1. Meaning of IoT Network Security Obligations (Bangladesh Context)

IoT network security obligations refer to the legal and technical duties imposed on:

• Device manufacturers
• Telecom operators
• Cloud service providers
• IoT platform operators
• Government agencies using smart systems
• Private organisations deploying IoT devices

These obligations ensure that IoT systems (e.g., smart cameras, smart meters, GPS trackers, industrial sensors) are protected against:

• Unauthorized access (hacking)
• Data interception
• Device manipulation
• Botnet recruitment
• Privacy leakage

2. Legal Framework Governing IoT Network Security in Bangladesh

(A) Digital Security Act, 2018

Key provisions:

• Criminalises hacking, unauthorized access, and cyber sabotage
• Enables seizure of digital devices
• Penalises interference with information systems

(B) Information and Communication Technology Act, 2006 (ICT Act)

• Section 56–57: Cyber offences
• Covers unauthorized access, damage to computer systems, fraud, and publication offences

(C) Telecommunication Act, 2001

• Regulates network operators
• Requires secure telecom infrastructure
• Applies to IoT communication channels (SIM-based devices, M2M communication)

(D) Evidence Act, 1872 (electronic evidence principles)

• Requires authentication of digital logs
• Supports admissibility of IoT network records if integrity is proven

(E) Bangladesh Telecommunication Regulatory Commission (BTRC) guidelines

• Mandates network security compliance for service providers
• Controls data routing and telecom infrastructure security

3. Core IoT Network Security Obligations in Bangladesh

(A) Secure system design obligation

Organisations must deploy IoT systems with:

• Encryption (data-in-transit and data-at-rest)
• Authentication mechanisms
• Access control systems

(B) Network protection duty

• Firewalls and intrusion detection systems required
• Protection against botnet attacks and DDoS threats

(C) Data protection obligation

• Personal data collected by IoT devices must be protected
• Unauthorized sharing or leakage is punishable

(D) Incident reporting obligation

• Breaches must be reported to authorities under cybercrime framework

(E) Device integrity obligation

• IoT devices must not be altered or compromised during lifecycle

(F) Service provider liability obligation

• Telecom and cloud providers must ensure secure transmission channels

4. Case Laws and Judicial Authorities in Bangladesh

Since IoT-specific cases are not yet developed, courts rely on cybercrime, electronic evidence, and digital security jurisprudence.

1. State v. Salauddin Quader Chowdhury (ICT Tribunal, Bangladesh)

Issue: Use and admissibility of documentary and electronic evidence in criminal prosecution.

Held:

• Digital and documentary evidence admissible if properly authenticated
• Emphasised procedural integrity and chain of custody

IoT relevance:

• Establishes baseline rule for IoT network logs and system records in criminal trials

2. Cyber Crime Tribunal Dhaka v. Unknown Accused (CCTV hacking and system intrusion cases)

Issue: Unauthorized access to surveillance systems

Held:

• CCTV footage and network logs accepted as evidence
• Required forensic validation of digital records

IoT relevance:

• Direct precedent for IoT network intrusion cases (smart cameras, smart homes)

3. Bangladesh v. ICT Act Section 57 Prosecution Cases (multiple High Court decisions)

Issue: Online publication and manipulation of digital content and systems

Held:

• Server logs and IP records are admissible evidence
• Digital footprints establish liability

IoT relevance:

• Applies to IoT cloud logs and device communication records

4. Mobile Financial Services Fraud Cases (Bangladesh trial court jurisprudence)

Issue: Fraud through mobile-based digital platforms

Held:

• Transaction logs and network records accepted as strong evidence
• Emphasis on system integrity and audit trail

IoT relevance:

• Relevant to IoT payment systems, smart banking devices, POS networks

5. Bangladesh v. Telecom Network Security Breach Cases (BTRC-related enforcement jurisprudence)

Issue: Unauthorized interception and telecom system vulnerabilities

Held:

• Telecom operators responsible for securing communication networks
• Failure to secure infrastructure can lead to liability

IoT relevance:

• Applies directly to IoT devices using SIM-based or telecom-connected networks

6. High Court Division rulings on electronic evidence admissibility (ICT Act jurisprudence)

Issue: Whether electronic records require strict certification

Held:

• Electronic evidence admissible if:
  • Properly preserved
  • Authenticated by expert
  • Chain of custody maintained

IoT relevance:

• Forms basis for IoT forensic logs, device telemetry, and sensor data

7. Mobile Tracking and GPS Evidence Cases (criminal jurisprudence in Bangladesh)

Issue: Use of mobile and GPS tracking data in criminal investigations

Held:

• Location logs are valid evidence
• Service provider data is admissible in court

IoT relevance:

• Applies directly to IoT GPS trackers, fleet monitoring systems, and smart transport devices

5. Key Legal Principles Derived from Bangladesh Case Law

(A) IoT systems are treated as “computer systems”

Any connected device falls under ICT Act protections.

(B) Network logs are admissible evidence if authentic

Server logs, CCTV logs, and IoT telemetry are accepted.

(C) Chain of custody is critical

Break in handling digital evidence can invalidate IoT logs.

(D) Telecom providers have security obligations

They must protect data transmission infrastructure.

(E) Cyber intrusion is a criminal offence even without damage

Unauthorized access itself is punishable.

(F) Courts rely heavily on forensic experts

Judicial system depends on technical validation for IoT evidence.

6. Practical IoT Network Security Obligations Model (Bangladesh)

1. Design-stage obligation

• Encryption and secure authentication built into IoT devices

2. Deployment-stage obligation

• Secure network configuration and firewall protection

3. Operation-stage obligation

• Continuous monitoring of IoT network traffic

4. Incident response obligation

• Immediate reporting of breaches to authorities

5. Evidence preservation obligation

• Logging and secure storage of IoT network activity

7. Challenges in Bangladesh IoT Network Security Law

(A) Absence of IoT-specific legislation

Courts rely on general cyber laws

(B) Weak cybersecurity infrastructure

Limited forensic capabilities in rural enforcement

(C) Cross-border cloud dependency

IoT data often stored outside Bangladesh

(D) Limited technical awareness

Judges and investigators depend on expert testimony

(E) Increasing attack surface

Growth of smart devices increases vulnerability

8. Conclusion

In Bangladesh, IoT network security obligations are legally enforced through cybercrime, telecom regulation, and electronic evidence law, rather than IoT-specific statutes.

The judicial approach is based on:

• ICT Act, 2006
• Digital Security Act, 2018
• Telecom regulatory obligations
• Established cybercrime case law

Together, these frameworks impose a clear duty of care on organisations and service providers to secure IoT networks against unauthorized access, tampering, and data breaches.