After nearly three years of negotiations, the UN adopted a groundbreaking convention on cybercrime on August 8, 2024. While this move may inspire optimism about improving justice and security in cyberspace, the convention is actually very controversial. It could serve as a useful tool for authoritarian regimes to suppress people’s rights and implement various repressive measures.
The problem stems from the proposal itself
The convention is based on Russia’s original 2017 proposal, in which it sought to push the initiative through the General Assembly under the guise of preventing cybercrime. The aim was to create a binding legal framework to combat online fraud and other types of crimes in the digital world. Two years later, the Kremlin, along with other non-democratic regimes such as Belarus, Syria, and China, submitted a resolution on preventing the misuse of technologies for criminal purposes (Cybercrime Convention). However, it faced opposition from the European Union, the United States, and many other countries. Despite this, the resolution was adopted in December 2019.
The fact that the initiative originates from authoritarian regimes raises concerns about the potential misuse of international law to adopt repressive measures. All of the aforementioned initiators, with the exception of Syria, are known for their persistent cyberattacks against democratic regimes, primarily NATO, the EU, and Ukraine. In this context, the proposal to enhance cybersecurity raises many questions. However, the proposal was not approved by all states. According to some experts, it is also seen as an attempt by the Russian Federation to alter the process by which legislation related to crimes is adopted. Typically, this process occurs in Vienna by consensus, but in this case, the convention was adopted in Washington by a simple majority. Another authoritarian regime known for multiple critical cyber operations against hostile countries, Iran, also expressed strong support for the convention. Moreover, during the negotiations, Tehran made several attempts to propose votes that would remove human rights safeguards from the convention, specifically targeting Chapter 1, Article 6, which states: “Nothing in this Convention shall be interpreted as permitting the suppression of human rights or fundamental freedoms.”
The new definitions of cybercrime, however, are met with misunderstanding from several sides, particularly from human rights organisations. According to them, the previous Convention on Cybercrime (the so-called Budapest Convention) already provides a sufficient legal framework for prosecuting cybercriminal activities. In contrast, the Kremlin rejected the Budapest Convention, arguing that it infringed on Russia’s sovereignty. One of the most contentious points is the article granting states the right to access and share data that could be used as evidence of criminal activity. The lack of details on how this mechanism would function opens up vast opportunities for states to monitor their citizens and individuals they find inconvenient.
Overall, the biggest issue with the treaty is the diverse perspectives among countries on the need to protect human rights and how such protection should look in practice. The convention is more a result of a pragmatic approach aimed at ensuring the new framework is accepted by a broad spectrum of states. Additionally, several countries have indicated that they will apply so-called reservations to the treaty in the area of human rights. However, this move is illegal, as it would contradict the very essence of the treaty (raison d’être). Under international law, such exceptions are not permitted in these cases. It remains unclear how these states will ultimately address this issue.
The situation is not black and white
While there are numerous concerns and potential risks associated with the new convention, there is also another side to the story. The convention could deepen international cooperation in the prevention and fight against cybercrime. This could especially benefit countries with limited resources that struggle to effectively address cyber incidents and bring perpetrators to justice. With the increasing level of digitalisation, the number of transnational cyberattacks, which pose significant security risks to states, is also rising proportionally. The need for better regulation of cyberspace at the international level has been discussed for years, but until now, no new legal framework has been successfully established to address the current situation. Therefore, the convention could be a step in the right direction, with the potential to spark deeper discussions and encourage further legal measures to ensure cybersecurity. It cannot be definitively concluded that the proposed legal framework will solely serve as a tool for authoritarian regimes, although the concerns are valid. The convention has both strengths and weaknesses, but its ultimate impact will depend on how states choose to implement it.However, the convention is not yet in force. It must first be ratified by at least 40 countries. According to expert Pavlína Pavlová, it will be several years before the convention becomes fully applicable. Another issue is whether developing countries will be able to enforce the principles, as their technical capacities are often underdeveloped. This is compounded by significant opposition from civil society, due to concerns about human rights violations and infringements on individual privacy. When and in what form countries will implement the convention is far from clear, and we will have to wait some time before seeing the first steps toward its application.