Cyber security must be strengthened

Dr. Ajoy Kanti Mondol

Let me start with a small event that happened to me recently. A few days ago I sent Tk 6,000 to my father’s bKash number. My father waited at a bKash agent’s shop to cash out the money. I sent the money through mobile banking, that is, from my bank to my father’s bKash account.

The bank sent me a message and an email saying my transaction succeeded. I called my father, and he said his phone got no message. I asked him to check his account, but no money had arrived there. Then I spoke to the bKash agent. I gave him the transaction number, and he checked it for some time.

He found that the money did arrive, but someone took it out at once from an unknown number. My father’s phone got no notice of the deposit or the withdrawal. I tried to learn the name and details of the person who took the money. Then I asked my father whether he ever shared his bKash PIN or any other details with anyone.

My father said a person once called him and claimed to be from the bKash office. The caller took some details, and my father shared the OTP that came to his phone. I understood at once that hackers broke into my father’s bKash account that very day. I told a police officer friend everything, and through him I learned the hacker’s details. My friend scared the hacker and told him to return the money, and he did.

So when people use the law and scare a criminal, the criminal often returns the stolen money. As far as I know, such incidents happen daily through bKash, Nagad, Upay and other money transfer services. Many cases come to light from time to time. But victims who seek legal help face extra harassment in practice. So in some cases the criminal returns the money, and in others he stays out of reach.

Falling victim to such digital fraud feels out of place in this digital age. Like the rest of the world, the internet is now a part of daily life in the country. We depend on the internet and digital technology for banking, shopping, education, health care, government services, office work and communication. These tools no doubt make city life easier and easier. But they also bring new kinds of risk.

Cyber criminals use computers, smartphones, the internet, digital networks and other digital tools to commit many crimes. They enter other people’s email or social media accounts without permission and steal passwords. They cheat people through online banking or mobile financial services. They build fake websites to take money from people. They blackmail people with private photos or videos.

They also spread malware, enter an organisation’s server without permission and steal important data. These days, criminals also use artificial intelligence to make fake photos, videos or audio to cheat or harass people. This is a new kind of risk. But in truth, cyber criminals stay out of reach. New technology will no doubt keep making people’s lives easier day by day.

If the number of cyber criminals grows at the same pace, we need both cure and prevention. Finding the main cause of the rise in cyber crime is very urgent. Let us now look at the laws the country made over the past two decades to fight cyber crime. The journey began with the Information and Communication Technology Act, 2006. Later the country made the Digital Security Act, 2018 and the Cyber Security Act, 2023.

But some provisions of these laws caused wide debate over their use, freedom of speech and misuse. In 2025, the government issued the Cyber Protection Ordinance and cancelled the 2023 law. Later it made that ordinance into law again as the Cyber Protection Act, 2026. The law says it took effect in 2025. The government has already made an amendment law in 2026 as well.

The present law has rules for investigating and trying cyber crimes. Section 31 of the law says the police or a fixed investigation officer will investigate, and it sets a 90 day limit to finish the investigation. The law also has rules to pay back people or organisations that a crime has harmed. But in reality, a country can have the best laws and still struggle to use them.

Success needs many things. The investigating agency needs technical skill, digital forensic facilities and trained staff. It must also investigate fast, keep evidence safe, and work with strong courts and international partners. We see this in our own country. We have the law, but people argue a lot over how the authorities use it.

Figures show that until 2024, the country’s eight cyber tribunals had 5,818 cases running in all. They came under the Information and Communication Technology Act, the Digital Security Act and the Cyber Security Act. Of these, 1,340 were “speech offence” cases, that is, complaints about what people said or published online. Later the government moved to withdraw a large part of them. It withdrew 410 cases filed between 2019 and 2024.

This shows an important weakness in Bangladesh’s cyber justice system. In the past, many cases came under the cyber laws, but not all were real cases of hacking, online financial fraud, data theft or technical cyber attacks. A large part of the old cases were complaints about social media posts, defamation or other publications. So the number of cases alone cannot tell us whether cyber crime is rising in the country.

On the other hand, there is plenty of proof that real digital fraud and harassment are a real problem. Published information says the Cyber Police Centre got more than 174,000 complaints from 2020 to 2025. But it took up only 2,789 complaints for investigation. Reports also say it recorded only 40 cases. Officials give two main reasons. They say complaints lack enough information and proof, and victims lack awareness.

Let us now look at the cyber security laws in the developed world. Developed countries do not see cyber security only as punishing people after a crime. They bring prevention, risk management, duties of organisations, data protection, fast reporting of attacks, emergency response and international cooperation into one framework. The European Union’s NIS2 Directive is a good example.

This system puts weight on cyber risk management and on reporting major cyber incidents in 18 important sectors. These include energy, transport, health, banking, water and digital infrastructure. In China, the punishment for a cyber crime depends on the nature and size of the crime. Serious crimes include entering a computer system without permission, collecting data illegally and taking control of a computer system. These crimes carry jail terms and fines.

The relevant part of China’s Criminal Law sets a jail term of up to three years in serious cases. In especially serious cases, it sets three to seven years. For a serious data leak, or major harm to the work of important information infrastructure, it fines the organisation a large sum. It also fines the responsible persons. It also allows fines and other administrative action against those who supply illegal software or tools made for attacking network security.

So China has visible and immediate punishment for cyber criminals. But it is quite hard for Bangladesh to copy the Chinese model exactly. Every country has its own political, constitutional, administrative and technical structure. Still, Bangladesh can learn from China in several areas. It can protect important information infrastructure separately and sort data into classes.

It can give big organisations fixed security duties, run regular security checks, and make sure the state responds fast to cyber attacks. The most urgent need for Bangladesh now is to move past the question of whether we have a law. We must ask how well the law works. Making more new laws will not stop cyber crime on its own.

The country must use the present laws well. It needs trained cyber investigators, modern digital forensic labs, skilled prosecutors and judges trained in cyber matters. It must settle cases fast. It must also build stronger ways to share information with international technology companies. The country must pay special attention to collecting and keeping digital evidence.

A criminal may commit a crime while sitting in Bangladesh, but his server may sit in another country. His money may sit in another country’s banking system, and he may use another platform to communicate. So cyber crime is often more complex than ordinary crime. The country must increase international cooperation to investigate such crimes. It is also important to raise awareness at the personal level.

Several habits make the work of cyber criminals easy. These include weak passwords, the same password in many places, clicking unknown links and giving OTPs to others. Installing unknown apps and sharing too much personal information on social media also help them. So we must not treat cyber security as the duty of law enforcement agencies alone. Citizens, organisations, banks, telecom companies and the state must all take part.

The government must publish a national cyber crime report every year. It must list the number of complaints, the types of crime, cases under investigation, chargesheets, cases on trial, settled cases, acquittals and convictions. Each figure must appear separately. Then it will be easier to see the true picture of the problem.

In the end, I want to say that cyber risks will keep changing as people use more technology. Today’s hacker may steal passwords. In the future, criminals may use artificial intelligence, deepfakes, automatic cyber attacks or even more complex technology. So it is not enough to make laws only for today’s crimes. The country must change its laws to keep pace with technology.

It must also build skilled people, strong institutions and aware citizens. So the fight to make the cyber world safe is not only a fight to make laws. It is a joint fight of technology, education, skills, awareness, investigation, trial and international cooperation. The country must not only hunt for criminals after a cyber crime. It must build a strong cyber security system that can spot and stop risks before a crime happens.

We must remember that many things are now part of security. These include a country’s bank servers, power control systems, hospital databases, citizens’ government records, telecom networks and the personal data of ordinary people. So cyber security is really an important part of national security, economic security and citizen security.