Nutshell Today’s Editorial Board has reviewed the new draft of Bangladesh’s Cyber Security (Amendment) Act, 2026. And we have come to the conclusion that this is an old wine in a new bottle.The problem is the wine has switched so many bottles that the makers might think it’s not the wine but the bottle was the problem. It’s not! In 2018, this wine was the Digital Security Act. In 2023, after enough domestic and international embarrassment, it was reborn as the Cyber Security Act. In 2025, it became an Ordinance. Now it is back again: another corrective draft, another assurance that the state has finally learnt the difference between protecting people and policing speech.
There is a strange confidence in the way these laws return. They leave public life amid protests, petitions, editorials and stories of midnight arrests; then they come back with a tidier preamble, a fresh acronym and a promise to behave better. Much like the political sphere of the country to be honest. The 2026 draft says it is meant to remedy the 2023 law’s “inadequate protections for citizens and free expression.” It is a noble sentence. It also happens to be the sentence against which the rest of the bill should be read.
To be fair, the draft does contain things that ought to have been there all along. It creates an “aggrieved person” remedy against content takedowns, adds an appellate mechanism, and fixes timelines for disposing of cases. Those are not decorative changes. They are pieces of legal plumbing that journalists, lawyers and rights advocates have been asking for since 2018. But the plumbing is not the house. The house is Section 26ka.
This new provision makes it an offense, punishable by up to ten years in prison and a Tk 40 lakh fine, to spread “rumor” or “disinformation” online. The offence does not ask the most obvious question: was it true? It offers no clear distinction between an intentional lie and an honest mistake, no protection for satire, no exemption for reporting in the public interest. Instead, it asks whether a post creates “confusion, panic, agitation or social instability.” That is not a legal standard. It is a weather report on the feelings of power.
Bangladesh knows how this story goes. In March 2023, Prothom Alo correspondent Shamsuzzaman Shams was taken from his home at 4 a.m. and held for six days over a photo-caption error in a report on food prices. In 2020, cartoonist Ahmed Kabir Kishore and writer Mushtaq Ahmed were arrested over Facebook posts criticising the government’s Covid-19 response; Mushtaq died in custody before his case was heard. Such cases were never only about what was posted. They were about the point at which an uncomfortable post becomes, in the eyes of someone powerful, a threat to order. Section 26ka gives that instinct a new address and a longer sentence.
There is a smaller provision with potentially larger consequences. Section 46 sets out which offences are bailable, but does not mention Section 26ka. If that omission remains, the Criminal Procedure Code’s default rules may apply, and an offence carrying ten years can be treated as cognizable and non-bailable. In ordinary language: a district reporter accused of “disinformation” may be arrested before anyone is obliged to explain what the word means, and then made to fight for bail. The punishment, as so often, begins long before conviction.
The bill’s institutional design does little to calm that worry. It creates a National Cyber Security Council dominated by ministers and security officials, with two non-government experts chosen by the government. It grants officials broad “good faith” immunity, while reducing the Council’s mandatory meeting frequency from every three months to every six. More authority, fewer required moments of scrutiny: the arithmetic is not complicated.
Nor does the risk end with an individual Facebook user. Section 25 expands a provision meant for blackmail and non-consensual intimate imagery to include defamation and “reputational degradation,” while raising penalties. Section 29 lets a court cancel the registration of a convicted trust or NGO. A small investigative newsroom, registered as a trust, could therefore be prosecuted over a disputed story and then legally erased. That is a very large consequence to attach to such elastic language.
Bangladesh needs a serious cyber-security law. Hacking, fraud, infrastructure attacks, online abuse and organised disinformation are not imaginary problems. But a law built to confront them should be precise enough to separate sabotage from satire, fraud from reporting, and malicious falsehood from a mistake made in public. The final gazetted text will show whether this is a real reform. For now, it looks uncomfortably like the same law, in a new font, waiting for us to forget what the old one did.