The shadow of Digital Security Act over the Cyber Protection Ordinance
VISUAL: SALMAN SAKIB SHAHRYAR
In the face of widespread criticism, the Sheikh Hasina government enacted the Cyber Security Act (CSA), 2023 by repealing the Digital Security Act (DSA), 2018, which had been used to suppress freedom of expression in Bangladesh. But the old repressive clauses were retained in the CSA. The interim government, which came to power on the back of a student-led mass uprising in August, is revoking the controversial CSA and enacting the Cyber Protection Ordinance (CPO), 2024. The draft, already approved by the Advisory Council, was made available online for review for only three working days. Issuing such an important ordinance without sufficient analysis and inclusive feedback from relevant stakeholders carries the risk of repeating history.
The Cyber Protection Ordinance elaborates the definition of cyberspace, incorporating emerging technologies including artificial intelligence. The definition of cyber protection includes the citizens' right to 24/7 internet access and data privacy. The ordinance mentions that eight controversial sections of the CSA have been cancelled along with the ongoing cases under it. In some cases, the terms of sentence have been reduced from the previous equivalent sections, the number of non-bailable clauses has been reduced, and anyone other than the person directly aggrieved or his/her appointee or a law enforcement member is barred from suing under the ordinance.
These are all positive changes. However, some provisions of the DSA (and the CSA) have been included in the CPO, through which civil rights and freedom of expression might be undermined. For example:
1. Similar to Section 8 of DSA and CSA, Section 8 of CPO empowers the Bangladesh Telecommunication Regulatory Commission (BTRC) to remove or block content that may undermine "national unity," "economic activity," "security," "defence," "religious values" or "public order," on request of law enforcement agencies and the director-general of the National Cyber Security Agency. There is no provision for disclosure of blocking statistics, judicial review, and explanation of why a content would be removed or blocked. If law enforcement agencies or bureaucrats are given the power to determine whether an online news report or content is harmful for "national unity," "economic activity," "security," "defence," "religious values" or "public order," there is always a risk of abuse. I think only in specific cases of "communal violence" can any content block be authorised, though there should be a mechanism for judicial review. That is, to prevent communal violence, there should be a system such that the judiciary will regularly review what content the BTRC has removed or blocked, and if any abuse is proven, the responsible person will be punished.
2. Section 25 (1) of DSA (and of CSA) made it an offence to "transmit, publish or disseminate any information with intent to annoy, insult, defame or degrade any person." Section 25 (1) of CPO also makes it an offence to transmit, publish or disseminate any information with intent to insult, harass or defame a person. This section specifically recognises "cyberbullying" as a crime. It is being argued that this provision has been included specifically for the protection of women and children. But the ordinance does not specifically mention women and children. What's the guarantee that people will not be oppressed by this provision, much like the defamation clause of the DSA?
Cyberbullying is a term that can be used to label any form of criticism that may be deemed to harass or abuse people. Acts considered to be cyberbullying, as defined in CPO, include posting false or harmful information, insulting messages, rumours or defamatory content. Just as through the DSA people were oppressed and harassed on the charges of "defamation" or "spreading false information," Section 25 (1) of CPO will also create a loophole to oppress and harass people on the charges of "cyberbullying." Moreover, every online platform has various mechanisms to tackle bullying, like blocking, reporting, etc. UNICEF has urged to enhance digital literacy, use various tools of online platforms and, where necessary, use the existing relevant criminal laws of the country to prevent cyberbullying. This is why rehabilitating the defamation clause of DSA in the name of protecting women and children from cyberbullying is not acceptable.
3. Section 28 of the Digital Security Act (and of the Cyber Security Act) criminalised hurting religious "values" or "sentiments," which was used to harass and oppress people during the previous regime. This DSA section has been incorporated in the Cyber Protection Ordinance, in a slightly modified form, as Section 26. The change includes the issue of spreading false information and hatred by hacking into another person's device. But distinguishing between genuine debate around religion or hurting religious sentiment is a delicate matter. If this is to be resolved through police, law and court, there is a chance of oppression and abuse. Therefore, this issue should be resolved socially through discussion and debate. Dragging the state into matters of religious faith is not beneficial at the end of the day. Therefore, Section 26 should be scrapped. If someone illegally accesses another person's device and spreads misinformation regarding religion, they can be punished under Section 18 of CPO for hacking.
4. Section 43 of DSA (Section 42 of CSA) empowered police to search, seize and arrest without warrant. This section has been included as Section 35 of CPO, with the provision of a new sub-section that provides that a person arrested without warrant will be produced before the nearest magistrate or tribunal "without delay." But this does not solve the core problem of this provision, which is the power given to the police to "search, seize and arrest without a warrant."
5. As in Section 54 of the repealed DSA (Section 53 of CSA), Section 47 (3) of Cyber Protection Ordinance makes "legitimate" cyber equipment accompanying "forfeitable" cyber equipment used in unlawful activities also forfeitable. This provision is completely unreasonable and can be used to harass individuals and institutions. If a piece of cyber equipment is legitimate and not used in the commission of a crime, there is no reason to seize it just for accompanying a piece of "forfeitable" cyber equipment.
6. The definition of "cyber protection" includes the citizens' right to 24/7 internet access and data privacy, but there is no mention of the punishment for violating these rights in the ordinance. As a result, these rights are likely to remain mere promises.
The people of Bangladesh have been deceived time and again in the name of amendment to oppressive laws. Section 57 of the Information and Communication Technology (ICT) Act, 2006 was repealed, but the provisions of that repealed section were included in the DSA. Then the nine sections of DSA that were identified as a threat to independent journalism and freedom of expression were incorporated in the CSA. This practice must not be allowed to continue through the Cyber Protection Ordinance, 2024.
Kallol Mustafa is an engineer and writer who focuses on power, energy, environment and development economics.
Bangladesh Defense
www.thedailystar.net
