The case for acting
Bangladesh's government has a real problem to solve. Online harassment, sextortion, revenge porn and coordinated disinformation cause genuine harm, and in a country that went through the violence of July-August 2024, officials are right to fear that viral falsehoods can turn into street disorder. Information and Broadcasting Minister Andaleeve Rahman has said the draft amendments aim to curb disorder on social media and protect social harmony, according to the Committee to Protect Journalists. A modern cyber law should cover those harms, and parts of the draft, such as its treatment of child sexual abuse material and blackmail, are uncontroversial.
The question is whether the instrument fits the problem. On the evidence available, it does not.
What the draft does
The ICT Division published the draft amendments to the Cyber Security Act 2026 in mid-September. A cabinet committee chaired by Minister Fakir Mahbub Anam had already discussed the draft in July and resolved to hold another meeting to finalise it. According to a Daily Star editorial dated 14 September 2026, the draft would:
- reintroduce digital defamation as a crime, with up to five years in prison and a fine of Tk 20 lakh;
- apply the same penalties to online 'humiliation' and 'bullying';
- create an offence of spreading 'rumours' or 'fake news', punishable by up to 10 years and a fine of up to Tk 40 lakh;
- extend the power to seek content blocking beyond law enforcement and broaden the grounds for it;
- remove the requirement to publicly disclose blocked content.
CPJ reports that material could violate the rumour offence if authorities judge it 'unsubstantiated or unverified' and likely to create public confusion, panic or unrest. It adds that cases would go to the Cyber Tribunal and that courts could suspend or cancel a news company's licence.
Why the definitions are the problem
A criminal law must let a person know in advance what is forbidden. 'Rumour', 'misinformation', 'humiliation' and 'bullying' do not. In a statement reported on 24 September, CIVICUS, the Robert F. Kennedy Human Rights Center, Front Line Defenders and South Asians for Human Rights called these terms 'vague, overly broad and open to subjective interpretation'. They warned that the absence of precise definitions creates 'significant scope for misapplication and arbitrary enforcement'. Tech Global Institute has also criticised the draft.
The 'unverified' standard deserves particular attention. Journalism is, by nature, reporting in the interval before every claim is confirmed. Early reporting on a disaster, a police shooting or a corruption allegation is routinely 'unverified' at publication and sometimes wrong in detail. A 10-year ceiling on that conduct does not target malicious fabricators. It shifts the risk onto every reporter, editor and ordinary user who shares something that later proves shaky.
The track record is not abstract
Bangladesh has run this experiment before. CPJ notes that at least 255 journalists were sued under the Digital Security Act between 2018 and 2023, and that the writer Mushtaq Ahmed died in custody after nine months of pretrial detention on charges under that law. The interim government's response was to strip out contested provisions: the Daily Star says the Cyber Security Ordinance 2025 removed nine of them. The draft, in the editorial's words, 'may take us back', and its penalties are described as harsher than the old Act's.
The design matters as much as the headline penalties. Blocking on suspicion of a possible future offence, by more agencies, with no public disclosure of what was blocked, removes the one mechanism that would let courts, researchers and the press audit abuse. Secret takedown power is exactly how disputes about legitimate speech become unfalsifiable. The same pattern runs through the state's wider toolkit. A July 2026 joint statement from eight groups, including Access Now, Amnesty International, ARTICLE 19 and Human Rights Watch, describes surveillance powers expanded 'without meaningful transparency, independent oversight, or effective accountability mechanisms' and says the Telecommunication Regulation (Amendment) Act 2026 removed many safeguards.
Process undermines the stated goal
The consultation was thin. The rights groups say the 10 September session included some media professionals but excluded civil society and human rights defenders. Laws that restrict speech are the ones that most need slow, adversarial scrutiny. Editors at a later consultation voiced concern about misuse and asked for protections for the media.
A proportionate alternative
None of this means leaving victims unprotected. A proportionate approach would:
- Keep harassment and sexual-abuse offences, and define them narrowly, by conduct and intent rather than by feelings of 'humiliation'.
- Handle defamation civilly. Reputational harm is best addressed by damages and corrections, with truth and public-interest defences, not prison.
- Drop the standalone 'rumour' offence, or limit it to knowing falsehoods that cause demonstrable, imminent harm, with a high bar of proof.
- Require prior judicial authorisation for blocking, with time limits, notice to affected parties and a public register of blocked content.
- Publish the text and allow a real consultation with media, civil society and the technology sector, which is where the compliance burden will fall.
This is also a growth question. Platforms, startups and creators decide where to invest on the basis of legal predictability. Open-ended liability for 'unverified' content and covert blocking raise the cost of operating in Bangladesh and push companies toward over-removal.
Bottom line
Bangladesh's reform government came to power promising to dismantle the machinery of the last sixteen years. The draft would rebuild its most criticised parts under a new name. The defensible parts of the draft can be kept; the vague speech offences, the secret blocking and the lopsided process should go. If the cabinet committee withdraws them before it finalises the bill, it will keep the commitment it made.