Wendy Erickson
The United Nations is in the process of negotiating a landmark global cybercrime treaty, which if adopted, will be the first binding U.N. instrument on cybercrime. The treaty has the backing of Russia, China and a number of other countries. Negotiations over the scope and content of the treaty have been dominated by conflict between Western countries and treaty proponents. The draft version of the treaty contains controversial provisions that raise concerns about the extent of national governmental surveillance powers and the overreach of cross-border investigations into cybercrimes. Without further clarification of its scope, the cybercrime treaty could threaten human rights by endangering the privacy of personal information and facilitating the criminalization of free speech by repressive governments.
Establishing a U.N. cybercrime treaty could help alleviate the rapidly growing danger of data breaches and online criminal activity to individual privacy, corporate financial security, and national security. In December 2019, the U.N. established an open-ended ad hoc intergovernmental committee tasked with developing a comprehensive international convention on countering the use of information and communications technologies for criminal purposes. The U.N. decided that the committee would convene for at least six sessions and provide a draft Convention to the seventy-eighth session of the General Assembly in September 2023, with the aim of adopting the treaty in September 2024.
The proposed cybercrime treaty builds upon the established U.N. Convention against Transnational Organized Crime, adopted in 2000, as well as The Council of Europe’s Budapest Convention, adopted in 2001. The Budapest Convention defined the cybercrime offenses subject to investigation and prosecution narrowly and required that the specific data needed for criminal proceedings be secured subject to human rights and rule of law safeguards. The Budapest Convention has been signed by fifty countries, but has notably not been adopted by China, Russia, India, and Brazil. Russia has argued that the Budapest Convention is an outdated regional agreement that threatens principles of state sovereignty and non-interference. International consensus over the regulation of cybercrime has stalled in the past twenty years as Russia and China have pushed for the creation of the U.N. cybercrime treaty.
Negotiations of the cybercrime treaty have shown that the scope of cybercrime activities , cooperation on electronic evidence, and language on human rights safeguards are divisive issues. For the breadth of criminalization in the treaty, there is international agreement on the inclusion of cyber-dependent crimes, but widely different perspectives are reflected on the inclusion of cyber-enabled offenses. Some states, including Russia and China, advocate for a definition of cybercrime that would criminalize a broad range of cyber-enabled crimes, including offenses based upon posting prohibited content online. During recent negotiations, China proposed that the cybercrime treaty should criminalize the “dissemination of false information” while India has advocated for criminalizing offenses related to cyber terrorism. Other states, including the US, EU member states and the UK, are advocating for a more limited definition that includes a core set of cyber-dependent crimes and a very limited amount of cyber-enabled crimes such as child abuse and exploitation.
The current draft of the treaty would also expand the scope of evidence collection sharing for serious crimes across borders, even those that openly violate human rights law. Cooperation on electronic evidence not only poses human rights issues, but could violate the privacy of personal information and pose cybersecurity risks.
If the international cybercrime treaty is not properly narrowed through negotiations, it could be used to classify a wide variety of activities as criminal if they take place online, including legitimate expressions of free speech. Some of the treaty’s most staunch advocates are countries with legislation that significantly restricts the free and open use of the internet. As treaty negotiations conclude, it will be important for the international community to add human rights and freedom of speech safeguards and bridge the developing polarization between treaty advocates and critics.
[1] United Nations Draft Convention on Countering the Use of Information and Communications Technologies for Criminal Purposes, June 29, 2021.
[1] Summer Walker, Still Poles Apart: UN cybercrime Treaty Negotiations 5 (2023).
[1] Jonathan Greig, Latest UN Cybercrime Treaty Draft a ‘Significant Step in the Wrong Direction,’ Experts Warn, The Record (Dec. 13, 2023).
[1] Jeremiah Salzberg, Navigating the Threat Landscape: The Growing Menace of Cybercrime, Sec. Mag. (May 5, 2023).
[1] G.A. Res. 74/247 (Dec. 27, 2019).
[1] G.A. Res. 75/282 (May 26, 2021).
[1] United Nations Convention against Transnational Organized Crime, Nov. 15, 2000, 2225 U.N.T.S. 209; Council of Europe, Convention on Cybercrime, Nov. 23, 2001, 2296 U.N.T.S. 167, E.T.S. 185.
[1] Council of Europe, Convention on Cybercrime, art. 15, Nov. 23, 2001, 2296 U.N.T.S. 167, E.T.S. 185.
[1] Parties/Observers to the Budapest Convention and Observer Organizations to the T-CY, Council of Eur. (2024), https://www.coe.int/en/web/cybercrime/parties-observers.
[1] Elaine Korzak, Russia’s Cyber Policy Efforts in the United Nations 11 (2021).
[1] Id. at 11–12.
[1] Summer Walker, supra note 2, at 15.
[1] Id.
[1] Isabella Wilkinson, What is the UN Cybercrime Treaty and Why Does it Matter, Chatham House (Aug. 2, 2023).
[1] Id.
[1] Id.
[1] Jonathan Greig, supra note 3.
[1] Christian Ohanian, The UN Cybercrime Treaty Has a Cybersecurity Problem In It, Just Sec. (Oct. 17, 2022).
[1] Isabella Wilkinson, supra note 14.