In the digital age, a substantial part of everyday life, economic activity, education, business, communication and public expression takes place online. Protecting citizens, institutions and the state from cybercrime is therefore an essential responsibility of government. Yet an equally important constitutional question arises: how far should state power extend in the name of security?
The debate surrounding Bangladesh’s proposed amendments to its cyber protection legislation raises concerns that go well beyond individual provisions. In an article published on 28 September, political scientist Ali Riaz questioned the rationale behind amendments that could restrict freedom of expression. His arguments touch on fundamental issues concerning the relationship between the state and its citizens, the limits of government authority and the protection of civil liberties.
The central question is whether cybersecurity laws will genuinely protect citizens or provide the state with additional means of controlling their freedoms under the pretext of security.
Balancing Cybersecurity and Civil Liberties
Cybercrime is a genuine and growing concern. Hacking, identity theft, financial fraud, data theft, online harassment, sexual abuse and attacks on critical information infrastructure can cause serious harm to individuals, businesses and public institutions. Effective legislation is essential to investigate such offences, hold perpetrators accountable and prevent further damage.
However, combating cybercrime and restricting freedom of expression are fundamentally different objectives. Citizens’ security and their right to express opinions should not be treated as competing interests. A sound legal framework must protect both.
The state has a responsibility to bring offenders to justice. Yet it must exercise particular caution before treating criticism of the government, opposition to public policies or questions about official decisions as criminal conduct.
Governments possess extensive institutional resources, including law enforcement agencies, administrative authority and technological capabilities. Citizens, by contrast, depend on constitutional protections, civil liberties and access to justice to defend their rights.
This imbalance makes accountability essential. Where should the limits of state authority lie? Who should oversee the exercise of that authority? And what remedies should be available when officials misuse their powers? These questions must be addressed when cybersecurity legislation is drafted and implemented.
Why Vague Legal Definitions Are Dangerous
The effectiveness and fairness of any law depend partly on the precision of its language. Citizens should be able to understand in advance which actions constitute offences and which remain lawful.
Misinformation is not necessarily the same as deliberately fabricated information. Strong criticism does not automatically amount to defamation. Political disagreement is different from criminal incitement, just as investigative journalism differs from deliberate disinformation.
If legislation fails to establish these distinctions clearly, it can create legal uncertainty and leave excessive room for interpretation by enforcement agencies. Citizens may become unsure whether expressing an unpopular opinion or publishing information about a controversial public issue could expose them to legal action.
These concerns are particularly relevant to the proposed Section 26. The provision must be assessed in terms of how clearly it defines the conduct that could attract legal consequences and whether its application could unduly restrict legitimate expression.
A democratic legal system should rely on clearly defined offences, credible evidence and fair procedures rather than the preferences or political interests of those in power.
Who Has the Authority to Determine the Truth?
False information and rumours can mislead the public, damage reputations and, in certain circumstances, threaten public safety. Nevertheless, determining whether information is false, misleading or unlawful requires an impartial process.
Who should make that determination: the government, police, administrative authorities, regulatory bodies or an independent judicial authority?
The question is especially significant when information concerns political disputes, government decisions or allegations of misconduct by public officials.
Disagreement with an official statement does not, by itself, make an opposing claim false. Nor should the publication of information that embarrasses a powerful individual automatically be treated as a criminal act.
Verifying information and controlling expression are separate responsibilities. The state should facilitate access to reliable information, investigate genuine offences and enforce the law fairly. If it acquires excessive authority to determine which opinions may be expressed, however, the distinction between protecting the public and suppressing dissent becomes increasingly difficult to maintain.
Can the Possibility of Harm Justify Restrictions?
Proposed Section 8(2) raises questions about taking action when information is considered likely to undermine public order or security. The key issue is whether restrictions should be imposed on the basis of a clearly established offence or on an assessment of potential harm that may be open to interpretation.
If the possibility of harm becomes sufficient grounds for legal intervention, authorities must operate under clear and objective criteria. They should be required to establish a credible connection between the information in question and the anticipated harm.
Without such safeguards, broadly defined concerns about public order could provide grounds for restricting lawful expression.
Cybercrime investigations sometimes require urgent action, particularly when financial losses, data breaches or threats to critical infrastructure are involved. Speed, however, cannot replace due process.
The use of mobile courts to adjudicate such offences also raises questions about the separation of powers. If executive authorities perform overlapping roles in enforcement and adjudication, it becomes necessary to examine whether defendants receive an adequate opportunity to challenge allegations and obtain an impartial hearing.
The separation of powers is not merely a theoretical principle of political science. It is an important constitutional safeguard against the concentration and misuse of authority.
Protecting Investigative Journalism and the Public Interest
Freedom of the press and the public’s right to know are essential components of an accountable state. Investigative reports on corruption, irregularities or abuse of power may damage the reputations of individuals or institutions. That does not automatically make such reporting defamatory or unlawful.
The distinction between publishing evidence-based information in the public interest and deliberately spreading false allegations must remain central to the application of the law.
If journalists fear prosecution simply because their reporting challenges powerful interests, they may become less willing to investigate wrongdoing. Such an environment would weaken public accountability and restrict access to information that citizens have a legitimate interest in receiving.
Digital searches and the seizure of electronic devices require particular care. A journalist’s phone or computer may contain confidential sources’ identities, unpublished documents, interview recordings and material relating to ongoing investigations. Unrestricted access to such information could expose sources to risk and undermine the ability of journalists to obtain sensitive information.
Journalists should not be exempt from legitimate criminal investigations. However, investigative powers must be exercised on a lawful and proportionate basis, with appropriate safeguards for confidential sources and materials unrelated to the alleged offence.
Protecting press freedom and public access to information is not incompatible with cybersecurity. Both are necessary for a transparent and accountable society.
Digital Privacy and the Limits of State Access
Electronic devices have become repositories of personal life. Smartphones and computers can contain private correspondence, photographs, family information, financial records, business documents and details of an individual’s personal activities.
Access to these devices can therefore reveal far more than the information directly relevant to an investigation. It may expose a person’s private life in considerable detail.
Law enforcement agencies may need to obtain digital evidence when investigating genuine offences. Yet the authority to search a device or seize data should be governed by clear legal requirements. Authorities must have legitimate grounds for accessing the information, and the scope of any search should be proportionate to the purpose of the investigation.
Questions of oversight are equally important. What information may be collected? How long can it be retained? Under what circumstances may it be shared or used for other purposes? What remedies are available if the information is accessed unlawfully or misused?
Suspicion can justify an investigation where the law permits it, but suspicion alone is not proof of guilt. Safeguards are therefore necessary to prevent investigative powers from becoming instruments of unnecessary surveillance.
Judicial authorisation where appropriate, independent oversight and effective remedies for privacy violations should form part of a credible framework for digital investigations.
Lessons from Earlier Digital Laws
Bangladesh’s experience with earlier digital legislation should inform any new cybersecurity framework. Debates surrounding the implementation of the Information and Communication Technology Act and the Digital Security Act cannot simply be set aside when laws are renamed or amended.
According to research cited in Ali Riaz’s article, 1,417 cases were filed under the Information and Communication Technology Act between 2012 and June 2017. Approximately 65 per cent of them were brought under Section 57.
The article also cites figures showing that 1,436 cases were filed under the Digital Security Act between October 2018 and September 2023, involving 4,520 accused individuals.
These figures provide an indication of the extent to which the legislation was used. However, case numbers alone cannot establish whether a law succeeded or failed. A fuller assessment would require examining the nature of the allegations, the evidence presented, the outcomes of investigations and trials, and the effects of enforcement on freedom of expression.
The experiences of journalists, citizens and other individuals affected by these laws also deserve consideration.
The broader lesson is that changing the name of legislation is not enough. Meaningful reform requires changes to the legal provisions themselves, the way authorities exercise their powers and the institutional safeguards that prevent abuse.
Fighting Misinformation Through Transparency
Combating rumours and misinformation is necessary, but criminal punishment should not be the only response.
The availability of reliable information, independent journalism, professional fact-checking and timely government communication can help prevent false claims from gaining traction. Citizens also need meaningful access to information so that they can evaluate competing accounts and make informed judgements.
When official information is delayed, incomplete or difficult to obtain, rumours may fill the resulting gap. Publishing accurate information promptly can help address uncertainty before misleading claims spread widely.
The state’s first response to false information should therefore include making verifiable facts available to the public. Criminal sanctions may be justified in cases involving clearly established offences, but they should not become a substitute for transparency or an easy means of silencing criticism.
Restricting the flow of information does not necessarily eliminate rumours. When reliable information becomes less accessible, misinformation may find more room to circulate.
A comprehensive cybersecurity strategy should combine effective law enforcement with public awareness, independent verification, transparent administration and respect for citizens’ right to know.
No Cybersecurity Law Stands Above the Constitution
Parliament, the government, the administration, the police, the Election Commission and the judiciary all exercise authority within Bangladesh’s constitutional framework. Their powers derive from the constitutional order and the authority vested in public institutions. None possesses unlimited power.
The Constitution establishes institutions and assigns responsibilities, but it also places limits on the exercise of authority. Protecting fundamental rights, individual freedoms and access to justice is an essential part of that arrangement.
Cybersecurity legislation must operate within the same constitutional boundaries.
The digital world should not be treated as a lawless space beyond the reach of legitimate regulation. Equally, it should not become an area in which the state can exercise unrestricted control over citizens’ activities, communications and opinions.
Cyberspace is part of the wider civic environment in which people work, communicate, conduct business and participate in public debate. Any legal framework governing it must recognise both the need for security and the importance of individual rights.
This requires clearly defined offences, fair investigations, appropriate judicial scrutiny, proportionality in the exercise of powers, independent oversight and effective remedies for those affected by unlawful action.
Three questions should remain central to the design of any democratic security law: what may the state lawfully do, what must it not do, and what recourse do citizens have when the state exceeds its authority?
Without credible answers to these questions, cybersecurity legislation risks falling short of democratic standards.
State Reform Must Begin with Accountability
The wider debate over state reform in Bangladesh following the July uprising has placed renewed emphasis on the structure of public authority and the way it is exercised. Reform cannot be considered complete if it fails to protect citizens’ rights, freedoms and dignity.
Cybersecurity legislation should be part of that process rather than an exception to it.
The ultimate challenge is not simply how to give the state sufficient power to combat cybercrime. It is how to ensure that the exercise of those powers does not expose citizens to arbitrary restrictions, unnecessary surveillance or the suppression of legitimate dissent.
The greater the authority granted to the state, the stronger the constitutional limits and accountability mechanisms must be.
A democratic republic should seek to make citizens safer without placing the state beyond scrutiny. Its laws may be firm, but their enforcement must remain consistent with justice and fundamental rights. Government institutions must be capable of protecting the public while remaining answerable to the people they serve.
The guiding principle should be straightforward: cybersecurity legislation must protect citizens, not turn their private lives and public expression into objects of unrestricted state control.
The state is not the guardian of the people in the sense of deciding what they should see, say or think. It is their servant, entrusted with public power for a defined purpose.
Protecting citizens from criminals is an essential responsibility. Protecting them from the misuse of state power is equally important. A just and democratic republic must do both.
