Bangladesh: 10 Years' Jail for "Unverified" Reporting

A law against publishing falsehoods sounds narrow. A law against publishing the unverified is not, because verification is a claim only the reporter can substantiate, and substantiating it usually means producing the person who told you.

Key Takeaways

• Bangladesh's Ministry of Information and Broadcasting has proposed amendments to the Cyber Protection Act creating a new offence for circulating "rumor" and "misinformation" online, according to a Committee to Protect Journalists alert issued on September 14, 2026.
• Material violates the offence if authorities decide it is "unsubstantiated or unverified" and it creates public confusion, panic or unrest.
• Penalties run to 10 years' imprisonment plus heavy fines before a specialised Cyber Tribunal, with courts empowered to suspend or cancel a news outlet's licence.
• Prothom Alo reported on July 30, 2026 that the draft numbers the rumour offence Section 26A and attaches a fine of up to Tk 4 million.
• At least 255 journalists were sued under the predecessor Digital Security Act between 2018 and 2023, and writer Mushtaq Ahmed died in custody in February 2021 after nine months in pretrial detention.

What Do the Draft Amendments Actually Criminalise?

They criminalise circulating information officials later classify as unverified, where it is judged to have caused confusion, panic or unrest. CPJ reported on September 14, 2026 that the Ministry of Information and Broadcasting discussed the amendments with selected media on September 10. Courts would also gain power to cancel an outlet's licence, turning one article into an existential risk for the newsroom that ran it.

Kunal Majumder, CPJ's Asia Pacific program coordinator, put it plainly: "The sweeping amendments to Bangladesh's Cyber Protection Act are so broad that they could undermine press freedom." Information Minister Andaleeve Rahman says the amendments aim at stopping disorder on social media and protecting social harmony.

Coverage differs on the name: CPJ calls it the Cyber Protection Act, Bangladeshi outlets report the same provision inside the Cyber Security (Amendment) Act. Prothom Alo published the draft language on July 30, 2026, defining a rumour as "any unsubstantiated or unverified information, news or claim that creates, or risks creating, confusion, panic, unrest or social instability among the public". The name on the bill has moved. The operative sentence has not.

Why Does an "Unverified" Offence Turn Into a Hunt for Sources?

Because the only defence is evidence of verification, and that evidence is the sourcing itself. A defamation case asks whether a statement was false. An unverified information case asks what you did to check it, and who you checked it with. Every credible answer names a person.

That inverts the pressure on a newsroom. Under a falsity standard, a reporter's notes are a shield they may raise. Under a verification standard, the prosecution acquires a direct evidentiary interest in those notes, and the fastest route to them runs through devices rather than witnesses. Front Line Defenders raised this about an earlier draft Cyber Protection Ordinance in January 2025, flagging warrantless searches, automatic pretrial detention for certain offences, and confiscation of digital materials. A phone seized at an airport and unlocked under duress is worth more to an investigator than any compelled testimony.

The law never has to mention sources to endanger them. It only has to make them the answer to the question it asks.

What Did the Digital Security Act Already Do?

It produced hundreds of lawsuits and one death in custody. At least 255 journalists were sued under it between 2018 and 2023. Writer Mushtaq Ahmed, arrested in May 2020 over Facebook commentary on the Covid response, died in Kashimpur prison on February 25, 2021 after nine months in pretrial detention and, his lawyer told CPJ, at least six denied bail applications. Ahmed was never convicted. The punishment was the process, and a tribunal plus pretrial detention delivers that whether or not a case succeeds.

The government changed in February 2026, when Tarique Rahman was sworn in as prime minister. The instrument did not change with it. We saw the same shape in Kuwait's revocation of two exiled journalists' citizenship and in the detention of two reporters in Pakistan: administrations swap, the machinery for reaching a reporter stays bolted down where the last one left it.

What This Means for a Reporter's Inbox

Under a law that asks who told you, the mailbox becomes the most valuable object a journalist owns, because the archive answers the question directly: names, dates, attachments, a reply chain reconstructing how a story was assembled. Encryption alone does not close that gap. The Electronic Frontier Foundation's guide to why metadata matters notes that metadata is "essentially everything except the content of your communications", and even a tiny sample "can provide an intimate lens into a person's life". Who emailed whom, at what hour, from which address, survives end to end encryption of the body. For a source inside a ministry, the contact itself is the disclosure.

A message from an unknown sender that loads a remote image also reports back the moment it is opened, with the IP address behind it. An ordinary marketing technique becomes a location check, on any client set to load images automatically. We covered the same exposure when CPJ warned about ad tech location data being used against journalists. A source who reads a test message from their desk at work confirms something they never meant to send.

What Should a Journalist or Source Do Right Now?

Reduce what a seized device reveals, and break the link between your identity and your reporting channels.

• Turn on disappearing messages for source conversations. CPJ's Digital Safety Kit recommends them on Signal or WhatsApp "if you are concerned about your phone being taken and your messages being accessed". This shrinks the archive on both devices. It does not stop screenshots or erase the fact that you spoke.
• Power devices fully off before any checkpoint or border crossing. CPJ says to power off "to activate disk encryption", and to treat any confiscated device as copied. A running phone with keys in memory is a far softer target than a cold one.
• Enrol two hardware security keys and turn on Google's Advanced Protection Program. Google requires a passkey or security key to sign in and tightens account recovery so recovery takes days rather than an SMS code. Two, because losing your only key drops you into that slow path. This defends against remote takeover, not a court order or a forced unlock.
• Take first contact from anonymous sources over SecureDrop and Tor. The Freedom of the Press Foundation's system does "not log your IP addresses, browser, or computer", the property email cannot offer; see securedrop.org. It protects the submission, not a source who later emails you from a work account.
• Disable automatic image loading in your mail client. In Gmail that is the "Ask before displaying external images" setting. An emailed beacon then cannot confirm you opened a message, or from where.
• Keep reporting accounts separate from identity linked ones. One mailbox per investigation, never tied to a phone number registered against your national ID. Compartmentation caps what a single seizure yields.

What to Watch Next

Most coverage leads with the ten year figure. The number that matters more is the one nobody will publish: how many sources inside Bangladeshi institutions stop answering. A long sentence deters the reporter who might be charged. A law that makes verification the state's evidentiary target deters the person who has not yet picked up the phone, and no index counts them.

The tell will be the first case where a court orders a journalist to produce sourcing to prove a story was checked. That is when this stops being a law about publication and becomes a law about the notebook. Until then, CPJ's Digital Safety Kit is the shortest practical starting point for reporters working under it.