If you’ve never heard of the Cybercrime Convention, you’re not alone. And if you’re wondering whether an international treaty to tackle cybercrime is a good idea, you’re in good company too. Many who are actively participating in the negotiations, states and civil society alike, initially opposed the idea but were drawn into the process when it was launched at the United Nations (UN).

Negotiations have been underway for more than three years now: the latest negotiating session was held in April, and a multi-stakeholder consultation has just concluded. A sixth session is scheduled to take place in August, with a draft text of the convention expected to be approved by February 2024, to be put to a vote at the UN General Assembly (UNGA) later next year. But there’s still much to determine and some big potential pitfalls ahead.

Controversial beginnings

In December 2019, the UNGA voted to start negotiating a cybercrime treaty. The kick-off resolution was sponsored by Russia, which two years earlier had started circulating a draft proposal. Russia’s initiative was co-sponsored by several of the world’s most repressive regimes: Belarus, Cambodia, China, Iran, Myanmar, Nicaragua, Syria and Venezuela. Many of these states had already passed national cybercrime laws that they use to stifle legitimate dissent and scrutiny under the pretence of combatting a variety of vaguely defined online crimes such as insulting the authorities, spreading ‘fake news’, hate speech, extremism, sedition or inciting terror.

Tackling cybercrime certainly requires some kind of international cooperation, since it’s a form of crime that crosses borders. It’s a global phenomenon that impacts on many and that people are rightly concerned about. A treaty could facilitate international cooperation by providing a means for countries to collaborate, including by exchanging information, sharing expertise and cooperating to prevent, investigate and prosecute cybercrimes. It could provide incentives for states to align domestic laws with international standards, ensuring consistency, simplifying cross-border investigations and enhancing legal certainty.

But this doesn’t necessarily mean there’s a need for a new treaty. Civil society organisations (CSOs) still have their doubts. Freedom of expression organisation Article 19, for example, insists the treaty isn’t necessary. Experts have pointed out that the real problem may be the insufficient enforcement of international agreements that already exist, particularly the 2001 Council of Europe’s Budapest Convention. Open to states around the world, it’s only been ratified by 68 and isn’t fully operational.

When Russia’s resolution was put up for a vote, the European Union (EU), USA and many others, alongside human rights and digital rights organisations, urged the UNGA to reject it. But once the resolution passed, they engaged with the process, trying to prevent the worst possible outcome – a treaty lacking human rights safeguards that could be used as a repressive tool. To critical civil society observers, this meant states were increasingly ready to compromise, introducing and accepting amendments that could result in the erosion of key human rights guarantees.

The December 2019 resolution set up a ‘UN Ad Hoc Committee negotiating a treaty on Countering the Use of Information and Communications Technologies for Criminal Purposes’ (AHC), chaired by the UN Office on Drugs and Crime (UNODC) and open to the participation of all UN member states plus others as observers, including civil society.

The AHC’s first meeting to set the procedural rules took place in mid-2021, delayed by the pandemic. Brazil’s proposal that a two-thirds majority vote be needed for decision-making – to be used only when consensus couldn’t be achieved – was accepted, instead of the simple majority rule favoured by Russia. A list of stakeholders enabled to participate was approved, including CSOs, academic institutions and private sector representatives.

Another key procedural decision was made in the first negotiating session in February 2022: intersessional consultations were to be held between negotiating sessions to solicit input from stakeholders, including human rights CSOs. These consultations have given CSOs the chance to make presentations and participate in discussions with states.

Human rights concerns

Several human rights and digital rights CSOs – including Access Now, Article 19, the CyberPeace Institute, Derechos Digitales, the Electronic Frontier Foundation, Global Partners Digital, Human Rights Watch, Privacy International and R3D – are trying to influence the treaty process, individually and as part of broader civil society and multi-stakeholder coalitions.

As the Electronic Frontier Foundation put it, this treaty has ‘the potential to rewrite criminal laws around the world, possibly adding over 30 criminal offenses and new expansive police powers for both domestic and international criminal investigations’. Given what’s at stake, in advance of the first negotiating session, around 130 CSOs and experts urged the AHC to embed human rights safeguards into the treaty, warning that otherwise it could become ‘a powerful weapon for oppression’ and result in ‘a race to the bottom among jurisdictions with the weakest human rights protections’.

As early as the first negotiating session, it became apparent that there wasn’t a clear definition of what constitutes a cybercrime and which cybercrimes should be regulated by the treaty. There’s still no clarity.

UNODC identifies two main types of cybercrimes: cyber-dependent crimes such as network intrusion, computing system interference or the distribution of malware, which can only be committed through the use of information and communications technologies (ICTs), and cyber-enabled crimes, which can be facilitated by ICTs but can also committed without them, such as drug or arms trafficking, money laundering or the illegal distribution of counterfeit goods.

Throughout the negotiation process there’s been disagreement about whether the treaty should focus on a limited set of cyber-dependent crimes, or whether it should also address a variety of cyber-enabled crimes. These, human rights groups warn, include various content-related offences that could be invoked to repress the fundamental civic freedoms of association, expression and peaceful assembly.

These concerns have been highlighted by the Office of the UN High Commissioner for Human Rights, which has maintained that the treaty shouldn’t include offences related to the content of online expression and emphasised that it should clearly and explicitly reference binding international human rights agreements, such as the International Covenant on Civil and Political Rights, to ensure it’s interpreted and applied in line with universal human rights principles.

A second major disagreement concerns the scope and conditions for international cooperation. If not clearly defined, cooperation arrangements could result in bulk data sharing, violating privacy and data protection provisions, rather than the exchange of specific evidence linked to investigations. In the absence of the principle of dual criminality – under which extradition can only apply to an action that constitutes a crime in both the country making an extradition request and the one receiving it – state authorities could be made to investigate activities that aren’t crimes in their own countries on other states’ behalf. They could effectively become enforcers of the repression of others.

Civil society has pushed for recognition of a set of principles on the application of human rights to communications surveillance. According to these, dual criminality should prevail, and where laws differ and those of more than one state could apply, the one with the higher level of rights protections should be applied. It must be ensured that states don’t use mutual assistance agreements and foreign cooperation requests to circumvent domestic legal restrictions. Processes to comply with such agreements should be clearly documented, publicly available and subject to procedural fairness guarantees.

An uncertain future

Following the third multistakeholder consultation held in November 2022, the AHC released a draft text known as a ‘consolidated negotiating document’. In the fourth negotiating session in January 2023, civil society’s major concerns focused on the long and growing number of criminal offences listed in the draft, many of them content-related – now including, on China’s initiative, that of ‘disseminating false information’.

But the most contentious issues, such as the inclusion of vaguely defined content-related crimes and the definition of procedures for the interception of content, the collection and storage of data and the administration of electronic evidence, weren’t discussed in the plenary sessions, but rather in informal groups not open to civil society.

The fifth negotiating session produced a mechanism– a ‘conference of the parties’ as used in other treaties – for the agreement’s implementation but brought no consensus on substantial issues. This means agreement was reached on how to implement a treaty that doesn’t yet exist and may never fully materialise.

It’s unclear how the AHC intends to bridge the current deep divide to produce the ‘zero draft’ that it’s expected to share in the next few weeks. If it complies with the deadline by leaving contentious issues undecided, the next session, scheduled for August, may bring a shift from consensus-building to voting – unless negotiating states decide to give themselves some extra time.

As of today, the process could still conclude on time, or with a limited extension, following a forced vote on a harmful treaty that lacks consensus and therefore fails to enter into effect, or does so for a limited number of states that ratify. Or it could be repeatedly postponed, lose momentum and fade away. Civil society engaged in the process may well think such a development wouldn’t be so bad: better no agreement than one that gives repressive states stronger tools to stifle dissent.