Bangladesh spent the better part of a decade building a body of law that turned a Facebook post into grounds for arrest. The Digital Security Act of 2018 became the template, and its successor, the Cyber Security Act of 2023, kept most of the machinery intact. When the interim government under Muhammad Yunus repealed that statute and issued the Cyber Security Ordinance 2025, it promised a cleaner instrument. The early evidence from the new elected government suggests the text changed more than the practice did.
On April 23, 2026, Human Rights Watch documented the arrests of at least four social media users in the weeks after the Bangladesh Nationalist Party (BNP), led by Tarique Rahman, won a landslide in the February 2026 election. Azizul Haque was arrested on March 31 after ruling-party supporters complained about a depiction of the prime minister on his Facebook page; police invoked Section 54 of the Criminal Procedure Code alongside the Cyber Security Ordinance and the Anti-Terrorism Act. Shaon Mahmud was handed to police on April 2 by members of the ruling party's youth wing for allegedly "insulting" the prime minister online. Sawoda Sumi was detained on April 5 over "anti-government" Facebook comments and released on bail two days later. A.M. Hasan Nasim was arrested on April 17 for posting a cartoon of a government lawmaker, under an ordinance provision relating to online blackmail.
The reform that kept the dangerous parts
It is worth stating the case for laws like this one fairly. Online harassment, non-consensual intimate imagery, financial fraud, and incitement to communal violence are real harms, and Bangladesh has a genuine history of digitally coordinated mob attacks. A state needs some legal instrument to address them, and the 2025 ordinance does contain real improvements: HRW's own World Report 2026 notes the interim government removed nine of the most-abused sections of the prior law, and the ordinance added a safeguard requiring that only the person allegedly injured by online content — or their authorized representative — may lodge a complaint.
That safeguard, Section 40, is the reform's centerpiece. It was designed to kill the dynamic that made the Digital Security Act notorious: any political activist could file a case over a post that named or offended someone else, weaponizing the courts against critics on behalf of the powerful. In at least some of the April arrests, that provision was simply ignored. Ruling-party supporters, not the officials depicted, lodged the complaints. A procedural guardrail that exists on paper but is bypassed in practice is not a guardrail.
The deeper problem is that the reform trimmed the statute without fixing its core defect. HRW's assessment is that the ordinance "continues to include provisions that are open to abuse, including overly broad definitions of criminal conduct, and weak judicial oversight of investigatory powers and powers to block online content." A cartoon of a lawmaker becomes "online blackmail." A critical comment becomes potentially "anti-state." When offenses are defined this loosely, prosecutorial discretion does the work that statutory text should constrain, and discretion follows political power.
A pattern, not an aberration
The through-line here matters for anyone weighing how to regulate online platforms. The Digital Security Act was sold as a tool against cybercrime and digital fraud. In practice, Freedom House's Freedom on the Net 2025 report — which scored Bangladesh 45 out of 100, an improvement from 40 the year before — documents that security forces under the prior order arbitrarily arrested hundreds of people for real or perceived political affiliation, with 28 journalists sued over their online activity. The names and the ruling party changed in 2026. The law's elasticity did not.
This is the central lesson of intermediary and content regulation: vague offenses do not stay confined to the harms that justified them. They migrate to whoever holds the complaint mechanism. The BNP campaigned against exactly the repression it is now reproducing, which is the clearest possible demonstration that the danger lives in the statutory design, not in the character of any one government. A law that depends on the restraint of whoever is in power is not a law — it is a standing invitation.
What proportionate reform looks like
The answer is not that Bangladesh should have no cyber statute. It is that a defensible one would do three things the current ordinance does not reliably do. First, it would define offenses narrowly and concretely — naming specific conduct like distributing non-consensual intimate images or operating fraud schemes, not "hurting religious sentiment" or content that "defames" an official. Second, it would put a judge, not a police officer, between an accusation and a pre-trial detention, with the Section 40 complaint requirement enforced as a hard jurisdictional bar rather than an aspiration. Third, it would route content-blocking through transparent, appealable orders rather than discretionary administrative power.
These are not radical asks. They are the difference between a law that targets harm and a law that targets speech the government dislikes. The arrests of Nasim, Sumi, Mahmud, and Haque are not evidence that Bangladesh enforced its new ordinance too zealously. They are evidence that the ordinance, even after reform, still permits a Facebook cartoon to be prosecuted as a crime — and that as long as it does, the identity of the prime minister is the only thing standing between citizens and the cell. That is precisely the protection no open society should accept.
For platforms operating in Bangladesh, the practical stakes are immediate: takedown demands and user-data requests arriving under a statute whose definitions are broad enough to sweep in ordinary political criticism. The reform was real. It was also not enough.