05/09/2025
𝐂𝐲𝐛𝐞𝐫𝐜𝐫𝐢𝐦𝐞 𝐢𝐧 𝐁𝐚𝐧𝐠𝐥𝐚𝐝𝐞𝐬𝐡: 𝐄𝐱𝐢𝐬𝐭𝐢𝐧𝐠 𝐋𝐚𝐰𝐬, 𝐂𝐡𝐚𝐥𝐥𝐞𝐧𝐠𝐞𝐬, 𝐚𝐧𝐝 𝐅𝐮𝐭𝐮𝐫𝐞 𝐏𝐚𝐭𝐡𝐰𝐚𝐲𝐬
A Full-Length Academic Paper
Abstract
Bangladesh’s rapid digital transformation has generated new risks and complexities in cybercrime. Following widespread criticism of the Digital Security Act (DSA) 2018, the Cyber Security Act (CSA) 2023 was enacted. Yet structural limitations remain along five axes: freedom of expression, definitional ambiguity, cross-border cooperation, data protection, and victim compensation. This paper critically examines (a) the existing legal framework, (b) institutional capacity, (c) comparative international practices (GDPR, Singapore, United States, India), and (d) the evolving challenge of AI-enabled cyber threats. Methodologically, it employs doctrinal legal research, comparative statutory analysis, and narrative synthesis of selected cases and policy reports. Findings reveal that while the CSA has introduced procedural reforms in arrests and bail, critical deficiencies persist in data protection legislation, MLAT/Budapest Convention-style cooperation, cyber tribunal capacity, and compensation mechanisms. Policy recommendations include (1) narrowly tailored statutory definitions, (2) a comprehensive data protection law with an independent regulator, (3) public–private–academic threat intelligence fusion platforms, (4) enhanced forensic and judicial capacity, and (5) nationwide cyber awareness and digital literacy campaigns.
Keywords: Cybercrime, Bangladesh, Cyber Security Act 2023, Data Protection, MLAT, GDPR, AI Security, Digital Rights
1. Introduction
The “Digital Bangladesh” initiative has expanded e-governance, online banking, mobile financial services, e-commerce, and health-tech. Alongside, cybercrime—such as phishing, ransomware, data breaches, identity theft, and deepfake-driven fraud—poses direct economic and national security risks [1]. The DSA 2018 attracted criticism for overbroad restrictions on free expression, prompting the CSA 2023 [2][3]. The central question is: how effective is this new law, where are the gaps, and what should future pathways look like?
Research Questions (RQs):
RQ1: Has CSA 2023 effectively balanced cybercrime prevention with human rights?
RQ2: What are the governance gaps in Bangladesh’s cybersecurity framework?
RQ3: What lessons can Bangladesh draw from international best practices (GDPR, Singapore, US, India)?
RQ4: How should law and institutions prepare for AI-driven cyber threats?
2. Background & Literature Review
Cybercrime is often described as a “borderless crime,” where offenders, infrastructure, and victims may lie in different jurisdictions, complicating investigation and prosecution [1][4].
Human Rights Lens: NGOs such as Human Rights Watch and ARTICLE 19 flagged the DSA’s vague provisions undermining free speech [2][3].
Regulatory Best Practices: The EU’s GDPR enforces strict rules on consent, purpose limitation, and breach notifications with heavy administrative fines [9]. In Singapore and the US, institutionalized public–private threat intelligence sharing and sectoral standards are key features [10][11].
Regional Developments: India supplements the IT Act 2000 with CERT-In and the Digital Personal Data Protection (DPDP) Act 2023 [7][12].
AI & Cybercrime: AI-enabled cyberattacks—deepfakes, automated exploitation, adaptive phishing—pose new evidentiary and regulatory challenges [8].
3. Legal & Institutional Context in Bangladesh
Cyber Security Act 2023 (CSA): Introduced procedural safeguards such as mandatory warrants (with limited exceptions), bail provisions, and investigation deadlines. Yet several provisions retain broad terms like sedition, hurting religious sentiment, or “anti-state propaganda” [2][3].
Other Relevant Laws are the ICT Act of 2006 (amended in 2013), Penal Code 18:60 (for online defamation and fraud), Po*******hy Control Act of 2012, and Consumer Protection Act of 2009.
Institutions: Police Cyber Unit, BCC/CERT-like initiatives, and cyber tribunals exist, but forensic labs, specialized manpower, and cross-border case-handling capacity remain limited.
4. Methodology
This study adopts a mixed research design:
1. Doctrinal Legal Research: Textual analysis of CSA 2023, DSA 2018, ICT Act, Penal Code, and related rules.
2. Comparative Regulatory Analysis: GDPR (EU), cybersecurity frameworks (US, Singapore), and India’s IT & DPDP Acts.
3. Narrative Synthesis: Analysis of policy reports, official publications, and selected cases [1–12].
4. Analytical Framework: Five evaluative axes—clarity, enforceability, cross-border cooperation, data protection, and remedies.
Scope & Delimitation: Focused on law and policy; no primary empirical surveys were conducted.
5. Findings / Results
F1. Normative Recalibration but Residual Overbreadth: CSA improved warrant/bail safeguards, but retains overbroad speech-related provisions [2][3].
F2. Enforcement Capacity Gap: Forensics, skilled human resources, and evidence-driven investigation remain inadequate [1][4].
F3. Weak Cross-Border Cooperation: Lack of robust MLATs and Budapest Convention-style alignment hampers evidence gathering [4][13].
F4. Absence of Comprehensive Data Protection Law: No GDPR-style framework ensures consent, minimization, or breach remedies [9].
F5. Remedy & Compensation Vacuum: Victims lack clear access to compensation, cyber insurance, or collective remedies.
F6. AI-Driven Threat Expansion: Deepfakes, targeted phishing, and automated exploits bypass signature-based defenses [8].
6. Discussion
6.1 Rights–Security Balance: Overbroad statutory language risks arbitrary application. Narrowly tailored provisions, as seen in GDPR-compliant regimes, achieve proportionality [2][3][9].
6.2 Institutional Readiness: Forensic-by-design practices—standardized chain-of-custoAsnd technically trained judSectoral ISAC-style models are urgent. As in the US and Singapore, Sectoral ISAC-style models are being adopted to improve resilience [10][11].
6.3 International Alignment: Adoption of Budapest Convention-style tools (dual criminality, expedited preservation, 24/7 points of contact) would accelerate cross-border cases [13].
6.4 Data Protection as a Pillar: GDPR and India’s DPDP Act demonstrate the necessity of consent-driven, regulator-supervised data protection [9][12]. Evidence provenance and global standards for deepfake disclosure, alongside AI-based anomaly detection and automated response systems, are essential [8].
7. Policy Implications
Legislative Drafting: Narrow definitions, graduated sanctions, and proportionality/necessity tests.
Regulatory Architecture: Independent data protection authority; mandatory breach notifications and DPIAs.
Public–Private–Academic Nexus: A National Cyber Fusion Center; sectoral ISACs; regular cyber drills.
Judicial & Forensic Capacity: Expanded cyber tribunals, technical assessors, accredited forensic labs.
The international MLAT channels and alignment with the Budapest Convention.
Citizen Awareness: Digital literacy campaigns in schools, universities, and MSMEs, including low-cost cyber insurance.
8. Limitations
Reliance on legal texts and secondary reports; no primary empirical survey.
Limited CISA studies; some international data may evolve.
Quantitative analysis absent; future research can expand here.
9. Future Research
Empirical Studies: Surveys and interviews with victims, investigators, prosecutors, and judges.
Economic Impact Modeling: Sectoral cost analysis of cyber incidents.
AI–Forensics: Deepfake detection, provenance tools (e.g., C2PA), evidentiary standards.
RegTech & SupTech: Compliance automation, standardized threat intelligence, breach simulations.
10. Conclusion
The CSA 2023 represents incremental progress over its predecessor but retains overbroad provisions and suffers from critical deficiencies in data protection, cross-border cooperation, forensic capacity, and victim compensation. A forward-looking roadmap—anchored in narrowly defined offenses, comprehensive data protection law, joint threat intelligence ecosystems, judicial/forensic empowerment, and digital literacy—is essential for a rights-respecting and investment-friendly secure Digital Bangladesh.
References
[1] UNODC. (2021). The Global Threat of Cybercrime.
[2] Human Rights Watch. (2022). “No Room for Criticism”: Bangladesh’s Crackdown on Free Speech under the Digital Security Act.
[3] ARTICLE 19. (2020). Digital Security Act: An Analysis of Key Provisions and Human Rights Concerns.
[4] Council of Europe. (2021). Mutual Legal Assistance and Cybercrime.
[5] Bangladesh Bank. (2022). Annual Report on Payment Systems.
[6] World Bank. (2020). World Development Report 2020: Trading for Development in the Age of Global Value Chains.
[7] MeitY, Government of India. (2021). National Cyber Security Strategy.
[8] Europol. (2022). Internet Organised Crime Threat Assessment (IOCTA).
[9] European Union. (2016/679). General Data Protection Regulation (GDPR).
[10] Singapore Government. (2018). Cybersecurity Act & CSA advisories.
[11] U.S. CISA. (2021–2024). Joint Cybersecurity Advisories & JCDC model.
[12] Government of India. (2023). Digital Personal Data Protection (DPDP) Act, 2023.
[13] Council of Europe. (2001, with Protocols). Budapest Convention on Cybercrime.
