Law Minister Anisul Huq recently stated that he thinks the misuse of the Digital Security Act, 2018 will stop after the enforcement of the proposed Cyber Security Act. He said the problems (that is, some sections of the DSA) which worried the journalist community would be gone, and so the harassment of journalists would also stop. It is supposedly not an "old wine in a new bottle."

Read more

Cyber Security Act: Only fine, no jail time for defamation

However, just a casual look into the draft CSA will prove to anyone that the optimism expressed by the law minister is entirely unfounded.

One of the most prominent critiques of the current DSA came from the Office of the United Nations High Commissioner for Human Rights (OHCHR) in the form of the OHCHR Technical Note to the Government of Bangladesh on review of the Digital Security Act, published last year. In the report, the UN body highlighted three major issues with the DSA. Firstly, the vague and overly broad provisions of the DSA criminalise various legitimate forms of expression with overly harsh sentences. Secondly, the powers granted to the police and the Bangladesh Telecommunications and Regulatory Commission (BTRC) are far too broad. Thirdly, the offences stipulated in the DSA are non-bailable and allow pre-trial detention.

Read more

From DSA to CSA: Key areas of concern stay

Of course, one has to give credit where it is due. Under the drafted CSA, the significant positive changes include making several non-bailable offences bailable and also cancelling provisions for repeat offenders.

However, the key issues arising from vague provisions and the broad powers of police and the DSA enforcing agency remain totally unaddressed. Therefore, the function of the DSA as a tool for suppressing freedom of speech is entirely untouched by reform.

Read more

Cyber Security Act and the fear of history repeating itself

I would like to focus on a particular part of the CSA, which encapsulates the worst aspect of this problem.

When the ICT Act was replaced with the DSA in 2018, the government repealed Section 57 of the ICT Act, but all its provisions were included in four separate sections of the DSA. Namely, Sections 25, 28, 29, and 31. Of all the cases filed under the ICT Act, 65 percent were under Section 57. Since the DSA came into effect, the number of cases filed under the aforementioned four sections have exceeded 1,500, according to data collected by the Centre for Governance Studies. Almost one-third of all cases filed under the DSA are under Sections 25 and 29, mainly for defamation.

The UN human rights office observed that Section 25 – which criminalises "offensive, false or threatening data information" – and Section 29 – which criminalises "defamatory information" – of the DSA relate to acts considered civil liability issues in many other countries. The OHCHR also noted that these sections "do not include defences, such as the defence of truth or a defence for public interest in the subject matter…"

Simply allowing bail does not address the issue of why and how these two sections are being misused. Instead, by keeping the defamation clauses as a criminal offence subject to a fine of Tk 25 lakh, the process of suppression has been streamlined.

— Zillur Rahman

The core problem of these two sections in the DSA is that they are considered "desacato laws," meaning that they are laws which penalise offensive expressions directed at public officials and restrict freedom of expression and the right to information. These two sections are the most misused of the DSA, and are primarily used to target journalists and members of opposition political parties.

In the new CSA, the clauses under Sections 25 and 29 have been untouched. Simply allowing bail does not address the issue of why and how these two sections are being misused. Instead, by keeping the defamation clauses as a criminal offence subject to a fine of Tk 25 lakh, the process of suppression has been streamlined. It has to be understood that Tk 25 lakh is not pocket change for the average Bangladeshi citizen. For many in the middle class, especially those who are young, that amount equals their life savings. By adopting this approach, the police may no longer have to bother tracking down the accused individual, go through the hassle of picking them up and filling out the paperwork. Instead, fines can be easily sent out in mass against a large number of targeted people, who will inevitably fail to pay the exorbitant fine and will later be collected by police whenever it is convenient for the latter.

Read more

Cyber Security Act will not stop criminalising freedom of expression

The OHCHR has repeatedly stated a general view, under international human rights law, that defamation should be decriminalised as it discourages the media from publishing critical information on matters of public interest, thus posing a threat to freedom of expression and access to information of all kinds, and impeding journalists' legitimate work performance. Thus, the OHCHR is concerned that these sections fall short of Article 19(3) of the International Covenant on Civil and Political Rights (ICCPR). Bangladesh has been a party to the ICCPR since September 2000.

Similar to the findings of the OHCHR, an analysis by the Sampadak Parishad (Editors' Council) stated that Section 25 of the DSA directly affects all investigative reporting in the media. Such reports are usually about some irregularities performed by institutions and individuals. Corrupt people might use this law to intimidate journalists and media organisations, and try to prevent the publication of such stories on the pretext that the reports have attacked or intimidated them. Regarding Section 29, they restated that a law already exists to deal with defamation, so a separate law for digital media is unnecessary.

Read more

Why Sampadak Parishad opposes the Digital Security Act

The way to stop the CSA from being used against freedom of speech would be to turn the acts under Sections 25 and 29 into civil liability issues instead of criminal ones. For this, three things have to be ensured. Firstly, the criminal defamation laws have to be replaced with civil laws that are more narrowly defined. Secondly, only the party who is the alleged victim of defamation or harm to reputation should be allowed to file a case against the alleged perpetrator. And lastly, the sections must include defences and exemptions in regards to defamation, such as the defence of truth or a defence for public interest in the subject matter of the criticism.

Zillur Rahman is executive director of the Centre for Governance Studies (CGS) and a television talk show host. His X handle is @zillur

Last week, British director Daniel Gordon's new documentary Billion Dollar Heist was released. The film highlights the seriousness of cybersecurity issues the world faces today. Unfortunately, the subject of Gordon's documentary is our central bank, the Bangladesh Bank, which was almost robbed of around a billion dollars by hackers in one of the worst instances of cybercrime in the world. Reviews published in some of the leading international newspapers, including The Guardian and The Financial Times, remind us that the 2016 heist remains quite a mystery.

Nearly three years after the heist, our government enacted the Digital Security Act, 2018, promising it to be "an Act to make provisions for ensuring digital security and identification, prevention, suppression and trial of offences committed through digital device and for matters ancillary thereto." But instead, from its beginning, it has been another tool for suppressing free speech and political dissent in the country. According to Law Minister Anisul Huq, as of January 31 this year, more than 7,000 cases have been lodged under this law since its enactment. This means that, on average, 4.5 cases are filed under the DSA each day. The number of people sued and arrested has not been released by the government, but could be speculated to be three to four times the number of cases. This clearly indicates that the DSA has been weaponised to intimidate and harass dissenters.

Read more

Cyber Security Act and the fear of history repeating itself

In more recent years, there have been quite a few instances of serious security breaches that one would have thought could not happen following the lessons learnt from the Bangladesh Bank heist. The latest in this series of shocking failures was a 38-hour shutdown of our NID server and trouble with a few other critical networks following threats from hackers, allegedly from outside Bangladesh. Before this, there was a breach into more than 50 million Bangladeshis' personal information, which remained unnoticed by the local authorities until a South African cybersecurity expert, Viktor Markopoulos, went public with the information (following weeks of waiting) to draw the attention of the authorities responsible for keeping the data secure.

After nearly five years of resisting the demand for scrapping the DSA, both from within the country and from international development partners and rights groups, the government has now decided to replace the law. Unfortunately, the publication of its replacement, named the Cyber Security Act (CSA), is already another disappointment.

In a world where most democracies reform their cyber laws to provide better protection for their citizens' freedom of expression and right to privacy, Bangladesh is moving in the opposite direction and instead criminalising dissent and critical views.

— Kamal Ahmed

The most contentious provisions of the DSA – which have been viewed as a harsh deterrent to free speech – Articles 21 and 28, have been retained practically unaltered, save for a nominal reduction of sentences. Provisions related to the authority for removal of content, search and seizure of devices, and arrest of suspects without warrants given to law enforcement agencies also remain unchanged. Rights groups have been alleging that such abuses have inflicted great suffering on thousands of activists and innocent citizens, not to mention they caused the death of writer Mushtaq Ahmed under custody.

Despite the reduction of sentences and allowing of bails on a few of the offences which were previously non-bailable, experts have pointed out that the unchanged vagueness and the wider scope of the act's application will likely be the most worrying aspects of the proposed CSA. They have argued that the retention of about nine articles from the DSA will continue to impede independent journalism and freedom of expression and opinion. Changing the name of the law and the implementing agency perhaps symbolises all that is proposed by the government: a simple relabelling of a tool of suppression.

Ministers have said innumerable times that the DSA is not very different from that of most other countries. Some of them even questioned whether digital regulations in Western countries were actually less repressive. In an interview on May 2, Prime Minister Sheikh Hasina told US broadcaster Voice of America's Bangla service that the digital security law does not exist only in Bangladesh, but in all other countries of the world. Furthermore, the PM said that her government was looking into the contents included in the digital laws of other countries, such as the US, the UK, and in European countries. She also added that if it is discovered that there are punishments in the laws of these other countries which are tougher, then those sections in our law, too, will be reformed.

The draft CSA does not hint, however, that the government has examined relevant laws in either the US or the UK. Firstly, under the First Amendment of the US constitution, its citizens enjoy almost unfettered freedom of expression and opinion, be it online or offline. The United Kingdom, prior to January 1, 2021, was a member of the European Union and hence still follows EU principles and legislations in regulating cyberspace, especially in relation to the protection of citizens' rights. There are a number of national legislations in the EU regarding digital security, but all of them are aligned with the Convention on Cybercrime adopted in 2001 (otherwise known as the Budapest Convention) which has been ratified by 68 countries. Currently, negotiations are ongoing to improve it further and make it a global charter. The Budapest Convention states that signatories be: "Mindful of the need to ensure a proper balance between the interests of law enforcement and respect for fundamental human rights as enshrined in the 1950 Council of Europe Convention for the Protection of Human Rights and Fundamental Freedoms, the 1966 United Nations International Covenant on Civil and Political Rights and other applicable international human rights treaties, which reaffirm the right of everyone to hold opinions without interference, as well as the right to freedom of expression, including the freedom to seek, receive, and impart information and ideas of all kinds, regardless of frontiers, and the rights concerning the respect for privacy."

Read more

Cyber Security Act will not stop criminalising freedom of expression

Notably, in the digital security laws of other countries, the independence of law enforcement agencies (including police) is such that they can be guided by the law, not the whims of politicians. These countries also have powerful watchdogs which work free from government interference. With fast-changing technology, lawmakers are under pressure to update their legislations more frequently and, as a result, the EU enacted a new Digital Services Act (DSA) last year to make companies more transparent and accountable in relation to protecting citizens' rights (not the political ideology of a party or of the politicians in power). A similar legislation, the Online Safety Bill, is currently being considered by the UK parliament.

In a world where most democracies reform their cyber laws to provide better protection for their citizens' freedom of expression and right to privacy, Bangladesh is moving in the opposite direction and instead criminalising dissent and critical views. As a result, the state is increasingly infringing upon citizens' privacy. Relabelling the DSA as CSA is not the answer to making the law compliant with human rights standards. Our authorities must draw lessons from democracies.

Kamal Ahmed is an independent journalist. His X handle is @ahmedka1

The government has uploaded the draft cyber security law on the website of the Digital Security Agency yesterday night so that people can give their opinion on the proposed law, Law Minister Anisul Huq said today.

People will get 14 days to give their opinion on the proposed cyber security law, he said.

If necessary, the views of the stakeholders concerned will also be taken on the draft law, Haq said at a press conference on the cyber security law at the ICT Tower in Dhaka.

State Minister for ICT Zunaid Ahmed Palak was present at the event.

In the face of widespread criticism at home and abroad, the government decided to make a new law called 'Cyber Security Act' by making a number of changes in the controversial 'Digital Security Act'.

However, different stakeholders demanded more changes in the draft law.

The government has formed the new 'National Cyber Security Agency' which will replace the previous 'Digital Security Agency', according to an official gazette published on November 17, 2023. As per official sources, the Cyber Security Agency will be responsible for monitoring online communication and countering cyber crimes.

This newly formed agency is constituted under the Cyber Security Act 2023. According to the gazette, the Digital Security Agency formed under the previous law will be cancelled. 

Regarding this change, Abu Sayed Md. Kamruzzaman, Director General of the former Digital Security Agency, said, "We are looking forward to a fresh start. As the new gazette was published, we are revising our existing structure with the ministry and other stakeholders." 

After getting approval from the cabinet, the Cyber Security Act was passed in Parliament on September 13, 2023. The new act is an amended version to replace the controversial Digital Security Act 2018.