UN approves controversial convention on cybercrime

United Nations member states have adopted the Convention against Cybercrime, ending nearly three years of negotiations.

However, many stakeholders, including NGOs and technology policy experts, have criticized the final text, raising concerns that it gives authoritarian regimes the opportunity to suppress political opposition and violate human rights.

Cybercrime Convention adopted by all UN Member States

The Comprehensive International Convention on Countering the Use of Information and Communications for Criminal Purposes (commonly known as the Cybercrime Treaty) was submitted to the UN by Russia in 2017. Its aim is to create a globally agreed legal framework to combat online fraud, scams and harassment.

In addition, it will be used to help define how countries investigate and criminalize cybercrime.

The final text, the UN Convention against Cybercrime, was adopted by consensus by all UN Member States on 8 August 2024, following a two-week meeting of the Ad Hoc Committee in New York.

The Ad Hoc Committee also approved a draft resolution providing for negotiations on an additional protocol to the Convention, addressing additional criminal offences.

Iran’s attempt to abolish human rights safeguards

Despite this final consensus, Pavlina Pavlova, an independent expert who took part in the negotiations, said Information security that the session in New York was marked by seven rounds of voting, requested by Iran, with the aim of lifting existing human rights safeguards.

It is striking that the Iranian UN delegation wanted to delete an article (Chapter I, Article 6) which stated: “Nothing in this Convention shall be interpreted as allowing for the suppression of human rights or fundamental freedoms.”

This request was rejected by 102 votes to 23, with 26 abstentions. Among those who supported Iran’s positive vote were Russia, India, Sudan, Venezuela, Syria, North Korea and Libya.

Final version of Cybercrime Convention heavily criticised

Many stakeholders have expressed their concerns about the adopted text.

In particular, Articles 28 to 30, which concern the search and seizure of electronic data, the real-time collection of traffic data and the interception of content data, are controversial.

Global Surveillance Threats

In a blog post, the Global Initiative against Transnational Organized Crime noted that while the treaty has some positive aspects, such as its explicit reference to human rights and a ground for refusal of mutual legal assistance based on non-discrimination, it also has numerous inherent risks that Member States will undoubtedly be closely monitoring.

The NGO criticised in particular the lack of oversight of nation states’ right to access and share e-data for use as evidence, which could pose a global threat to surveillance.

In addition, there are no measures for legal training or judicial oversight on the collection of electronic evidence, or how to properly use electronic data in building legal cases, including the security of personal data.

According to the Global Initiative, this raises the question of what is the point of providing assistance in the retrieval, collection and retention of data if this data could be declared inadmissible in future legal proceedings due to improper handling?

During previous negotiations, several NGOs, the Office of the United Nations High Commissioner for Human Rights (OHCHR) and the International Chamber of Commerce (ICC) have called for the deletion of Articles 28 to 30.

Threats of violation of fundamental freedoms

Another point of contention concerns a provision in Articles 29 and 30 that could give nation states more power to silence dissent and political opposition.

The Global Initiative pointed out that the clause would allow governments to adopt legislation requiring a service provider to keep confidential the exercise of a power under this article and any information related thereto.

A coalition of press freedom NGOs, including the International Press Institute and the Committee to Protect Journalists (CPJ), supported by the Electronic Frontier Foundation, called for the treaty to be rejected altogether.

Another member of the coalition, the Washington Post Press Freedom Partnership, said on X that “the treaty…could give governments around the world dangerous new spying capabilities to track and punish journalists, and give repressive regimes even more tools to target and muzzle the press.”

Speaking with Information securityNick Ashton-Hart, who led the delegation from the Cybersecurity Tech Accord organisation, which brings together more than 100 companies in the sector, including Microsoft and Meta, also expressed his concerns about the final text.

“Unfortunately, the UN Member States adopted the Cybercrime Convention (…) without addressing the major shortcomings identified by the private sector and civil society ahead of the session. In fact, the text was weakened on key points, notably with regard to human rights and safeguards against abuse,” he said.

“The poor wording of the criminalisation articles puts security researchers, whistleblowers and journalists at risk and allows Member States to force IT professionals to secretly break into secured systems, undermining global network security.”

Road to implementation

The final draft of the Cybercrime Treaty will be submitted to the General Assembly later this year for formal adoption. To become an official UN instrument, it will then need to be ratified by 40 UN member states.

Pavlova said it will take quite some time before the treaty enters into force.

“Many developing countries have also emphasized the importance of technical assistance and capacity building for implementation,” she said.

“Civil society and technology companies have shown unprecedented unity and warned that the proposed treaty could seriously harm rights and freedoms worldwide. Now they are still concerned about the human rights and privacy implications of the future treaty, and some may choose to boycott its ratification,” she added.

It remains to be seen how the controversial aspects of the treaty will be interpreted and implemented by the signatory states.

Photo credits: Viktor_IS/oliverdelahaye/Shutterstock