After restricting Nitter’s technical access, X Corp. sent lawyers after the code. On August 24, the company demanded permanent takedown of Nitter instances and the project’s repository, according to Nitter’s shutdown notice. TechCrunch reviewed the letter and reported that X accused the project of scraping data, circumventing its API, and accessing X accounts and session tokens against its rules.
The allegation about account sessions matters. Nitter was more than a cosmetic skin for a website. Recent versions used account sessions supplied by instance operators to request data from X. The legal status of that access is not settled by calling everything on X “public.”
X also demanded that the source repository disappear. The company wants the same veto over a GitHub repository that it has over an X account. Control of X’s computers does not confer control over software that other people write.
X has a real argument about access
Nitter let people read public X posts without running X’s JavaScript, loading its advertisements, or sending their browsers through its tracking stack. The project described itself as a privacy focused alternative front end with RSS feeds and a backend that handled every request to X.
The backend became the project’s legal vulnerability. TechCrunch reported that X’s restrictions broke guest access in 2024 and that later instances connected through real X accounts. Nitter documented how an instance operator could supply account session cookies. Its code maintained a pool of those sessions, attached authentication cookies and security headers, and tracked X’s rate limits. That is authenticated access through unofficial endpoints, even if the person running the instance created the accounts and supplied the credentials.
X’s current terms ban scraping without written permission. They also prohibit bypassing authentication, using unpublished interfaces, imposing an undue burden, and distributing tools that help someone violate those terms. X has a legitimate interest in protecting server capacity and account security. It can revoke sessions, block requests, enforce rate limits, and prove any damage it says Nitter caused.
The available record does not prove that Nitter stole tokens, flooded X, or damaged its systems. TechCrunch reported X’s allegations because the letter itself has not been published. Nitter’s code tracks rate limits, but code cannot tell us how much traffic public instances generated. The facts available today leave X’s claimed harm and Nitter’s full legal defense unresolved.
Code is a different target
A running Nitter instance sends requests to X. A repository sitting on GitHub sends none.
The repository contains a general purpose program under the AGPL free software license. People can inspect it, study it, change it, or adapt parts of it. X can close accounts and reject network traffic without requiring every copy of that program to vanish. Its demand for permanent removal turns a dispute over access into a claim of authority over publication.
The courts have already warned platforms against blurring those categories. In hiQ Labs v. LinkedIn, the Ninth Circuit held at the preliminary injunction stage that the federal computer hacking law’s ban on access “without authorization” did not cover information open to the public. The court did not bless every kind of scraping. Contract claims, authenticated access, deception, and actual harm remained separate questions.
A federal judge made the same distinction inside X’s own litigation. In a 2024 case against scraper Bright Data, Judge William Alsup separated access to X’s systems from copying public data. He recognized X’s right to deploy technical barriers, including CAPTCHAs and rate limits, while dismissing claims that failed to allege server harm or contract damages caused by the access. The order left X room to allege actual access damage. It treated server traffic, public information, and published software as different things.
Legal threats can do what lawsuits cannot
The project’s notice says development stopped while its operator seeks advice. XCancel, another service built on Nitter, posted that it also shut down after receiving a letter on August 24. The Nitter repository was archived and made read only on August 26, although it remains online.
The result arrived before a judge saw the evidence: two services offline, development stopped, and the repository frozen. A legal threat does not need a judgment to remove a tool from public use.
X has used contract and scraping claims this way before. In 2024, it sued the Center for Countering Digital Hate after the group used collected platform data in reports critical of X. Judge Charles Breyer dismissed the case, finding that the damages X sought flowed from the group’s speech rather than technological harm from scraping. X appealed, and the appellate briefing has concluded. Nitter is a different project with different access methods, so that ruling does not decide this fight. It shows why courts should demand evidence of computer harm instead of letting a platform convert disliked uses of public information into damages claims.
X wants every reader inside its system
X’s own terms say users retain ownership of their posts, while granting X a broad license to distribute them. Those same terms say the price of access includes advertising. Nitter gave readers a way to reach public posts without accepting that bargain in their own browsers.
Alternative front ends and RSS feeds let people read public statements without creating another profile, feeding another recommendation system, or accepting another layer of surveillance. They also make public posts easier to follow and archive after platforms redesign interfaces or close access. A company that hosts public discourse should expect the public to build tools around it.
X can fight unauthorized traffic at the access layer. It can terminate accounts, block requests, and bring a specific claim when it can prove deception or damage. Demanding deletion of the repository reaches for a much larger power: the power to decide which independent software may exist around a platform it happens to own.
A private company already controls the servers, the accounts, and the official interfaces. It should not control the code we are allowed to write about them too.