Rumour has it you could get 10 years

Mushtaq Ahmed was a writer. In 2020, he posted criticisms on Facebook about how Hasina's Awami League government handled the pandemic. Police arrested him under the Digital Security Act, passed by that government in 2018. Bail was refused repeatedly. In February 2021, after nine months in Kashimpur jail and no trial, he died there.

The cartoonist arrested with him, Ahmed Kabir Kishore, was released on bail about a week after Mushtaq's death, nearly 10 months after his own arrest. He later said he had been tortured.

The law criminalised online reputational damage and empowered police to make arrests without a warrant, meaning no judge reviewed complaints beforehand. A single Facebook post was sufficient grounds. Most complaints, notably, came from ruling-party workers targeting leaders they had never personally encountered.

Reversing this system took years and a regime change. Hasina's administration rebranded it as the Cyber Security Act in 2023, though critics argued it changed little in substance. Following her ouster, the interim government repealed it altogether, introducing the Cyber Security Ordinance, 2025, before the BNP government passed its own version, the Cyber Safety Act, 2026, this April, which eliminated most speech-related offences and voided all pending cases under both preceding laws.

Five months later, the same government drafted an amendment. Much of what was dropped would come back.

We obtained a copy of the unpublished draft reviewed for this report from our sources.

A new crime: the rumour

The draft creates an offence found in no Bangladeshi law today. Spreading a "rumour" or "disinformation" online would carry a sentence of up to 10 years in prison and a Tk 40 lakh fine.

Three elements are absent from the offence's definition. The post does not have to be untrue; the draft defines a "rumour" as anything unverified. Intent to cause harm is required only for "disinformation," not for "rumour." And no actual harm has to occur: it is enough that a post "may" cause confusion, panic or unrest, a determination made afterwards by an official.

Under this test, a journalist who hears from two witnesses that someone was killed at a protest, verifies with them, and files before police confirm anything, has published something unverified. Confirmation the next morning does not change that status, since the offence turns on verification rather than accuracy. The draft also applies the same penalty to sharing such a report as to publishing it.

The draft carves out exceptions elsewhere: it excuses whistleblowers under its terrorism section and journalists or researchers under its child-abuse section. It contains no such exception for the rumour offence.

Who verifies?

The draft does not define verification, identify a verifier, or provide a mechanism to verify content before publication. Under its terms, that judgment falls to whoever reads the post. Any person, institution, the public or the state can file a complaint. A sub-inspector investigates.

Under the blocking section, law enforcement, the Information Ministry, or any agency the government designates can decide there is "reason to believe" a violation occurred. As drafted, a single official's reading of a post can trigger both a takedown and a criminal case.

Partha said in his remarks that people often share content without verifying it. The draft criminalises that behaviour without specifying who is responsible for verification.

In 2024, the interim government's Chief Adviser's Press Wing set up a Facebook page, CA Press Wing Facts, to counter what it described as misinformation about government activities. The page operated within the government's own communications structure rather than an independent newsroom or verification body.

By the standards professional fact-checking organisations apply, this arrangement would not qualify as independent verification, since editorial control rested with the government, whose own claims were frequently the subject of dispute. A law that criminalises "unverified" content, applied through a comparable arrangement, would place government bodies in a position to adjudicate claims about their own conduct.

Ten years for what?

The penalty for the rumour offence stands out against the draft's other listed punishments. Inciting religious or ethnic violence online carries two years; hacking critical national systems and destroying data carries seven; a cyberattack that causes death carries ten. Sharing an unverified post also carries a 10-year jail sentence.

Defamation comes back

The Cyber Safety Act currently groups the most serious online offences, blackmail, sextortion and child sexual abuse imagery, under one section. The draft adds criminal defamation, "humiliating" someone, and bullying to that section, then doubles the penalties for the section as a whole.

This structure limits how legislators can vote on the provision. Because all these offences now sit on a single list, a lawmaker seeking tougher sentences for child abuse offences cannot vote against the defamation penalty without also voting against the rest of the section.

Police already have warrantless arrest power under this section, meaning defamation would again become an arrest-first offence, the same mechanism that filled jails between 2018 and 2023. In March 2023, Prothom Alo reporter Shamsuzzaman Shams was arrested over an Independence Day story on food prices under the then-active Digital Security Act. Under this draft, the same story would generate two separate charges.

These cases currently go to the Cyber Tribunal, a venue built to handle digital evidence. The draft reassigns defamation and religious hate-speech cases to mobile courts, on-the-spot hearings conducted by an executive magistrate, a government administrative officer, rather than a judge, who would rule within minutes on whether evidence such as a screenshot is authentic. Appeals go to another government officer.

What quietly disappears

Under the current Cyber Safety Act, the government cannot block content indefinitely without oversight: it must publish a list of everything blocked, obtain tribunal approval within three days, and restore content automatically if that approval is not granted. The draft removes all three requirements. A person whose content is blocked would instead have to apply for release, either to a court or to the agency that ordered the block.

Three days can represent the entire news cycle for a story about a protest, an election night, or a price increase. Without the automatic-restoration rule, content can remain blocked indefinitely without judicial review.

The draft also expands blocking authority. The Information Ministry, along with any "agencies or forces" the government designates, could order takedowns under a new, undefined category: content "contemptuous to the state," a term that does not appear elsewhere in Bangladeshi law. This is the type of wording Partha said the government was reviewing carefully because some terms "could have dual meanings and be open to misuse."

Who oversees the agency?

A single body oversees the law's enforcement, and the draft reduces how often it meets. The National Cyber Security Agency operates within the ICT Division. Its only oversight body is the National Cyber Security Council, chaired by the Prime Minister and composed largely of ministers, secretaries, and police and intelligence chiefs.

The draft reduces the council's meeting frequency from four times a year to twice a year without stating a reason, while retaining the existing requirement for quarterly risk report reviews. It adds six officials to the council, including the Information Minister and Secretary, from the same ministry that would gain blocking authority under the draft. It removes the Chairman of the National Human Rights Commission from the council. Two seats remain designated for non-government members, though the government retains the authority to select both. The law does not require the agency to report to parliament, and officials acting "in good faith" are shielded from civil or criminal liability, while a person wrongly blocked has no corresponding remedy.

Not all of it is bad

The draft cancels pending cases and sentences under the Digital Security Act and the Cyber Security Act, 2023, and states that one of its purposes is to address the effects of those laws on free expression. Transparency International Bangladesh has called for the draft to be rewritten, describing terms like "rumour" and "disinformation" as broad enough to allow "targeted misuse and violation of freedom of speech."

What the government proposed

Information and Broadcasting Minister Andaleeve Rahman Partha said on 10 September that the amendment aims narrowly at “abusive language and other harmful activities on social media,” while respecting “freedom of expression and media freedom.” He framed the goal as protecting “social harmony” and public morals, noting the draft was still being finalized with journalist input, since some terms “could have dual meanings and be open to misuse.”

He acknowledged past laws, including the Digital Security Act, were “used to suppress or abuse the media” over the past 17-20 years, and said this draft was being written carefully to avoid similar misuse, insisting it was “not being made to suppress anyone’s voice.”

Notably, the draft would expand his own ministry’s power, allowing it to order content takedowns and adding its minister and secretary to the council overseeing the blocking agency, changes he did not mention in his remarks.

What it would mean for journalists

The practical question for newsrooms is not only who might be charged, but what changes before publication. A reporter who has confirmed a story with sources but not with the government has published something that the draft would classify as unverified. The same applies to the editor who approved it and to readers who share it. If such a story is blocked, it remains blocked while the matter is contested, and if the block is later found to be mistaken, no official bears responsibility for it.

One existing safeguard would not extend to the new offence. The current Cyber Safety Act requires a magistrate to review defamation and hate-speech complaints within 24 hours and to dismiss baseless ones immediately, a provision intended to prevent a complaint from resulting in pretrial detention. The draft's rumour offence falls outside that requirement.

Mushtaq Ahmed spent nine months in a cell before facing trial, the outcome that the provision was designed to prevent. It would not apply to the offence this draft creates.