A 3-hour takedown hit GitHub in 2026: the safe-harbour engineering checklist

Summary. At 11:16 pm on 23 July 2026 the Indian Cyber Crime Coordination Centre, part of the Ministry of Home Affairs, sent GitHub a notice under Section 79(3)(b) of the Information Technology Act, 2000 read with Rule 3(1)(d) of the IT Rules, 2021, requiring three repository URLs to be disabled within 3 hours, "without vitiating the evidence in any manner." GitHub disabled the links. The statutory deadline is 36 hours, set by a MeitY amendment notified on 22 October 2025 and effective from 15 November 2025, and missing it costs safe harbour under Section 79(1). The same amendment restricts who may issue a notice to an officer not below Joint Secretary rank, or a police officer not below Deputy Inspector General, and requires each notice to name the statutory provision and the exact URL. In September 2025 the Karnataka High Court upheld the Sahyog Portal and held that intermediaries cannot decide for themselves whether flagged content is lawful. Platforms crossing 50 lakh registered users take on three India-resident officers, a 24-hour acknowledgement clock and a 15-day grievance disposal clock. The engineering problem is that a legal deadline measured in hours cannot be met by a process measured in business days.

What a Section 79(3)(b) notice actually is

Section 79(1) of the IT Act gives an intermediary immunity from liability for third-party content. Section 79(3)(b) removes that immunity if the intermediary, on receiving actual knowledge, fails to expeditiously remove or disable access to the material. The notice is not a court order and it is not a blocking order. It is a statement that the clock on your immunity has started.

Rule 3(1)(d) of the IT Rules, 2021 operationalises it. MeitY replaced that rule through an amendment notified on 22 October 2025, effective 15 November 2025. Under the replacement, "actual knowledge" arises in exactly two ways: an order of a court of competent jurisdiction, or a reasoned intimation in writing from an authorised government officer. The intermediary must act within 36 hours of receiving it.

The amendment added three constraints on the sender that matter operationally, as MediaNama reported on 23 October 2025. The officer must be "not below the rank of Joint Secretary or an officer equivalent in rank," and a police officer performing the role must be "not below the rank of Deputy Inspector General of Police." Each intimation must "clearly specify the legal basis and statutory provision invoked, the nature of the unlawful act, and the specific uniform resource locator, identifier or other electronic location." All intimations are subject to monthly review by an officer not below Secretary rank of the appropriate government, tested against whether the order was "necessary, proportionate, and consistent" with Section 79(3)(b).

Those three constraints are your validation schema. A notice that lacks a statutory provision, a specific URL, or an identifiable authorised signatory is defective on the face of the rule. Whether you act on it anyway is a legal call, but your intake system should be able to tell you which fields are missing inside a minute.

The GitHub notice, and why 36 hours is the wrong number to design for

The I4C order to GitHub on 23 July 2026 named three URLs: the Bitchat repository, the Android repository, and the Android releases page. It invoked Section 79(3)(b) with Rule 3(1)(d), and cited Section 43 of the IT Act on unauthorised access and disruption, Sections 84B and 84C on abetment and attempt, and Sections 61, 196 and 197 of the Bharatiya Nyaya Sanhita, 2023. Its stated grounds included anonymous communication without mandatory registration or phone verification, an architecture that impedes lawful interception and attribution, and the absence of a centralised service provider from which subscriber information could be obtained.

The compliance window given was 3 hours, reported by MediaNama on 24 July 2026, and the notice went out at 11:16 pm.

Take the operational lesson rather than the constitutional one. The rule says 36 hours. A real order arrived just before midnight with a 3-hour window. If your on-call rota for legal notices is a shared inbox that a compliance analyst reads at 10 am, you did not have 36 hours and you did not have 3. You had none.

Design for the worst case that has actually occurred: a notice landing outside business hours, in a timezone your team is not awake in, naming URLs that must be disabled and evidence that must be preserved at the same time.

Section 79(3)(b) versus Section 69A versus a court order

These three instruments look similar from the outside and behave differently in your systems. Confusing them is the most common design error.

Dimension	Section 79(3)(b) with Rule 3(1)(d)	Section 69A blocking	Court order
What it does	Starts the clock on losing safe harbour	Directs blocking of information	Directs removal or disclosure
Who may issue	Officer not below Joint Secretary, or police not below DIG	Authorised officer under the Blocking Rules, 2009	The court
Deadline	36 hours from receipt	As specified in the direction	As specified in the order
Required contents	Statutory provision, nature of the unlawful act, specific URL	Reasons recorded, procedural safeguards including notice	The order text
Consequence of ignoring	Loss of safe harbour under Section 79(1)	Statutory penalties	Contempt
Public visibility	Low; the Sahyog Portal coordinates these	Blocking orders historically confidential	Usually on record

MediaNama noted that the government continues to treat the two IT Act mechanisms as distinct, which lets removal directions issue under Section 79 without the more procedurally demanding Section 69A route. SFLC.in argued that Section 79(3)(b) intimations are effectively binding because non-compliance costs safe harbour, and called the arrangement a parallel enforcement regime unsupported by law.

Your intake pipeline should classify the instrument before it routes the work, because the evidence, timing and reinstatement paths differ for each.

What the Karnataka High Court settled, and what it did not

In September 2025 the Karnataka High Court dismissed X's petition challenging the Sahyog Portal, the government system used to coordinate Section 79(3)(b) notices. The court held that nodal officers were "not dropping from the air but emanate from statutes," that Section 79(3)(b) and Rule 3(1)(d) are valid, and that the word "unlawful" is sufficiently qualified by "under any law for the time being in force."

Two holdings bind engineering directly. First, the court said intermediaries cannot independently decide the legality of content once a lawful order arrives from a court or the government, and that compliance is mandatory for retaining safe harbour. Second, it said the Shreya Singhal v. Union of India judgment of 2015, which limited intermediary liability under the earlier rules, does not directly apply to the 2021 framework.

Pranesh Prakash, policy expert at Anekaanta, criticised the judgment for not addressing whether the Sahyog Portal is consistent with the IT Act and with the limits on restricting expression under Articles 19(1)(a) and 19(2). X has signalled a challenge before the Supreme Court. Treat the current position as settled for planning purposes and reversible for risk purposes: build the capability, and keep records good enough to support a later argument that you complied under protest.

The intake pipeline: what to build

A takedown intake is a small system with hard latency requirements. Six components carry it.

An always-on ingress. One published address that routes to a paging rota, not a mailbox. The Sahyog Portal, email, physical service and a court registry all deliver into the same queue. Anything that can only be read during office hours is not ingress.

A validator. On receipt, extract and check the fields the amended rule requires: the statutory provision invoked, the described unlawful act, the specific URL or identifier, and the issuing officer's designation. Record which fields are absent. This is a five-field parse, not a machine learning problem, and it is the difference between a defensible response and an improvised one.

A clock. Start a timer at receipt, not at triage. Render both the 36-hour statutory deadline and any shorter deadline stated in the notice, in Indian Standard Time, on a surface the on-call engineer sees. The GitHub notice shows why: a 3-hour window that starts at 11:16 pm expires before most teams wake up.

A disable path that is not a delete path. The obligation is to remove or disable access. Preserving the evidence is a separate and simultaneous obligation, and the GitHub notice made it explicit with the phrase "without vitiating the evidence in any manner." Deleting the row satisfies the first and destroys the second. Build a state transition that hides content from serving, snapshots the object and its metadata to immutable storage, and records who triggered it and when.

Granularity control. Notices name specific URLs and identifiers. Your system needs to disable exactly those and nothing more, at the correct scope. If you can only take down a whole account when the notice names one post, you will over-comply, and over-compliance is its own liability with users and with the market.

An audit log you would hand to a regulator. Notice received, fields parsed, decision taken, action executed, evidence snapshot reference, reinstatement if any. Append-only. This is the same discipline that a DPDP-ready build needs for consent and erasure records, and teams that have already done that work will recognise the shape. The DPDP Act engineering playbook covers the storage side of it in more detail.

The additional obligations if you cross the threshold

The government set 50 lakh registered users as the threshold for a significant social media intermediary. Above it, the platform appoints a chief compliance officer, a nodal contact person and a resident grievance officer, all resident in India, and publishes a monthly compliance report including details of content removed proactively.

The grievance clocks are separate from the takedown clock and often forgotten in system design. Complaints are acknowledged within 24 hours and disposed of within 15 days. Content involving private sexual imagery, impersonation or morphed images carries a 24-hour removal obligation.

Three clocks running against the same content store, with different triggers and different owners, is a scheduling problem. Model it as one work queue with a deadline field and a source field rather than three services that each learned about the content separately.

Practical checklist

Control	What good looks like	Common failure
Ingress	Paging rota, 24x7, single queue for all legal channels	Shared inbox read in business hours
Validation	Five required fields parsed and logged per notice	Notice forwarded as a PDF attachment with no structured record
Timing	Timer starts at receipt, shows IST, shows the shorter of statutory and stated deadline	Timer starts at triage
Action	Disable serving, preserve object and metadata immutably	Hard delete, or soft delete with a mutable row
Scope	URL-level and identifier-level disable	Account-level ban as the only lever
Geography	India-only disable where the order is India-specific	Global removal by default
Record	Append-only audit trail with evidence reference	Ticket comments
Grievance	24-hour acknowledgement, 15-day disposal, published officer details	Support inbox with no SLA
Review	Monthly reconciliation of notices received, actioned and reinstated	No reconciliation

Geography deserves a note. Where an order is India-specific, an India-only restriction is usually the proportionate response and the one that limits collateral damage to users elsewhere. That requires your content service to support jurisdictional visibility rules as a first-class concept, not as a CDN hack. Retrofitting it under a 3-hour deadline is not an option.

India-specific considerations

Personal data flows through this process constantly. A takedown notice names users, and the evidence snapshot you preserve may contain personal data that the Digital Personal Data Protection Act, 2023 governs. Preservation for a legal obligation and minimisation for privacy pull in opposite directions, and the resolution is scope: preserve precisely what the notice covers, with a retention rule and an access log, rather than a broad export. Teams working through the cost of DPDP compliance will already have the retention machinery to reuse.

Code hosting is now in scope. The Bitchat order was served on a source code repository, not a social platform. Any Indian company hosting user-submitted artefacts, whether that is a package registry, a template gallery, a plugin marketplace or a customer file store, is an intermediary for this purpose. The distinction that mattered ten years ago, between social media and everything else, does not hold.

Adjacent obligations are arriving on the same rails. MeitY has been consolidating regulation inside the IT Rules rather than passing standalone law, including proposals on synthetically generated information aimed at deepfakes and AI-generated content. If you are building the intake pipeline now, build it to accept new notice categories, because more are coming. Our analysis of India's IT rules on deepfake takedown and AI labelling covers that thread.

Regulated sectors stack their own timelines on top. A lending or payments platform already carries reporting duties that assume 24x7 operations, which is why the RBI digital lending engineering checklist and this one tend to be built by the same team.

What to do in the first week

1. Publish and test one legal-notice ingress that pages a human at 2 am.
2. Write the five-field validator and log every notice through it, including ones you receive today.
3. Separate disable from delete in the content service, with an immutable evidence snapshot.
4. Add jurisdictional visibility to the content model if it is not there.
5. Stand up the append-only audit log before you need to produce it.
6. If you are near 50 lakh users, appoint the three India-resident officers and start the monthly report.
7. Run a drill: a notice at 11:16 pm with a 3-hour window, and measure the real time to disable.

Step 7 is the one that finds the gaps. Every organisation believes it can act inside 36 hours until it measures the path from an email arriving to a URL going dark.

FAQ

What is Section 79(3)(b) of the IT Act?

It is the provision that removes an intermediary's immunity for third-party content if, on receiving actual knowledge, the intermediary fails to expeditiously remove or disable access to the material. It is not a blocking order. It starts the clock on losing safe harbour granted under Section 79(1) of the Information Technology Act, 2000.

How long does a platform have to comply?

Thirty-six hours from receipt, under Rule 3(1)(d) of the IT Rules, 2021 as replaced by the MeitY amendment notified on 22 October 2025 and effective 15 November 2025. Actual orders have demanded faster action: the notice served on GitHub on 23 July 2026 required three URLs to be disabled within three hours.

Who is allowed to issue a takedown intimation?

Under the amended rule, a government officer not below the rank of Joint Secretary or equivalent, or a police officer not below the rank of Deputy Inspector General. A court of competent jurisdiction may also create actual knowledge by order. Each written intimation must name the statutory provision, the unlawful act and the specific URL or identifier.

Does this apply to platforms that are not social media?

Yes. The order served on GitHub in July 2026 concerned source code repositories. Any service hosting third-party content can be an intermediary. Package registries, template galleries, plugin marketplaces and customer file stores fall in scope. Additional obligations attach only above the significant social media intermediary threshold of 50 lakh registered users.

What extra duties come with 50 lakh users?

A significant social media intermediary appoints a chief compliance officer, a nodal contact person and a resident grievance officer, all resident in India, and publishes a monthly compliance report including content removed proactively. Grievances are acknowledged within 24 hours and disposed of within 15 days.

Can we decide a notice is wrong and ignore it?

The Karnataka High Court held in September 2025 that intermediaries cannot independently decide the legality of content once a lawful order arrives from a court or the government, and that compliance is mandatory for retaining safe harbour. The court also held that Shreya Singhal v. Union of India, 2015 does not directly apply to the 2021 framework.

What does preserving evidence mean in practice?

The order served on GitHub required action "without vitiating the evidence in any manner." Operationally that means disabling access is not deletion. The content object, its metadata and the surrounding context are snapshotted to storage that cannot be altered, with the action, the actor and the timestamp recorded alongside the notice reference.

How does this interact with the DPDP Act?

Takedown notices name users, and preserved evidence can contain personal data governed by the Digital Personal Data Protection Act, 2023. Preservation for a legal obligation and data minimisation pull against each other. The workable answer is narrow scope: preserve only what the notice covers, with a retention rule and an access log rather than a broad export.

How eCorpIT can help

eCorpIT is a Gurugram technology consultancy founded in 2021, certified at CMMI Level 5 and ISO 27001:2022 and registered as an MSME, with senior engineering teams that build content platforms, marketplaces and regulated products for Indian and global companies. We build legal-notice intake pipelines, evidence-preserving disable paths, jurisdictional visibility in content services and the append-only audit trails a regulator would accept. We design systems aligned with IT Act, IT Rules 2021 and Digital Personal Data Protection Act requirements, and we run the drills that show whether a stated deadline can actually be met. If you host third-party content in India, talk to our team about a readiness review before the first notice arrives.

Related reading: DPDP-ready app development and the corporate IT compliance auditing guide.

References

1. GitHub takes down BitChat after Home Ministry order - MediaNama, 24 July 2026.
2. Govt tightens content takedown rules for online platforms: 36-hour deadline, officer rank now specified - MediaNama, 23 October 2025.
3. Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 - Ministry of Electronics and Information Technology.
4. Section 79 of the Information Technology Act, 2000 - Indian Kanoon.
5. Section 43 of the Information Technology Act, 2000 - Indian Kanoon.
6. The Bharatiya Nyaya Sanhita, 2023 - India Code.
7. Why the Karnataka High Court rejected X's allegations on the Sahyog Portal - MediaNama, September 2025.
8. Amendment to Rule 3(1)(d) of the IT Rules, 2021: a step towards greater accountability in takedown orders - Lexology.
9. The 3-hour takedown: how India's new IT rules are reshaping the digital battlefield - Legal Service India.
10. Non-compliance with Section 79(3)(b) content takedowns more serious than Section 69A, says X - MediaNama, July 2025.
11. Govt sets 50 lakh users threshold to define significant social media intermediary under IT rules - The Tribune.
12. IT Rules: Govt sets 50 lakh users threshold to define significant social media intermediary - Outlook India.
13. X relies on Shreya Singhal in arbitrary content-blocking case in Karnataka HC - Supreme Court Observer.
14. India orders takedown of Jack Dorsey's bitcoin-linked messaging app Bitchat - CoinDesk, 24 July 2026.

Last updated: 4 August 2026.