Bangladesh has published a new set of proposed amendments to the Cyber Security Act, 2026. Revisiting a new statute is not inherently troubling. What matters is the direction of the revision. The latest draft would reintroduce criminal defamation, add offences built around “humiliation”, “bullying”, “rumor” and “misinformation”, widen the state’s power to block online content, and weaken safeguards that currently require transparency and rapid tribunal scrutiny. The draft CSA is not simply an update to cybercrime law. It risks moving Bangladesh back toward the regulatory logic that made the 2018 Digital Security Act (DSA) so vulnerable to abuse.
The draft is still a proposal, and the Information and Communication Technology Division has invited public comment. That makes this the right moment to ask what a cyber law should actually solve. Bangladesh needs stronger protection against hacking, fraud, identity theft, sextortion, non-consensual intimate imagery, child sexual abuse material, malicious deepfakes, and other technology-facilitated harms. But a law designed to address those concrete injuries should not become a parallel system for policing reputation, criticism, and disputed information.
Article 39 of the National Constitution of Bangladesh guarantees freedom of speech and expression and freedom of the press, while allowing reasonable restrictions for specified purposes, including public order, decency, defamation, and incitement to an offence. The existence of those grounds does not make any restriction automatically reasonable. In criminal law, wording matters because citizens must be able to know what conduct exposes them to arrest, prosecution, and imprisonment. Broad concepts become especially dangerous when penalties are severe, and enforcement power is widely distributed.
The proposed Section 25 shows the problem. It would place sexual harassment, sextortion, revenge pornography, child sexual abuse material, blackmail, and obscene content in the same provision as defamation, humiliation, and bullying. Its explanation of digital defamation refers to Penal Code section 499 and also covers digital material intended to damage a person’s reputation, dignity, or character where the material is false, distorted, misleading, insulting, or harmful. “Humiliation” is defined as damage to dignity, honor, reputation, or social standing, while “bullying” covers repeated conduct causing physical or psychological harm, intimidation, or social exclusion. The general maximum penalty would rise to five years’ imprisonment and a BDT 2,000,000 fine, with a higher maximum where the victim is a woman or a child.
Those are different wrongs. Sextortion and non-consensual intimate imagery (NCI) involve concrete invasions of autonomy, privacy, and safety. Defamation and humiliation turn on meaning, context, truth, opinion, public interest, and reputation. Combining them under one criminal provision obscures those differences. The UN Human Rights Committee’s General Comment No. 34 urges states to consider decriminalizing defamation and states that imprisonment is not an appropriate penalty for it. Creating a new digital defamation offence carrying years in prison moves in the opposite direction.
Section 26A of the CSA amendment draft is even harder to justify. It would punish the publication or dissemination of “rumor” or “misinformation” with up to 10 years’ imprisonment or a BDT 4000000 fine. A rumor is defined as unsupported or unverified information that causes, or may cause, confusion, panic, agitation or social unrest. Early reporting is often unverified. Whistleblower claims may initially be unsupported. Political allegations are frequently disputed. A criminal rule that turns on whether information may create confusion or agitation gives enforcement authorities enormous discretion before truth has been established.
The most consequential change may be in the blocking procedure. Under the current Section 8, blocked content must be publicly disclosed, and removal or blocking requires approval from the relevant tribunal within three days; without approval, the content must be released. The proposed amendment would expand the authorities to initiate blocking to include the Ministry of Information and Broadcasting and other government-authorized agencies or forces. It would permit action where authorities suspect that prohibited consequences may occur and add material considered defamatory toward a person or institution or derogatory to the state as new grounds.
At the same time, the draft of the CSA amendment strikes out the public-disclosure requirement and removes automatic three-day tribunal approval. Instead, an aggrieved person may apply for release after the restriction is imposed. That reverses the burden: the state would no longer have to promptly justify its censorship before a tribunal; and the affected person would have to challenge it.
There is also a procedural concern. The draft would divide jurisdiction between cyber tribunals and first-class magistrates, and allow offences outside the listed cyber-tribunal categories to be tried through mobile courts if added to the Mobile Court Act schedule. That creates the possibility that ordinary Section 25 cases could enter a summary process. Speech offences are a poor fit for such adjudication. Whether a statement is defamatory, false, satirical, opinion, public-interest reporting or a reasonable mistake can require evidence, cross-examination, and careful legal analysis.
The government’s strongest case for reform is also the reason the draft should be revised rather than abandoned. Technology-facilitated gender-based violence is real, and advocacy groups have called for clearer protection against deepfakes, sextortion, cyberstalking, doxxing, and related abuse. A victim-centered cyber law could define those harms precisely, require proof of relevant intent, protect complainants’ identities, preserve digital evidence, create rapid and reviewable takedown procedures, and provide compensation and accessible remedies.
The government should therefore separate cyber harm from speech regulation. It should remove the proposed offences of humiliation and rumor, and it should not create a second, more punitive digital defamation regime. Any reform of defamation should be addressed coherently through the general law, with greater reliance on civil remedies and protections for truth, public interest, and reasonable publication. Section 26A should be withdrawn or radically narrowed to intentional, demonstrably false conduct causing clearly defined and serious harm. Speech-related offences should remain outside mobile-court jurisdiction.
Most importantly, the safeguards in Section 8 should be strengthened, not erased. The law should retain public disclosure of blocking decisions, mandatory and prompt tribunal review, written reasons, notice where feasible, a right of challenge, and time limits for emergency restrictions. A blocking power based on anticipated harm should face a higher evidentiary threshold, not lower oversight. Parliament should also require a clause-by-clause justification and a meaningful consultation period involving journalists, women’s-rights organizations, digital-rights groups, technologists, lawyers, and victims’ representatives.
Bangladesh needs a cyber law capable of confronting sophisticated digital harm. But sophistication in technology cannot be answered with vagueness in criminal law. The relevant test is not whether ministers promise that the law will be used responsibly. It is whether the statute itself makes misuse difficult, visible, and reviewable. The DSA should remain a warning about institutional design, not a model waiting to return through different terminology.
DISCLAIMER: The views expressed are those of the author(s) and do not necessarily reflect the official policy or position of the Magazine and its editorial team. The views published are the sole responsibility of the author(s).
