doesn't ask a bank if a transaction may clear; Bitchat doesn't ask a telco if a message may send. That's exactly why they attract state hostility during moments of unrest, and exactly why they matter most in those moments. The Indian government’s ban on BitChat is a localized battle in a global war. It is a reminder that states will never willingly relinquish their surveillance capabilities. The protocol always wins not because it's invincible, but because it was never built to depend on anyone's permission in the first place. BitChat is not the last word in decentralized communication. It is simply one iteration of a pattern that will continue to evolve and spread.