On April 9, 2026, Bangladesh's newly elected Jatiya Sangsad passed the Cyber Security Bill, 2026 — one of 24 bills cleared on the final day of a 30-day sprint in which Parliament converted 91 interim-government ordinances into permanent statute law under Article 93 of the Constitution. The bill makes durable what the Cyber Security Ordinance, 2025 (gazetted as Ordinance No. 25 on May 21, 2025) had introduced on a temporary basis: a partial dismantling of the speech-criminalising machinery of the Cyber Security Act, 2023, paired with the survival of a powerful executive content-blocking provision.
The reform half of this story is genuine, and worth saying plainly. The 2025 ordinance shed nine of the most-abused sections of the 2023 Act — including the provisions that criminalised criticism of the Liberation War and the country's founding figure, penalised "offensive" or "fear-inducing" information, and punished use of a false digital identity. According to New Age, the repeal triggered automatic cancellation of roughly 95% of pending cases, because the overwhelming majority had been filed under exactly those clauses. Speech-related offences were made bailable, maximum penalties were cut, and — for the first time in Bangladeshi law — internet access was acknowledged as a civic right. For a country whose Digital Security Act 2018 and its 2023 successor had become bywords for jailing journalists and dissenters, this is a real, measurable narrowing of the state's power to prosecute words.
The case the government can make
Before criticising what remains, it is worth stating the strongest version of the state's position. Bangladesh has a documented history of online rumour igniting communal violence, and the law's retained provisions on incitement to religious hatred, child sexual abuse material, and AI-enabled fraud target conduct that few would defend. A regulator confronted with content that is genuinely spreading panic during a riot, or coordinating attacks on a minority community, has a legitimate interest in acting faster than a court can convene. That is the honest core of the argument for Section 8.
What Section 8 actually does
The problem is the breadth and the absence of a check. Section 8 empowers the Bangladesh Telecommunication Regulatory Commission (BTRC) to remove or block content that may undermine "national unity," "economic activity," "security," "defence," "religious values" or "public order" — acting on the request of law enforcement agencies or the director-general of the National Cyber Security Agency. As Front Line Defenders noted in its analysis of the draft, these are "vague and undefined reasons" exercised "without any judicial oversight."
That combination — elastic grounds plus no judge — is the structural flaw. "National unity" and "public order" are not standards a platform's compliance team or a reviewing court can apply with any predictability; they are an invitation to read the political weather. A joint statement by the Tech Global Institute and the Bangladesh Legal Aid and Services Trust (BLAST) made the operative recommendation: specify the grounds for content blocking clearly, and build in safeguards before the agency can order a takedown. Converting the ordinance to permanent law without doing either freezes the executive's discretionary blocking power into statute precisely when it should have been disciplined.
Why permanence raises the stakes
The scale of pre-existing demand explains why this matters. Google's Transparency Report records 279 government removal requests from Bangladesh in the first half of 2025, covering 1,023 individual items — and Google itself attributed 181 of those requests to "government criticism" rather than to fraud, child safety or other uncontested harms. That is the baseline behaviour of the state that now holds a statutory, judge-free blocking tool. A law's safeguards are tested against how a government already behaves, not against how a charitable reading imagines it might.
There is also a platform-governance dimension that cuts against innovation. When the trigger for removal is a phrase as open-ended as "economic activity" or "national unity," the rational response for a global platform is to over-comply — to geo-block or down-rank Bangladeshi content on thin signals rather than risk regulatory exposure. Vague liability does not just chill speakers; it nudges intermediaries toward pre-emptive removal, shrinking the space for legitimate commentary, journalism and even ordinary commerce that the reform was supposed to protect.
The proportionate path
None of this requires abandoning cyber regulation. It requires matching the tool to the harm. A proportionate Section 8 would do four things the current text does not: define each blocking ground narrowly enough that a court could review it; require prior judicial authorisation, with a tightly bounded emergency exception subject to fast after-the-fact review; mandate published transparency reporting on every order, including the legal basis; and attach a sunset or statutory review clause so Parliament must revisit the power rather than let it ossify.
Bangladesh has just demonstrated it can liberalise — the deletion of nine speech offences and the cancellation of tens of thousands of cases is exactly the kind of evidence-based correction good lawmaking looks like. The unfinished task is to extend that same discipline from what the state may prosecute to what it may erase. Permanence was the moment to add the judge. Parliament chose, for now, not to.