ivx 👾💀

A Certifying Authority used the number “4” as a private key. eMudhra’s weak keys could let fraudsters fake your bank’s website, padlock included. We’ve written to eMudhra, the Controller of Certifying Authorities and CERT-In asking for a fix. #eMudhra #Cybersecurity #DigitalIndia #InternetFreedom

The .IN Registry took chalosansad.in off the internet three days after it went live, without notice or reasons. The site was a fully sourced, non-commercial record of the NEET paper-leak protests and the “Chalo Sansad” march. On 14 October 2026, the Delhi High Court issued notice in Sriram Viswanathan v. National Internet Exchange of India & Ors. (1/7) Read More: internetfreedom.in/no-notice…

Delhi Police spent ₹161.27 crore on 34 signal jammers between July 2024 and May 2026, all bought from the public sector Electronics Corporation of India Limited on a nomination basis, without a tender. Three units of the force have given us RTI replies that contradict each other on what the jammers do and who can switch them on. The only rulebook they have named is one no citizen can read. (1/8) Read More: internetfreedom.in/delhi-pol…

Statement : The removal of BitChat from the India App Store is unconstitutional. Section 69A permits the blocking of unlawful information, not of a messenger for working during internet shutdowns. New Delhi, 3 October 2026 An Apple App Review notice published today by Jack Dorsey on X records that BitChat has been removed from the India App Store "per demand from the Ministry of Electronics and Information Technology", issued under Section 69A of the Information Technology Act, 2000, on the ground that the application "includes content that is illegal in India". The notice adds that BitChat's TestFlight builds are no longer available for testing in India. It does not identify the content said to be illegal or the ground under Section 69A invoked. The blocking order has not been published. The Internet Freedom Foundation condemns the order and calls for its immediate publication and withdrawal. BitChat relays end-to-end encrypted messages between nearby phones over Bluetooth mesh. It has no servers and hosts no content of its own. What travels through it is the private speech of its users, so the claim that the application "includes" illegal content is incoherent. The State's actual objection stands recorded in the notices the Indian Cyber Crime Coordination Centre issued on 23 July 2026 to GitHub, Google and Apple against BitChat, Briar and Bridgefy which stated that such applications work even during internet shutdowns and hamper lawful interception, attribution and traceability. Those notices, issued under Section 79(3)(b) were reportedly withdrawn after public disclosure. The same end has now been pursued through Section 69A. The objection is to capability of an application, not to content it transmits. A citizen's ability to speak to another citizen while the State has switched the internet off is not a ground of restriction under Section 69A or Article 19(2) of the Constitution. Section 69A survived constitutional scrutiny in Shreya Singhal v. Union of India (2015) because of its safeguards which included the need for a reasoned, recorded order, committee review, and a hearing to the originator under Rule 8 of the Blocking Rules, 2009, which the Delhi High Court enforced in Tanul Thakur v. Union of India (2022). Further, Anuradha Bhasin v. Union of India (2020) requires that orders restricting fundamental rights be published and adopt the least restrictive measure. However, it appears in this instance, each safeguard has been evaded. A secret order blocking an entire application, rather than any identified unlawful information, is the most restrictive and disproprotionate measure available. Further, the confidentiality claimed under Rule 16 cannot defeat the right to challenge an order, and the constitutionality of this blocking regime is itself pending consideration before the Supreme Court. While removal from the App Store does not delete BitChat from phones, it stops new downloads and security updates, leaving existing users on unpatched versions, and it ends security testing in India through TestFlight. During the Jantar Mantar protests, when mobile internet was suspended and jammers were deployed, Bluetooth mesh messaging was a channel of last resort through which young people coordinated their safety. To our knowledge, Apple has removed BitChat on a government's demand in only one other country. This is in China, in April this year. Our demands 1. MeitY must publish the blocking order, the ground invoked and the record of the committee's proceedings, and serve the developers with a copy and an opportunity of hearing. 2. The direction must be withdrawn. Any specific unlawful use must be met with targeted proceedings under due process, not the removal of a communications tool for everyone. 3. Apple must disclose the demand in its transparency reporting and notify its users in India, and must state whether parallel directions have been received in respect of other app stores. 4. The secrecy of the blocking regime must end. The Blocking Rules, 2009 should be amended to require publication of orders and notice to originators, without awaiting the outcome of the pending constitutional challenge. The Internet Freedom Foundation will file applications under the Right to Information Act seeking a copy of the order, and stands ready to assist the developers and affected users in India.

₹2 buys a stranger's home address. We tested a Play Store app with 10M+ downloads selling VAHAN/eChallan data, one number plate gave us the owner's full name, father's name, permanent address, insurance policy, chassis and engine numbers, all of which Parivahan masks behind an OTP. This isn't a hack. Researchers at Cyderes traced it to licensed API keys given to KYC companies, now resold on Telegram. IFF has written to MoRTH, NIC & CERT-In demanding a forensic audit, and filed RTIs on 22 Sept. Found your own data on these apps or similar website? Write to [email protected]