ARTICLE TEXT

Few laws in Bangladesh have been renamed as often as the one governing what citizens may say online. The Digital Security Act 2018 was replaced by the Cyber Security Act 2023. The interim government repealed that in May 2025 with a Cyber Security Ordinance, which the elected Parliament converted into the Cyber Security Act 2026 in April, and then amended on 30 June 2026. Supporters of each change said it removed the abuses of the last. Critics say the cage has simply been repainted. Both sides have a case.

What the Digital Security Act Did

The Digital Security Act 2018 was, by common consent, one of the most repressive speech laws in South Asia. Its offences included publishing information that hurt religious sentiment, tarnished the image of the nation, or spread confusion, all vaguely defined and most non-bailable. A study by the Centre for Governance Studies of 1,436 cases filed between 2018 and 2023 found that more than 450 journalists and nearly 500 politicians had been sued, that many were arrested, and that a majority of complaints were brought by state agencies or ruling party activists. Government figures put the total number of cases at more than 7,000, against nearly 22,000 people.

The Reforms

The Cyber Security Ordinance of May 2025 was the most significant break with that model. It omitted nine of the 2023 Act’s sections, including those on defamation, hurting religious sentiment and publishing offensive or false information, and annulled pending cases under them. It declared internet access a civic right and added offences targeting online gambling and crimes enabled by artificial intelligence. Human rights groups, while critical of remaining provisions, acknowledged the change.

The 2026 amendment moved in a different direction. It imposed deadlines on platforms to remove content on official request, gave the Bangladesh Telecommunication Regulatory Commission powers to block content and demand user data, and introduced new definitions of misinformation and defamation. Reports on further draft changes in September 2026 suggested penalties of up to ten years’ imprisonment for spreading rumours and up to five years for online defamation, with mobile court jurisdiction. Critics said the drafts echoed the era of the Digital Security Act.

The Case for Strong Cyber Laws

Defenders of the 2026 framework make three arguments. First, online harm is real. Bangladesh has seen communal violence triggered by fabricated Facebook posts, women harassed through intimate images shared without consent, and financial fraud on an industrial scale. A state that cannot compel a platform to remove such content, or trace its author, cannot protect its citizens.

Second, the previous laws were abused not because they existed but because they were applied by a government that tolerated no criticism. In the hands of a different government and an independent judiciary, they say, the same powers can be used responsibly. The 2025 ordinance’s civic right to internet access and the removal of the worst sections show that reform is possible within the framework.

Third, every democracy regulates online speech. The European Union’s Digital Services Act, the United Kingdom’s Online Safety Act 2023 and India’s IT Rules all impose takedown duties on platforms. Bangladesh is not an outlier in principle.

The Case Against

Critics respond that the problem was never the name of the law but the breadth of its offences and the ease of arrest. Definitions of misinformation and defamation broad enough to catch a satirical post or a critical news report will be used against journalists, whoever is in power. The record of the Digital Security Act shows that vague offences plus police discretion plus non-bailable arrest equals a weapon, and the 2026 drafts restore two of those three elements.

They also note the shift from courts to regulators. Under the amendment, blocking decisions are made by the BTRC, an executive body, not by a judge. Comparisons with European law miss that the Digital Services Act operates alongside strong courts, independent regulators and a constitutional right to free expression enforced by the Court of Justice and the Strasbourg court. The safeguards, not the takedown powers, are what make those laws tolerable.

Where This Leaves Article 39

The Constitution guarantees freedom of speech subject to reasonable restrictions imposed by law. The word that matters is reasonable. A restriction is reasonable when it is precise enough to be known in advance, narrow enough to catch only genuine harm, and applied by a process that allows challenge before an independent tribunal. Judged by that standard, the 2025 ordinance was a step forward and the 2026 amendments are a step back. Whether the final version of the law protects citizens or silences them will depend on three things: how narrowly its offences are drafted, whether arrest without warrant is permitted, and whether the courts, not the regulator, have the last word. On all three, the answer is still being written.

Sources

1. Prothom Alo, Cyber Security Ordinance 2025 gazetted, nine sections omitted (May 2025): https://en.prothomalo.com/bangladesh/government/5gj5obvmuw
2. BSS, Cyber Security (Amendment) Bill 2026 passed (30 June 2026): https://www.bssnews.net/js-session/401310
3. The Daily Star, Cyber Security Act draft changes echo DSA-era restrictions (14 September 2026): https://www.thedailystar.net/news/bangladesh/news/cyber-security-act-draft-changes-echo-dsa-era-restrictions-4272271
4. The Business Standard, Same cage, new name: how Bangladesh keeps renaming its cyber law (September 2026): https://www.tbsnews.net/thoughts/same-cage-new-name-cyber-law-bangladesh-keeps-renaming-1554681
5. The Daily Star, 60pc of DSA cases filed by agencies, government or AL activists (CGS study): https://www.thedailystar.net/news/bangladesh/news/60pc-dsa-cases-filed-agencies-govt-or-al-activists-3599506