By Dr Sanjana Hattotuwa, Senior Researcher

On 28 September 2026, I wrote to the Daily FT about the unprecedented, and significant threats arising from the 2026 version of the Protection of State Terrorism Act (PSTA). I ended by noting, 

Sadly, but unsurprisingly, the revised PSTA Bill is not the fundamental re-conceptualisation I urged the Ministry of Justice to consider in December 2025, since the machinery of executive detention, military policing, proscription and criminalised witnessing survives, placed now alongside a data protection law only partly in force and a constellation of other laws that reach what this one leaves out. Improvement measured against the PTA is a very low bar, and what matters is what these powers could do together, in the hands of any future government or even the incumbents, given that absolute power corrupts absolutely. 

The Supreme Court’s Special Determination on the PSTA bill is now public. It asks for 4 procedural amendments to the PSTA Bill, leaving the clauses that reach into our phones, platforms and personal data untouched, and beyond any challenge once the Bill becomes law.

The Supreme Court’s determination runs to 81 pages, and not once does it mention encryption or the Personal Data Protection Act (PDPA). Nor does it mention clause 8, the provision that most directly turns witnessing into a crime. Read with clause 74, it covers any information on “the conduct of any official activity” of the police or armed forces, with no test of secrecy or harm, and sharing it carries up to 15 years in prison, which means a Facebook post about a police raid, or a video of an arrest, could qualify.

The Court examined none of what I set out in September as the Bill’s information integrity core, including the clause 51 power to ban gatherings, which feeds straight into the clause 8 offence, and the clause 59 bar on publishing anything, in print or online, that furthers a banned group’s aims. It includes the Bill’s reach over Sri Lankans living abroad, its absorption of every group designated under the UN Act regulations, the liability of service providers and the rule that company directors are presumed guilty.

The determination is just as silent on phones, which clause 20 lets police and soldiers seize without a warrant and clause 49 lets them send on to local or foreign experts. Clause 16 makes it an offence to refuse to answer questions, while a person held in military custody for 24 hours has nothing in the Bill to stop a soldier demanding a passcode or pressing a detainee’s finger to the screen during that time. Clause 64 creates a central database, and clauses 43, 49 and 50 allow seized data to be shared with foreign states.

Where the Court did engage, as with the clause 15 duty to tell the police about anyone suspected of an offence under the Act, it relied on section 126 of the Evidence Ordinance, which protects only lawyers and notaries. That all but confirms there is no protection for journalists guarding their sources, for clergy, for WhatsApp group administrators or for family members, even as the Court called a defence the accused must prove “salutary”. What I called interaction design in August, meaning the way this Bill works alongside the Online Safety Act (OSA), the draft NGO law and the digital identity system, was dismissed in advance as “surmise and conjecture”.

The Court requires 4 amendments, to clauses 26(2), 59(5)(b), 60(7) and 66(1), and all 4 deal with court procedure and where judicial review is heard, without touching any of this, which means the PSTA can pass with every one of these gaps intact.

On detention, the PSTA is lighter than the Prevention of Terrorism Act (PTA), and the Court’s comparative chart is right on that count. Executive detention falls from 12 months to 2 before the High Court must approve more, confessions to police are no longer admissible and the mandatory minimum sentence is gone. However, the PTA was drafted in 1979, long before smartphones, social media, end-to-end encrypted messaging, a national data exchange or a diaspora that organises online. The PSTA writes counter-terrorism powers straight into phones, platforms, databases and the feeds of citizens living abroad, and it does so through offences tied to any offence under the Act, not to terrorism itself.

Article 80(3) of the Constitution then seals it, since once a Bill becomes law no court may question its validity on any ground. The clauses the Court chose not to examine can never be challenged after enactment, and only how they are used can be contested, case by case, after the damage is done.

The PTA never had legitimacy, since decades of criticism from UN human rights experts, and the European Union tying its GSP+ trade concessions to reform, made it a byword for abuse, whereas the PSTA arrives with a Supreme Court certificate declaring its definition of terrorism consistent with international standards. Governments, donors and diplomats will cite that certificate for years, even though it rests on a UN Special Rapporteur’s report whose own paragraph 69, quoted in full in the determination, recommends against covering damage to property at all.

The PTA’s own title calls its provisions temporary, whereas the PSTA’s proscription orders banning organisations never expire, and its database has no limit on how long records are kept. The PDPA rights to see, correct or erase your personal data, meanwhile, are left out of the order that brings the rest of that law into force on 1 January 2027.

To wit, this is a PTA with more invasive clauses, a far longer reach into the digital lives of citizens, permanent by design, and now with the SC’s imprimatur of legitimacy. Every power that matters, from proscription to the Defence portfolio to the appointment of the Online Safety Commission, rests with an Executive Presidency this government promised to abolish, but is now seemingly content to keep.