New United Nations Cybercrime Convention Sets Unprecedented International Anti-Human Rights Standard

Joan Barata is a Senior Fellow at The Future of Free Speech.

After two years of intense negotiations, the new United Nations (UN) Convention on “Strengthening international cooperation for combating certain crimes committed by means of information and communications technology systems and for the sharing of evidence in electronic form of serious crimes” (also known as the Cybercrime Convention) was adopted by consensus by all member states on August 8, 2024. The adoption was preceded by a final two-week round of conversations within the Ad Hoc Committee in New York. The convention is expected to be adopted by the General Assembly before the end of the year.

This new UN treaty was initially proposed by Russia in 2017 and has been particularly promoted by countries willing to build a system alien to the protections granted by most relevant international human rights instruments, including Belarus, China, Iran, Sudan, Venezuela, Nicaragua, North Korea or Cuba.

Even though tackling cybercrime could be seen as a very technical and legalistic matter, the discussions have progressively attracted the attention of several human rights experts and civil society organizations due to the growing concern around the impact that the adoption of such instrument would have on journalists, whistleblowers, activists, IT and security professionals as well as IT-reliant industries in general.

It is important to note that this is not the first international treaty covering fundamental aspects of cybercrime. Adopted within the context of the Council of Europe more than 25 years ago, the Convention on Cybercrime, also known as Budapest Convention, provides a legal framework for international cooperation with respect to any crime involving electronic evidence and counts on two additional protocols, on the criminalization of acts of a racist and xenophobic nature committed through computer systems, and on enhanced international co-operation and disclosure of electronic evidence, respectively. The Convention has so far been providing a legal framework for international cooperation with respect to any crime involving electronic evidence as well as facilitating trusted and efficient cooperation.

Two important aspects need to be underscored. Firstly, since this is an instrument elaborated within the context of the European human rights system, the Convention contains several guarantees and safeguards both at the substantive and procedural levels. Secondly, the treaty is open for accession by any country, which means that apart from members of the European organization, other countries from different regions have become parties or signatories to the Convention, including the United States, Canada, Colombia, Argentina, Japan, Australia, Israel, Philippines, Senegal or Nigeria, among many others.

In contrast with the above, and as underscored by several experts, the recently adopted instrument, which tackles areas already covered by the Budapest Convention, offers authoritarian regimes the opportunity to stifle political opposition and violate human rights, in the name of tackling cybercrime.

The most worrying aspects of the UN Convention have already been described by well informed analyses. Most relevant issues include very general and almost rhetorical references to human rights, a potentially expansive notion of cybercrime which would not only cover cyber-dependent but also cyber-related offenses with no clear threshold in terms of seriousness, lack of compulsory judicial oversight vis-à-vis electronic evidence collection, enabling governments to conduct non-transparent investigations and to track down particularly protected categories such as journalists or whistleblowers or obligations for IT professionals and companies to break into secure systems thus debilitating trust and safety.

The adoption of the UN Convention does not only constitute a step backwards in the protection of human rights, and particularly freedom of expression, within the context of international standards. The Convention represents the takeover of international institutions and international law from the side of states that do not only qualify as authoritarian but also actively and routinely engage, in the international arena, in the systematic erosion of the very basic idea of human rights as the bedrock of human dignity and pluralistic democracy. The Convention is a partial victory for those who defend an alternative vision of the public interest, where certain basic and fundamental rights are relegated to a secondary position in the name of other values and principles that are put at the center of state action: national security, crime prosecution, and protection of national discourse from undesired and challenging views. In particular, the Convention opens the door to a coordinated state action in the criminal persecution of critical voices across borders by facilitating not only the arbitrary punishment of political speech but also the cross-border collection of evidence and the control and limitation of means to disseminate ideas and opinions.

In this context, and even though the so-called “liberal democracies” have made some efforts to achieve a text that dodges a much worse final outcome, one still needs to ask why a proposal with such controversial provisions has become an actual legal instrument. This also applies to the voice of civil society, which despite all the unity and efforts, apparently has not been strong enough to convince human rights-committed negotiating parties to firmly reject certain parts of the text. It is undeniable that diplomacy and international lawmaking requires flexibility, negotiation and a certain give and take. It would be naïve not to acknowledge the sensitivity of the issue and the actual need to count on an effective instrument to properly address the challenges associated with cybercrime, which do not only affect individuals but also important economic activities.

It is also important to acknowledge the references to human rights and to specific limits to mutual assistance in cases where this may lead to punishing a person on account of that person’s sex, race, language, religion, nationality, ethnic origin or political opinions. However, the approved Convention still poses a significant threat to the universal human rights edifice, and fails at providing the legal certainty, fair process, and procedural safeguards that an instrument of this kind is supposed to guarantee. The Budapest Convention itself, still with imperfections, is an example that this kind of exercise is possible. The UN Convention opens the door to a legal landscape which is worse, from many perspectives, than what we have already.

At this stage all eyes (academia, civil society, political actors within states) are on the ratification process (to enter into force, 40 states need to become signatories to the treaty) as well as negotiations on supplementary protocols (which would likely only make things worse). There is thus some room for improvement, or for resistance at least. What is at stake is the enactment of a Convention that is counter to the very essence of our universal human rights systems.