The Arrest That Wasn't Supposed to Happen
On June 18, 2026, police in Bogura arrested Md. Rezanur Islam, acting editor of Agrajatra Pratidin, a Bengali-language daily, under the Cyber Security Act 2026 and several criminal statutes including defamation, extortion, and criminal intimidation. Five colleagues — publisher Mehedi Hasan, news editor Ashraf Ali Faruqi, reporter Saleh Kaisar, and two local correspondents — were named in the same complaint. Islam was held for three days before being granted bail on June 21; efforts to detain the others continue.
The complaint was not filed by the government. It was filed by Tanvir Alam Rimon, treasurer of the Bogura Press Club, who alleged the newspaper's reporting on corruption by State Minister for Local Government Mir Shahe Alam was false and defamatory — and that Islam had attempted to extort two million taka (roughly US$16,400) from Rimon and Alam. What followed was revealing: Alam publicly expressed regret over Islam's arrest and stated that no legal action should be pursued on his behalf. The subject of the corruption coverage wanted the prosecution dropped. A third-party political associate pressed on regardless.
The Committee to Protect Journalists called it what it was. "The detention of Rezanur Islam and charges against five other Agrajatra Pratidin journalists for their reporting on allegations of corruption against a government minister is a blatant act of intimidation," said CPJ's Asia-Pacific coordinator Kunal Majumder on June 22, 2026.
Credit Where It Is Due
Before cataloguing what the Cyber Security Act 2026 failed to fix, its genuine improvements deserve acknowledgment. Bangladesh's recent legal reforms removed criminal penalties for wounding religious sentiment, eliminated the vague prohibition on content deemed merely "offensive or threatening," and required police to obtain a magistrate's warrant before any search or seizure. Cases must now come before a magistrate within 24 hours of an investigation beginning. The law focused its criminal provisions on genuine harms: incitement to violence against religious or ethnic groups, sexual harassment, revenge pornography, and child sexual abuse material.
The civil society advocates and lawyers who pushed for those changes were not naive about the difficulty. They understood that Bangladesh was replacing the 2023 Cyber Security Act — itself a rebranded Digital Security Act of 2018, which had itself carried over most of the problematic provisions of the Information and Communication Technology Act of 2006. Each iteration promised reform. Each iteration retained enough ambiguity to permit exactly the prosecutions reformers sought to prevent.
The Architecture That Survives Every Rebranding
The Agrajatra Pratidin case illustrates the persistent design flaw. The Cyber Security Act 2026 charges do not stand alone — they arrive bundled with criminal defamation and extortion provisions from Bangladesh's Penal Code. This combination matters enormously. Even if courts eventually dismiss the cyber charges, the criminal defamation case continues. Even if the defamation allegation fails, the extortion claim creates separate bail conditions and legal costs. A charging stack engineered for attrition does not require a single conviction to achieve its objective.
This is not a theoretical risk. The Clooney Foundation for Justice's 2024 analysis of 222 cases under the Digital Security Act involving 396 journalists found exactly one conviction across the entire dataset. Nearly half of the journalists interviewed reported abuse or mistreatment in detention. Most proceedings never reached trial. The finding was explicit: the process was the punishment. Arrests, bail hearings, pending charges, and public association with criminal accusations inflict professional and personal harm without requiring a verdict.
Three Governments, One Pattern
Bangladesh has had three governments in under two years: Sheikh Hasina's Awami League, ousted in August 2024; Muhammad Yunus's interim administration; and Tarique Rahman's BNP government, which won elections in February 2026. CPJ's 100-day assessment of the BNP administration, published June 2, 2026, documented 282 journalists facing politically motivated cases — a list compiled by Bangladesh's own Editors' Council and handed to the government in May.
The structural critique is not partisan. Centre for Governance Studies data on DSA plaintiffs found that approximately 33 percent were ruling-party affiliates and 22 percent were police officers — meaning state and political actors drove the majority of cases regardless of which party governed. Human Rights Watch documented at least four additional arrests under the 2025 Cyber Security Ordinance (the immediate predecessor to the current law) in April 2026 alone, including one man arrested for posting a cartoon of a government lawmaker. Freedom House rated Bangladesh 45 out of 100 on internet freedom in 2025, classifying it as "Partly Free" — an improvement from prior years, but still well short of the open internet environment Bangladesh's technology economy requires.
As CPJ's Majumder observed: "Press freedom in Bangladesh has too often been treated as an opportunity for each new government to turn the law against journalists allegedly aligned with the previous administration."
The Fix the Reforms Keep Missing
Bangladesh has a defensible interest in criminalising cyber fraud, network intrusion, CSAM, and coordinated harassment campaigns. None of those goals require criminal penalties for speech. Civil defamation remedies, proportionality requirements for injunctions, and shield laws for confidential sources can protect individuals from genuinely false and damaging reporting without putting editors in prison. Several democracies — including India, Australia, and a growing number of EU member states — have moved away from criminal defamation precisely because the chilling effect on investigative journalism outweighs any marginal deterrence benefit.
Bangladesh's Media Reform Commission has reportedly proposed steps in this direction. The government's task is to implement them: remove criminal penalties for online speech acts from the Cyber Security Act, restrict cyber charges to technology-specific offences (intrusion, fraud, CSAM), and amend the Penal Code to make defamation a civil rather than criminal matter.
The Agrajatra Pratidin case is instructive not because the government ordered the arrest — it appears it did not — but because the law created conditions in which any sufficiently motivated political actor in Bogura could weaponise it against editors in Dhaka. That gap between legislative intent and field reality is what genuine reform would close. Renaming the law has not closed it.