Revised, not reformed: The PSTA Bill (2026) from an information integrity perspective

Sadly, but unsurprisingly, the revised PSTA Bill is not the fundamental re-conceptualisation I urged the Ministry of Justice to consider in December 2025, since the machinery of executive detention, military policing, proscription and criminalised witnessing survives, placed now alongside a data protection law only partly in force and a constellation of other laws that reach what this one leaves out. Improvement measured against the PTA is a very low bar, and what matters is what these powers could do together, in the hands of any future Government or even the incumbents, given that absolute power corrupts absolutely 

The Government has published a revised Protection of the State from Terrorism Bill in a Gazette Supplement dated 18 September 2026 and released on 22 September.1 

Ambika Satkunanathan’s analysis in the Daily FT on 26 September sets out what has changed and what has not, and I share most of her concerns.2 They fall under scope, supervision and sunset, starting with a definition of terrorism that, though modelled on the UN Special Rapporteur’s, still covers damage to property, the environment, cultural sites and electronic systems even where no life is at risk. On supervision, soldiers and coast guard officers keep police powers with no clear line of command, the Defence Secretary still issues detention orders that a Magistrate must enforce, the “Independent” Review Committee only advises the Minister who appoints it, and police may ban gatherings before any Magistrate approves. On sunset, proscription orders never expire, restriction orders have no outer limit, the President may direct how the law is enforced, and past offences will still be tried under the PTA, police confessions included. Her work on detention, militarisation and executive power and mine on communications, privacy and information integrity meet at the same point, which is how much of this machinery still rests with the Ministry of Defence and with an all-powerful Executive Presidency the current Government does not want to abolish.

What has improved

Several changes deserve acknowledgement, beginning with the deletion of section 55 of the 2025 draft that let a Magistrate order any provider of encryption to “unlock or unencrypt” communications and authorised interception of calls, email and “any communication through any other medium”, while section 53 let police demand data from telecommunications and internet companies. Neither appears in the new Bill. The duty to report terrorism offences now excuses information that is legally protected, covered by professional secrecy or self-incriminating. Recklessness no longer suffices for the speech offences, which now protect journalism, research, human rights documentation, satire and dissent, and state that mere expression without intent to incite, and without a “real and objective risk” of terrorism, is no offence. A new public-interest defence covers gathering or sharing sensitive information. Soldiers must hand seized items to the police “forthwith”, a Magistrate decides what happens to them, and police interviews must be recorded on video. Restrictions on photographing “prohibited places” must be “narrowly tailored” and must not unduly interfere with journalism. Many of these changes follow, sometimes almost word for word, recommendations that seven UN mandate holders sent the Government in February 2026.3

Witnessing remains a risk

The Bill still makes documenting the security forces extremely risky, especially given the enduring militarisation of the North, and the asymmetrical impact of state surveillance against Tamils, Muslims, minorities, and human rights activists. It punishes anyone who gathers or shares “confidential information” knowing, or having “reasonable grounds to believe”, that someone will use it to commit an offence under the Act (section 8). The drafters narrowed part of the definition, so information about the whereabouts of officials now counts only if it is not already public and could harm national or public security, but they left another part untouched. Confidential information still includes “any information relating to the police or the armed forces, on the conduct of any official activity”, whether planned, under way or finished, with no test of secrecy or harm at all (section 74). A Facebook post about a police raid, a WhatsApp message warning neighbours of a cordon-and-search, or a video of an arrest all fit.

What turns this into a real risk is the phrase “an offence under this Act”, which no longer means only terrorism. It includes disobeying a police directive under section 51, which lets the officer in charge of a police station, in urgent cases and before any Magistrate sees it, order people not to gather in a place or hold a meeting, rally or procession, and cordon off the area - something to bear in mind around the potential for pro-democracy movements like 2022’s aragalaya in the future, and mass mobilisation. Read literally, anyone who tells others where the police cordon is, while having reason to believe they will defy the ban, supplies confidential information for use in an offence under the Act and faces up to 15 years in prison. The public-interest defence helps, though it is a police officer who decides, at the moment of arrest, whether the public interest “outweighs the harm”, and the Bill never says whether the accused or the state must prove it. Narrowing the definition of terrorism does nothing to close this route.

Recipients as informants

The duty to report, which remains the Bill’s quietest form of surveillance, means that anyone who knows or has “reasons to believe” that another person is preparing, attempting or has committed an offence under the Act, and does not tell the police, faces up to seven years in prison (section 15). The new exceptions cover lawyers, but probably not journalists protecting sources or priests hearing confession, because the Bill does not define “professional secrecy” and Sri Lankan law, as far as I know, treats neither relationship as privileged. They offer nothing to WhatsApp group administrators, moderators of diaspora Facebook pages or family members, and anyone who relies on an exception must prove it themselves. End-to-end encryption keeps material safe in transit, but never from a recipient whom the PSTA compels to report it.

Devices and decryption

Removing section 55 took away a power without touching the capability, since police, soldiers and coast guard officers can still seize any “document, thing or article” on reasonable suspicion and without a warrant (section 20), which includes phones, laptops and memory cards. The officer in charge of a police station can then send them to the Government Analyst “or to any other local or foreign expert”, needing a Magistrate’s approval only for a foreign expert (section 49). Wilfully failing to answer a police officer’s questions during an investigation is an offence (section 16), with protection only against self-incrimination. A soldier who makes an arrest has up to 24 hours before handing the person to the police, and the 48-hour limit for reaching a Magistrate starts only after that. Nothing in the Bill stops anyone demanding a passcode, or pressing a detainee’s finger or face to a phone, in that time, and military questioning, unlike police interviews, need not be recorded.

The old section 55 at least placed a Magistrate between investigators and encrypted content. Its removal leaves access to devices with general seizure powers and with laws already in force, since the Anti-Corruption Act and the Proceeds of Crime Act permit the unlocking and decryption of devices and the interception of communications, in most cases on ex parte applications, which means without the affected person knowing or being heard.4

Online content and the diaspora

The new protections for journalism, research and dissent apply only to the two speech offences in sections 9 and 10, and do not reach proscription. A proscription order may bar “any person from publishing any material, including printed or online publishing, in furtherance of the objects” of a banned organisation (section 59), and breaking any order made under the Act is itself an offence. The Bill also folds every organisation banned under the PTA, and every entity designated under United Nations Act regulations, which have at times included Tamil diaspora groups, into its list of proscribed organisations. Because the Act applies to Sri Lankan citizens anywhere in the world (section 2), a dual citizen in Toronto or London whose posts the authorities read as furthering a listed group’s objects sits within its reach. Platforms and internet providers are not out of the picture either, since providing “a service” that lets others obtain a terrorist publication remains an offence (section 10), and every director of a company that commits an offence under the Act is deemed guilty unless they prove otherwise (section 67).

Personal data, and the PDPA

The Bill says nothing about personal data, and that silence matters more now than it did in December. The Personal Data Protection Act (PDPA) of 2022, amended in 2025, requires anyone handling personal data to collect it for a specified purpose, keep only what is necessary, keep it accurate and hold it no longer than needed.5 Data about offences and criminal proceedings, and data revealing ethnicity, religion or political opinion, form “special categories” requiring extra care. The Bill’s new central database (section 64) records every arrest, detention, remand, bail, discharge, acquittal and conviction under the Act, yet says nothing about who may see it, how long records stay, how errors are corrected or whether a person discharged or acquitted can ever have their name removed, so under the PDPA’s own terms it holds special-category data by definition.

The PDPA treats processing for criminal investigations as lawful whenever another law permits it, with safeguards that have never been written, so it offers far less protection than its title suggests. Both laws claim to override all others (PDPA section 3, PSTA section 70), and the newer counter-terrorism law is likely to win. The PDPA also lets organisations refuse requests to see, correct or erase data on national security grounds (section 17), and since 2025 the Data Protection Authority can no longer stop unsafe high-risk processing.

The President’s July 2026 order compounds this by leaving out the parts of the PDPA that give people the right to see, correct or erase their data, along with the requirement that any exemption be “necessary and proportionate”, when the rest comes into force on 1 January 2027.6 Someone arrested in 2027 and released without charge could therefore find their name in a police database with no legal way to see or remove it. The Bill also lets investigators share seized devices and evidence with foreign experts and states (sections 43, 49 and 50) without any of the safeguards the PDPA requires when personal data leaves the country.

Interaction design

None of this operates alone, or is designed to, which is why in August I argued that the gravest danger in Sri Lanka’s recent laws lies in what I called interaction design, the way powers in one law can be reached through another.7 The revised Bill slots into that architecture, which is easiest to see through the case of a Tamil journalist documenting a mass grave excavation in the north, a scenario which the Counter Terrorism Investigation Department’s summons of the Mullaitivu Press Club president over reporting on Chemmani in August 2025 shows is not hypothetical.8 The Secretary to the Ministry of Defence could declare the site a prohibited place and restrict photography, and posts about police activity there fall within confidential information. An Online Safety Act complaint could allege a false statement and seek the identity of accounts sharing the material, a seized phone could go to an expert and the journalist’s name into the PSTA database, while the draft NGO law would already have registered the organisation supporting the work, with its staff, funders and premises. A digital identity system and national data exchange then connect each record to the next. The President appoints the Online Safety Commission, would proscribe organisations under this Bill and holds the Defence portfolio whose Minister and Secretary run it, and none of this requires an emergency to be declared.

What should change

If Parliament is to pass a counter-terrorism law, the part of the confidential information definition covering police and military activity should carry the same secrecy and harm tests as the rest. The confidential information offence and the duty to report should attach only to terrorism itself, not to any offence under the Act, and the state should carry the burden of disproving a public-interest or professional-secrecy defence, with journalists and clergy named expressly. Examining a seized device should require a Magistrate’s order naming the device, the data sought and the period covered, and no one should be compelled to unlock a device before reaching a Magistrate. The speech protections should extend to proscription orders. The central database needs defined purposes, access rules, retention limits and deletion on discharge or acquittal, and the Bill should subject all processing expressly to the PDPA, whose remaining parts should come into force before this law does.

Sadly, but unsurprisingly, the revised PSTA Bill is not the fundamental re-conceptualisation I urged the Ministry of Justice to consider in December 2025, since the machinery of executive detention, military policing, proscription and criminalised witnessing survives, placed now alongside a data protection law only partly in force and a constellation of other laws that reach what this one leaves out. Improvement measured against the PTA is a very low bar, and what matters is what these powers could do together, in the hands of any future Government or even the incumbents, given that absolute power corrupts absolutely. 

(Endnotes)

1Protection of the State from Terrorism Bill, L.D.-O 37/2026, Supplement to Part II of the Gazette of the Democratic Socialist Republic of Sri Lanka of 18 September 2026 (issued on 22 September 2026). https://www.documents.gov.lk

2‘Revised’ Protection of State from the Terrorism Bill: What’s changed and what remains. Dr Ambika Satkunanathan, Daily FT, 26 September 2026, https://www.ft.lk/columns/Revised-Protection-of-State-from-the-Terrorism-Bill-What-s-changed-and-what-remains/4-797767 

3Communication OL LKA 1/2026 from seven UN special procedures mandate holders, 9 February 2026. https://spcommreports.ohchr.org/TMResultsBase/DownLoadPublicCommunicationFile?gId=30742

4Anti-Corruption Act No. 9 of 2023, https://documents.gov.lk/view/acts/2023/8/09-2023_E.pdf; Proceeds of Crime Act No. 5 of 2025, https://documents.gov.lk/view/acts/2025/4/05-2025_E.pdf. See also The Anti-Corruption Act, and Prevention of Crimes Act: Putting civil society at greater risk through potential procedural overreach? Sanjana Hattotuwa, 9 December 2025. https://sanjanah.wordpress.com/2025/12/09/the-anti-corruption-act-and-prevention-of-crimes-act-putting-civil-society-at-greater-risk-through-potential-procedural-overreach/

5Personal Data Protection Act No. 9 of 2022, as amended by the Personal Data Protection (Amendment) Act No. 22 of 2025 (certified on 30 October 2025). See in particular sections 3, 6 to 9, 17, 25, 26 and 40, and Schedule IV.

6Order under section 1(3) of the Personal Data Protection Act, Gazette Extraordinary No. 2498/16 of 22 July 2026, appointing 1 January 2027 for sections 2 and 3 and Parts I and III. https://www.dpa.gov.lk/Gazet/2498-16_E.pdf

7A perfect storm: Digitalisation, new laws, draft bills, and threats to civic space in Sri Lanka. Sanjana Hattotuwa, 14 August 2026. https://sanjanah.wordpress.com/2026/08/14/a-perfect-storm-digitalisation-new-laws-draft-bills-and-threats-to-civic-space-in-sri-lanka/

8Fragments, not architecture: how a Digital Rights Foundation report’s Sri Lanka chapter misreads a pervasive surveillance state. Sanjana Hattotuwa, 20 June 2026. https://sanjanah.wordpress.com/2026/06/20/fragments-not-architecture-how-a-digital-rights-foundation-reports-sri-lanka-chapter-misreads-a-pervasive-surveillance-state/