Same cage, new name: The cyber law Bangladesh keeps renaming 

In February 2021, writer Mushtaq Ahmed died in Kashimpur Central Jail. He had spent nearly 10 months in pretrial detention under Bangladesh's Digital Security Act, charged over Facebook posts critical of the government of then-Prime Minister Sheikh Hasina. 

His death became one of the rallying points for the movement that would, three years later, help drive Hasina from power and into exile. The question his death raised was simple: How does a law built to protect cyberspace become a mechanism for holding a writer in prison until he dies there, without ever standing trial?

Four and a half years later, the law has changed its name three times. The underlying question has never been answered.

Bangladesh enacted the Digital Security Act in 2018 under Hasina's government. Facing sustained international and domestic criticism that the law was being used to jail journalists, opposition figures, and ordinary critics rather than genuine cybercriminals, her government replaced it with the Cyber Security Act in 2023, a rebrand more than a reform. 

After the 2024 uprising that ended Hasina's 15-year rule, an interim government led by Nobel laureate Muhammad Yunus issued a new Cyber Security Ordinance in 2025. Finally, this April, under the elected Bangladesh Nationalist Party government, that ordinance became full legislation: the Cyber Security Act, 2026.

Each version was introduced as a correction of the last. Each time, the underlying architecture survived intact, and so did the pattern of arrests it enables.

A close reading of all four versions' definitional sections reveals something rarely discussed in coverage of any single arrest under this law: its scope has expanded with every rewrite, never contracted. 

The 2018 law's definitions of terms like "digital device" and "malware" were comparatively narrow, focused on computers and networks. 

By 2026, those same definitions have swollen to explicitly cover artificial intelligence agents, large language models, blockchain systems, quantum computing, even what the statute calls "non-human AI agents." A law genuinely reformed to protect citizens should, logically, narrow the state's discretion over time. Instead, each rewrite has widened it.

The 2024 uprising was explicitly framed as a rejection of the previous government's use of state power against its own critics. The law that enabled much of that abuse has now survived that rupture twice, under an interim government and then an elected one, essentially unchanged in its core mechanics.

Across all three renamings, the same structural flaws persist. Definitions remain vague enough that enforcement agencies can interpret them however suits their purpose. Investigating authorities retain broad arrest and search powers with no requirement for independent judicial authorisation. Journalists and dissidents remain the law's most frequent targets. 

Trials move so slowly that pretrial detention functions, in practice, as the punishment itself. No independent oversight body monitors how the law is actually applied. And at each rewrite, genuine input from civil society, press organisations, and legal experts has been limited at best.

On 19 June 2026, Rezwanur Islam, editor of the Bogura newspaper Ogrojatra Protidin, was arrested for defamation, cyber offences and blackmail over his reporting on corruption by Mir Shahe Alam, the minister of state for local government. 

Shahe Alam did not file the case; another journalist, Tanvir Alam Rimon, treasurer of Bogura Press Club, filed the case and objected that "defamatory and false" statements would harm Bogura's development. Alam himself then disclaimed any role. 

It has not been explained who, precisely, qualifies as the "aggrieved party" required to bring such a case under the cyber law's own provisions. Since the minister himself filed no complaint — that should have ended it.

This gap between the law's stated procedural safeguards and its actual application recurs across nearly every high-profile case brought under all three versions of the statute. A defamation case, under Bangladeshi law, can only be filed by the person actually defamed. 

In practice, cases are regularly filed by party officials, local leaders, or other third parties claiming injury on someone else's behalf, and police pursue them anyway. The requirement exists specifically to prevent this kind of proxy prosecution. When it is quietly ignored and nobody in the chain of enforcement objects, the space between what the law says and how it functions becomes the space where these cases live.

What is distinctive is the persistence of the same structural failures across three different governments, spanning a genuine political rupture that many observers, inside and outside Bangladesh, hoped would produce a real institutional break. 

The 2024 uprising was explicitly framed as a rejection of the previous government's use of state power against its own critics. The law that enabled much of that abuse has now survived that rupture twice, under an interim government and then an elected one, essentially unchanged in its core mechanics.

This suggests the problem was never simply which party controlled the law. It is how the law itself is built: broad enough definitions to capture almost any online statement, investigating powers exercised without independent checks, and no mechanism forcing accountability when the law is used exactly as its critics warned it would be.

Bangladesh does need cybersecurity legislation. Fraud, sextortion, revenge pornography, and digital exploitation of children are real harms, and the law's provisions addressing them are not in dispute. The problem is not that this law exists. It is that reforming its name and its section numbers, three times now, has done nothing to reform how it is actually used.

A genuine fourth version would need to do something none of the previous three attempted: narrow the definitions rather than expand them, require judicial authorisation for arrests rather than leaving that discretion with investigators, create an independent body to review complaints of misuse, and enforce the existing legal requirement that only an aggrieved party can bring a defamation case, rather than allowing that safeguard to be routinely ignored.

Until one of those changes actually happens, the next government, whichever party wins the next election, inherits the same tool its predecessors used against their critics, freshly renamed and ready to be used again.

Kazi Ahnaf Tahmid is a human rights researcher and writer who holds a Master's degree in Peace, Conflict and Human Rights from the University of Dhaka. With humanitarian fieldwork experience in Cox's Bazar, his research focuses on enforced disappearances and state violence in South Asia. 

Disclaimer: The views and opinions expressed in this article are those of the author and do not necessarily reflect the opinions and views of The Business Standard.