Bangladesh is rebuilding the Digital Security Act under another name

In late April, Bangladesh's Parliament passed the Cyber Protection Act, 2026, replacing an ordinance introduced by the interim government a year earlier. The legislation was supposed to mark a departure from a period in which laws governing the internet had become instruments of political control.

The Digital Security Act of 2018 had been used against journalists, students, activists and ordinary Facebook users. Its replacement, the Cyber Security Act of 2023, retained much of the same architecture. After the July uprising, the interim government promised to dismantle that system.

Less than six months after Parliament passed the new law, the government is preparing to restore some of its most controversial provisions. The first amendment, adopted in June, attracted little controversy. It removed provisions on online gambling because a separate law now covered the offence.

The second set of amendments is considerably more consequential.

Published by the ICT Division in mid-September for public consultation, and now under consideration by a cabinet committee, the draft would introduce new offences involving online speech, increase prison sentences and expand the authority of government agencies to enforce the law.

The government's stated concerns are legitimate. False information can provoke violence. Artificial intelligence has made it easier to fabricate convincing images, audio and video. Coordinated campaigns can destroy reputations and inflame communal tensions.

But the question is not whether these problems exist. It is whether a cybersecurity law should be used to determine what citizens are permitted to say.

The proposed amendments suggest that the government has confused two fundamentally different responsibilities: protecting people from cybercrime and policing their speech.

A cybersecurity law that criminalises speech

The difference matters because the Cyber Protection Act already defines what it is supposed to protect.

Its definition of cyber protection covers the security of digital devices, including computers, tablets, smartphones and wearable technology. It extends to computer systems, data, signalling information, traffic data and physical infrastructure such as data centres and cloud services.

The definition also covers personal, institutional, financial and commercial information, as well as software, application programming interfaces, source code, algorithms and artificial intelligence tools.

It requires that access to digital systems and networks be restricted to authorised users, including authorised AI agents operating within specified limits. It also recognises citizens' right to uninterrupted internet access.

These provisions address identifiable threats: hacking, phishing, identity theft, financial fraud, malware, spyware, ransomware, cyber extortion and unauthorised surveillance.

They concern the security of information and the systems that contain it. They do not establish a mandate for the government to determine whether a news report is sufficiently verified or whether a statement is derogatory.

Yet that is precisely where the proposed amendments are headed.

The draft would introduce Section 26A, making the publication or circulation of a "rumour" or "disinformation" a criminal offence. The maximum punishment would be 10 years in prison, a fine of 40 lakh taka, or both.

It would also rewrite Section 25 to restore offences involving digital defamation and derogatory content, including material produced using AI-generated audio, images or video. The proposed maximum punishment is five years in prison and a fine of 20 lakh taka.

Where the alleged victim is a woman or child, those penalties could double.

The amendments would also allow mobile courts to handle certain offences involving defamation, humiliation and bullying. They would bring the Ministry of Information and Broadcasting and unspecified "authorised agencies" into enforcement.

Press freedom organisations have additionally warned that the proposed framework could allow courts to suspend or cancel the licence of a news organisation convicted under the law.

The home minister has separately indicated that platforms such as Meta could face stricter requirements to remove harmful content within specified periods.

Some of these questions deserve serious regulatory consideration. But they should not be treated as interchangeable.

A platform's obligation to respond to a lawful takedown order is different from the state's authority to imprison someone for publishing information it considers unverified.

The proposed definition of "rumour" illustrates the danger. It covers unsubstantiated or unverified information, news or claims that create, or risk creating, confusion, panic, unrest or social instability.

The definition does not require the information to be false. Nor does it require the person publishing it to have intended to deceive anyone. It is enough that the information has not been verified and is considered capable of causing public anxiety.

Consider an ordinary reporting situation.

A bank has begun restricting withdrawals. Customers gather outside a branch. A photograph of the queue appears on Facebook before the bank issues a statement.

The photograph may be genuine and the complaints may be accurate. But the underlying circumstances have not yet been independently established. Could the post be considered an unverified claim likely to cause panic?

Under the proposed language, that possibility cannot be dismissed.

The same problem arises when workers complain about unpaid wages, patients report being denied treatment during a dengue outbreak, or journalists publish allegations based on confidential sources.

Many important stories begin with claims that powerful institutions refuse to confirm. Verification is a process, not always a condition that can be satisfied before publication.

Some of Bangladesh's major banking scandals first entered public discussion through allegations that were disputed or difficult to verify. A law that criminalises potentially alarming, unverified information could have discouraged those disclosures.

The draft separately defines "disinformation" as false or misleading content deliberately circulated to deceive or cause harm. Unlike the rumour provision, this at least introduces questions of falsity and intent.

But that does not resolve the larger problem.

Deliberate incitement to violence can already be addressed through existing criminal law. Defamation has its own legal remedies. Neither requires the state to convert a law protecting digital infrastructure into a general instrument for regulating public discussion.

The interim government's 2025 ordinance removed nine provisions associated with abuse under earlier cybersecurity legislation. Digital defamation was among the most consequential.

Its removal reflected years of experience.

Under the Digital Security Act, politically connected complainants could initiate cases in distant districts, forcing journalists and critics to travel repeatedly, seek bail and endure prolonged proceedings.

A conviction was not necessary for the law to impose a substantial cost. The proposed return of digital defamation would restore that risk. An analysis by The Daily Star found that some of the proposed penalties were harsher than those under the Digital Security Act.

The addition of an undefined or loosely defined category of derogatory content would create further uncertainty.

Bangladesh already provides civil remedies for defamation and contains relevant provisions in the Penal Code. There is no convincing reason to create an additional cyber offence carrying a substantial prison sentence.

The powers that make the draft dangerous

Two procedural changes deserve particular scrutiny.

The first is the proposed use of mobile courts. Mobile courts are designed to deal with offences that can be established relatively quickly, such as certain violations involving food safety or commercial regulation. They operate through executive magistrates and summary procedures. Online speech rarely presents such straightforward questions.

A statement may be offensive without being defamatory. A damaging allegation may be true. A misleading post may have been shared without knowledge of its inaccuracy. Political criticism may be harsh but still protected.

Determining criminal liability requires an assessment of context, evidence, intent, truth and public interest. These are matters for an independent judiciary, with adequate procedural safeguards. They should not be resolved through summary proceedings conducted by executive magistrates.

The second concern is the proposed expansion of enforcement authority.

The Ministry of Information and Broadcasting already exercises regulatory influence over the media. Giving it an additional role in policing online expression would concentrate further authority over the press within the executive branch.

The reference to unnamed "authorised agencies" is equally troubling. Citizens should know which institutions possess the power to investigate their speech, seek restrictions on publication or initiate enforcement action.

The possibility of suspending or cancelling a news organisation's licence would make the problem more serious. A media outlet investigating a government ministry could find itself exposed to criminal proceedings and potential licensing consequences under a law administered partly by the executive.

Such powers do not have to be exercised frequently to influence editorial decisions. Their existence can be enough. Bangladesh has already seen how that works.

Between 2018 and 2023, at least 255 journalists faced cases under the Digital Security Act. Writer Mushtaq Ahmed died in custody after spending approximately nine months in pretrial detention. Teenagers were arrested over Facebook comments.

The law's impact extended beyond those prosecuted. Journalists and ordinary citizens learned to calculate the legal consequences of publishing criticism.

The lesson should not be reduced to the conduct of a single administration. Broadly drafted speech offences are susceptible to abuse regardless of which party controls the government. Powers created by one administration remain available to its successors.

That is why institutional safeguards matter more than assurances about how responsibly a particular government intends to exercise its authority.

The objections to the current draft are substantial. Transparency International Bangladesh has warned that expressions such as "rumour", "demeaning" and "insulting to the state" could facilitate selective enforcement.

International human rights organisations have jointly called for the withdrawal of the proposed provisions, citing risks associated with pretrial detention and the criminalisation of expression.

At a government consultation on September 28, senior editors warned that the amendments, unless substantially revised, could turn the country into a large prison. 

These concerns extend beyond journalists and political activists.

For more than two decades, I have worked in Bangladesh's digital industry. Much of that industry depends on ordinary users being able to exchange information about people, businesses and institutions.

An employer review may contain an allegation that has not been independently verified. A job seeker may warn others about a recruiter who collected money and disappeared. A consumer may accuse a business of selling counterfeit products. A freelancer may describe a client who refused payment.

Such claims can be disputed. Some may be inaccurate. But they are also essential to the functioning of digital marketplaces. If publishing them carries the risk of criminal prosecution, platforms will have strong incentives to remove complaints rather than investigate them.

Users will have similar incentives to remain silent.

The result would not necessarily be a more trustworthy digital environment. It could become one in which businesses and individuals facing legitimate criticism enjoy greater protection than their customers or victims.

Fraudulent recruiters, dishonest merchants and abusive service providers would benefit from a system that makes public complaints legally hazardous.

The economic consequences could extend further. International investors consider regulatory stability, freedom of information and the predictability of legal enforcement when evaluating markets.

A digital economy cannot develop efficiently if businesses and users are uncertain whether an ordinary online complaint might expose them to criminal charges.

Bangladesh is seeking greater technology investment and a more credible capital market. Criminalising broadly defined categories of online expression would complicate both objectives.

There is also an important distinction between protecting women and children from online abuse and reviving general defamation offences.

AI-generated sexual images, intimate-image abuse, online blackmail, revenge porn, child sexual abuse material and sextortion require strong legal responses.

But those offences should be clearly defined and addressed through legislation designed to protect victims of sexual violence and exploitation.

In April, Parliament passed the Women and Children Repression Prevention (Amendment) Act, 2026. The amendment did not adequately incorporate offences committed against women and children through digital means. That was a missed opportunity.

Since the interim government issued the Cyber Protection Ordinance in 2025, I have argued that such offences should be incorporated into the Women and Children Repression Prevention Act.

The legislation should expressly cover the nonconsensual publication of personal or AI-generated intimate images, digital sexual harassment, blackmail, revenge porn, child sexual abuse material and sextortion.

It should provide meaningful penalties, rapid mechanisms for removing abusive material and safeguards for victims. This would give law enforcement a more precise legal framework without creating a general offence that could also be used against political criticism.

The government has already demonstrated that it can separate distinct categories of offences.

Online gambling was originally covered by cyber protection legislation. Once a dedicated gambling law was enacted, those provisions were removed from the Cyber Protection Act.

The same legislative logic should apply to crimes against women and children.

The reform the government should make instead

The government does not need to abandon its efforts to address online harms. It needs to distinguish between different forms of harm and use the appropriate legal instruments.

The proposed offences involving rumours and disinformation should be removed from the Cyber Protection Act. The law should remain focused on protecting devices, data, networks and digital infrastructure.

Digital defamation should not return. Existing civil remedies are available, and the interim government's decision to remove the offence should be preserved.

Mobile courts should have no jurisdiction over offences involving online expression. Any criminal proceedings should be subject to ordinary judicial oversight, with bail protections and a requirement for judicial approval before arrest.

The Ministry of Information and Broadcasting and vaguely identified authorised agencies should not be given additional powers to police speech.

Where online content must be restricted, orders should be based on clearly defined legal grounds, supported by written reasons, limited in duration and subject to appeal.

Government requests for content removal should also be disclosed through regular public reporting. A cyber protection law should never provide a mechanism for suspending or cancelling the licence of a news organisation.

Media accountability should be handled through an independent press or media commission, as editors have proposed, rather than through executive control under cybersecurity legislation.

The government should also separate the regulation of critical digital infrastructure from the regulation of speech, consistent with the concerns raised by Transparency International Bangladesh.

Platform accountability requires a different approach.

Major technology companies should be required to maintain accessible grievance mechanisms, designate responsible local officers where appropriate, respond promptly to lawful court orders and publish transparency reports detailing government takedown requests.

These measures would create a more accountable process without giving officials unrestricted discretion over what may be published.

Protection against digital sexual abuse should be strengthened through further amendments to the Women and Children Repression Prevention Act, with clearly defined offences, proportionate but substantial penalties and effective procedures for removing harmful material.

The legislative process itself also needs improvement.

A short public comment period and a limited number of consultations with selected editors are insufficient for legislation affecting virtually every internet user in Bangladesh.

The proposed amendments should be referred to a parliamentary standing committee for open hearings. Journalists, technologists, digital businesses, civil liberties organisations, lawyers and victims of online abuse should all be able to examine the draft and propose changes.

This is particularly important because the proposed law would affect not only the media but also the daily activities of millions of citizens who communicate, work, trade and obtain services online.

The government came to power after an election in which democratic accountability and the prevention of past abuses were central public concerns. Its manifesto promised cybersecurity for citizens.

That commitment should mean protecting people against hacking, financial fraud, identity theft, extortion and unauthorised access to personal information.

It should not mean protecting public officials against criticism or empowering the state to determine which unverified claims citizens may discuss.

The current draft cannot be adequately repaired by reducing a prison sentence or making minor adjustments to its definitions. Its underlying approach is wrong.

The cabinet committee should withdraw the speech-related amendments, preserve the Cyber Protection Act's focus on digital security and pursue separate, carefully drafted legislation to address specific forms of online harm.

Bangladesh has spent eight years moving from the Digital Security Act to the Cyber Security Act and then to the Cyber Protection Act. Each change has been presented as a break with the past.

The proposed amendments now raise a straightforward question: Has the government changed the law's purpose, or merely its name?

The answer will depend less on what ministers say about protecting citizens than on the powers Parliament ultimately gives the state.

—

Fahim Mashroor is the Co-coordinator, Voice for Reform, and Founder, Bdjobs.com