A series of dramatic developments has followed widespread outrage over a misogynistic post from the X account of Jamaat-e-Islami Ameer Shafiqur Rahman.
Despite failing to find evidence linking him to the alleged hacking of the account, the Detective Branch (DB) took Mohammad Sarwar Alam, an assistant programmer at Bangabhaban, into custody. The DB chief later said on Wednesday night that Alam had been arrested in a case filed by Jamaat.
Earlier that evening, the case was filed by Sirajul Islam, a member of Jamaat’s election management committee. Alam was granted bail on Thursday by a Dhaka court.
Analysts say the detention of a government official and police searches inside Bangabhaban – the president’s residence-cum-office – despite the absence of evidence of hacking, point to a replay of the so-called “Joj Mia drama”. DB officials themselves have said the arrest was made at Jamaat’s insistence.
The reference is to the aftermath of the 21 August 2004 grenade attack on an Awami League rally on Bangabandhu Avenue in Dhaka, which killed dozens of people and injured hundreds.
During the investigation, the Criminal Investigation Department produced a poor man from Senbagh in Noakhali, popularly known as “Joj Mia”, claiming he carried out the attack in exchange for money. The narrative later collapsed amid widespread criticism and is now widely regarded as a fabricated attempt to mislead the investigation.
Arif Reza, a sub-inspector of the prosecution department, said Alam was shown arrested on Wednesday night in a case filed under the Cyber Security Act at Hatirjheel police station. The investigating officer, Hatirjheel police station sub-inspector Khandaker Saleh Abu Naim, produced him before the court and sought his remand in jail.
Jamaat-aligned lawyer Abdur Razzak opposed bail on behalf of the complainant, while defence lawyer Md Alamgir argued for bail. After hearing both sides, the court initially reserved its order before later granting bail.
Meanwhile, Dhaka Metropolitan Police Detective Branch chief Shafiqul Islam said Alam’s involvement could not be confirmed before receiving forensic examination reports of his mobile phone and computer. Even so, when Alam was shown arrested, Hatirjheel police sought to distance themselves from responsibility.
When Shafiqul Islam announced the arrest, no other member of his team was present, and he avoided answering questions about the source of information or evidence on which the arrest was based.
Officials at Bangabhaban, however, said Jamaat’s cyber team or IT wing claimed that the party chief’s account had been hacked using Alam’s email ID. Acting on that claim, the DB picked him up from his residence and, after 12 hours of detention, announced his arrest. The DB, however, failed to specify any concrete evidence to support the claim.
X account analysis
TIMES of Bangladesh analysed the controversial post from the Jamaat ameer’s X account that triggered the backlash. It found that the phishing email alleged to have originated from the Bangabhaban email address [email protected] was received on 10 January at 12:12 pm.
This raises a key question: if the phishing attempt occurred on 10 January, why did the alleged hacking incident take place on 31 January? No clear explanation has been offered for the gap.
The ameer’s email inbox reportedly contains 5,679 unread messages. Given that he is believed to receive at least 50 emails a day, the January 10 message would likely have been buried under thousands of newer emails by 31 January, raising further questions about why such an old email would be opened on that date.
At a press conference, Jamaat’s IT expert Mahmudul Alam said it was not the X account that was hacked but the device itself. He claimed the account was already logged in on the device and that hackers posted after taking control of it.
Once the issue was detected, the X session on the device was terminated and the account password was changed at 5:09 pm. Such claims, however, require technical proof, not just statements.
Typically, a compromised device leaves forensic evidence, including malware traces, signs of unauthorised remote access, activity logs, session data and operating system security logs.
If a device truly came under external control, suspicious activity would also be expected in email, browsers or other applications. No such technical data has been made public.
Similarly, unauthorised access to an account usually leaves evidence of logins from unfamiliar devices or locations, including security alerts, unknown IP addresses or devices, and X login history. No such proof has been shown.
In such cases, system-generated security alerts – such as notifications of new logins, unusual activity or password changes – are typically sent by email. In this instance, only an email showing a self-initiated password change at 5:09 pm has been presented, with no record of other alerts.
Most importantly, if an account truly fell under someone else’s control, recovery attempts would normally involve the “forgot password” process, generating separate emails with reset links or verification codes. No such emails have been produced.
Jamaat has also claimed phishing-link emails were found. However, receiving phishing emails alone does not prove an account was hacked, as such messages are common. Phishing emails by themselves are not evidence of hacking; credible data and technical analysis are required.
If the account was genuinely hacked, there should also be records of contact with X’s support team – such as emails, ticket numbers or conversations – related to account recovery. No such documents have been disclosed, raising further questions about transparency.
What the post said
Last Saturday, a post from the Jamaat ameer’s X account triggered widespread criticism for its misogynistic content. The post said: “Jamaat’s position on women is not confusing or apologetic, but principled. We do not believe women should come to leadership. It is impossible in Jamaat. Allah has not permitted it. We believe that under the guise of modernity, pushing women out of the home exposes them to exploitation, moral decay and insecurity. This is nothing but prostitution.”
Confusion over the detention
As criticism mounted, Jamaat claimed the post was made after hacking the party chief’s X handle. On Tuesday afternoon, a Jamaat delegation went to Bangabhaban to lodge a complaint. Later that night, Alam was picked up from his residence in Rajarbagh.
Before his detention, a general diary was filed at Hatirjheel police station alleging the account had been hacked. At around 11pm on Wednesday, Shafiqul Islam announced at a press conference that Alam had been arrested.
However, several Detective Branch officials have said no evidence has been found linking Alam to the Jamaat ameer’s X post, adding that the decision to show him arrested was taken largely under political pressure.
