When Cybersecurity Becomes Content Control
he proposed amendments raise a serious concern that this is becoming less about strengthening cybersecurity and more about expanding the state’s power to regulate speech and empower law-enforcement and intelligence agencies.
There is no dispute that Bangladesh needs a strong, modern and technology-neutral legal framework to combat cybercrime. The question, however, is whether the latest draft amendments to the Cyber Security Act, 2026 are primarily designed to address cyber threats—or to expand the government’s control over online expression.
The draft discussed at a consultation meeting on 10 September 2026 proposes a new offence covering the publication or dissemination of “rumours and disinformation,” punishable by up to 10 years in prison or a fine of up to Tk40 lakh, or both. It also proposes bringing defamation, “demeaning” content and bullying within the scope of criminal offences, expanding content-blocking powers and changing the framework for trying cyber offences.
The concern is not about combating cybercrime. It is about whether powers created in the name of cybersecurity could ultimately be used against journalism, public-interest reporting, civic investigation and legitimate criticism.
The lifecycle of Bangladesh’s cyber laws
Bangladesh’s cyber-law journey has been marked by repeated changes in names, provisions and enforcement mechanisms.
The Digital Security Act, 2018 was introduced amid strong criticism over several provisions affecting freedom of expression. In 2023, the government replaced it with the Cyber Security Act, although critics argued that many controversial features of the earlier framework remained.
In 2025, the interim government introduced a Cyber Security Ordinance. A Cyber Security Act, 2026 was subsequently enacted by Parliament in April 2026. The National Cyber Security Agency’s official legal archive lists the 2025 ordinance and the 2026 Act separately.
Then, on 1 July 2026, the Cyber Security (Amendment) Act, 2026 was gazetted as Act No. 99 of 2026.
Yet another amendment draft has now emerged. A cabinet committee was formed in July to review and finalise the draft, and the committee held a meeting on 15 July. The latest consultation took place on 10 September.
That sequence matters. The issue is no longer simply about creating a cybercrime law; it is about expanding the powers of a law that was enacted only months ago.
1. The draft raises questions about its own stated purpose
The fundamental test for a modern cyber law should be whether it protects both digital security and citizens’ rights.
That is why the proposed Section 26A deserves particular scrutiny.
2. Section 26A: up to 10 years for a “rumour”
The draft proposes criminalising the publication or dissemination of “rumours and disinformation” in cyberspace, with a maximum punishment of 10 years’ imprisonment or a fine of up to Tk40 lakh, or both.
The most troubling issue is not simply the severity of the punishment. It is the proposed definition of a “rumour”.
The definition reportedly covers unsupported or unverified information, news or claims that create—or are likely to create—confusion, panic, excitement or social instability.
Three questions immediately arise.
First, must the information actually be false?
Not necessarily. Being “unverified” may itself be enough.
Second, must there be an intention to mislead?
The proposed concept of disinformation carries an intentionality element, but the proposed definition of “rumour” does not appear to establish the same safeguard with equal clarity.
Third, must actual harm occur?
Again, apparently not. The possibility of harm or instability may be sufficient.
That is where journalism enters the danger zone.
Journalism often means publishing information before the government has officially confirmed it. A report may be unverified at the time of publication and later prove to be completely accurate. If the legal test focuses on its status at the time of publication rather than its truthfulness or the journalist’s intent, legitimate reporting could become vulnerable.
That would create risks not only for professional journalism but also for citizen journalism, whistleblowing and public-interest advocacy.
A disproportionate punishment structure?
The proposed 10-year maximum sentence under Section 26A also raises questions about proportionality.
The punishment would sit alongside offences involving cyber fraud, attacks on critical information infrastructure and cyberterrorism. The issue is therefore not whether misinformation should be addressed. It is whether the definition of the offence and the severity of the punishment are proportionate to the actual harm involved.
A modern cyber law must punish genuine malicious conduct without criminalising the normal uncertainty inherent in reporting breaking news.
3. Why are safeguards missing where speech is regulated?
The broader cyber-law framework recognises the need for legitimate exceptions in areas such as law enforcement, criminal investigations, medical treatment, authorised research, education and public-interest whistleblowing.
If lawmakers recognise the importance of such safeguards elsewhere in the same legislation, similar protections should be considered for journalism, satire, research, fair criticism and public-interest communication.
Their absence from speech-related offences is therefore difficult to dismiss as a minor drafting issue.
4. Defamation and “demeaning” content return
The draft proposes adding defamation, “demeaning” content and bullying to the existing list of offences covering sexual harassment, blackmail, revenge pornography, sextortion and child sexual-abuse material. It also proposes higher penalties.
There should be little disagreement over stronger protection for children or tougher penalties for sextortion and sexual exploitation.
The problem arises when online defamation and an expansive concept of “demeaning” conduct are placed in the same criminal framework.
Where does legitimate criticism end and criminal conduct begin?
If the definition of “demeaning” is broad enough to encompass negative reviews, accountability journalism, cartoons, satire or memes, the boundary between criticism and criminality becomes dangerously blurred.
The issue becomes even more serious when arrest and trial mechanisms are considered.
5. Should cyber offences be tried through mobile courts?
The draft proposes dividing cyber offences among different judicial forums. Certain serious offences would remain under cyber tribunals, while others would go to first-class magistrate courts. Some offences could also become subject to mobile-court proceedings if included in the relevant schedule.
This raises a structural concern.
Cybercrime cases increasingly involve digital forensics, metadata, audio-visual authentication, source verification and the detection of AI-generated or manipulated content. The draft itself acknowledges the possibility of audio and video being created or edited using artificial intelligence.
How, then, can a summary mobile-court process reliably determine whether a screenshot, recording or video is authentic—or whether it has been digitally manipulated?
Speed cannot become a substitute for due process.
6. Who gets the power to block online content?
The proposed amendment would expand the authority to remove or block content beyond law-enforcement agencies to include the Ministry of Information and Broadcasting and other agencies or forces authorised by the government.
The phrase “other authorised agencies or forces” deserves particular attention.
If the law does not clearly define who can exercise such powers and under what judicial or administrative safeguards, the scope of executive authority can expand through administrative decisions.
The draft also proposes bringing “disinformation or rumours,” defamatory content concerning individuals or institutions, and content deemed insulting to the state within the blocking framework.
The phrase “insulting to the state” is especially problematic if it lacks a precise statutory definition.
A modern content-regulation system must also guarantee transparency and effective remedies. When content is blocked, the government should disclose what was blocked, why it was blocked and under what legal authority.
More importantly, a person affected by a blocking decision should have access to an independent and meaningful appeal process. A system in which the same agency that blocks content also decides whether its own decision should be reversed would raise obvious concerns about impartiality.
7. Less oversight, more immunity?
The proposed amendment reportedly seeks to change the meeting frequency of the National Cyber Security Council from at least once every three months to once every six months.
That proposal becomes significant if the same draft is simultaneously expanding executive powers to block and remove online content.
Even more important is the proposed immunity for officials. The draft reportedly seeks protection from civil or criminal proceedings for the council’s chairman, members and authorised officials for acts carried out in “good faith”.
Good-faith protection can have a legitimate role in public administration. But it must be narrowly defined, subject to oversight and never become a blanket shield against abuse of power.
The real question
Bangladesh needs a modern cyber law.
Artificial intelligence, deepfakes, ransomware, malware, identity theft, cyber fraud and attacks on critical information infrastructure are genuine threats. The state must have effective tools to address them.
But security and control are not the same thing.
A modern cyber law should protect citizens’ digital rights while safeguarding critical infrastructure, government systems, businesses and personal data.
The danger begins when vague concepts such as “rumour”, “disinformation”, “demeaning”, “insulting to the state” or “likely to cause instability” become the basis for long prison sentences and broad executive powers.
The government can explain why further amendments are necessary so soon after the Cyber Security Act, 2026 was enacted. But the legislative process must also answer a more fundamental question: are we strengthening cybersecurity, or are we rebuilding older mechanisms for controlling speech under a new legal label?
Bangladesh spent years moving away from the controversial architecture of the Digital Security Act.
If the new framework brings back similarly vague definitions, disproportionate penalties, broad blocking powers, weak remedies and extensive official immunity, changing the name of the law will not change the nature of the problem.
Bangladesh needs a strong cyber law. But that law should make citizens safer—not silent.
Author: Policy Technologist, Data Scientist and Researcher
Editorial Note || The views expressed are solely those of the author and do not necessarily reflect the editorial position of Digital Bangla Media. To uphold diversity of opinion, Tech-Thought is published without editorial censorship.
