Next Steps for Mitigating Harm in the UN Cybercrime Convention

On October 25, a badly flawed United Nations treaty—the first global crime treaty to be concluded in decades and the first ever to address the use of technology— reached a critical milestone. The treaty opened for signature, with 72 governments, and counting, having signed in Hanoi. Ninety days after 40 of those governments ratify the treaty, it will enter into force.

Heralded by the UN secretary-general as “a testament to the continued power of multilateralism to deliver,” the negotiation of this treaty surfaced profound divisions, including on the scope of what should constitute cybercrime under this framework and the role of international human rights standards when addressing it.

Despite being dubbed the “Convention against Cybercrime,” the treaty has a much broader scope. It creates a global policing tool for investigating any serious crime, meaning any crime a state decides to punish with a prison sentence of four years or more under national law, in any jurisdiction whose government is party to the treaty.

These cross-border surveillance powers are intrusive and do not include the types of human rights safeguards that would effectively curtail a growing tendency among states to repress political dissidents and others abroad. This overreach has rightly led critics to label the treaty a surveillance pact in disguise.

The primary vehicle for cross-border cooperation on policing today is the mutual legal assistance treaty (MLAT) system. Under this system, states enter into information-sharing agreements with each other that establish specific conditions and safeguards for information-sharing requests. Many states avoid entering into agreements with states that do not display respect for human rights or the rule of law.

The new Convention upends this model by putting in place what is effectively a global MLAT agreement—every state will be required to help every other state that signs the Convention in an investigation of any “serious” crime. Since it fails to require dual criminality—the need for an act to be criminalized in both countries if international cooperation is to occur— states could end up assisting the investigation of an activity that is wrongly criminalized in another jurisdiction, like the investigative work of an independent journalist, even though the same conduct is protected by their domestic law as well as international human rights law.

Many states lack an adequate human rights framework and this treaty is not cognizant of that reality. It does not even spell out key international human rights standards, like the principles of legality, necessity, and non-discrimination. During treaty negotiations, several states adamantly rejected proposals to codify well-established human rights safeguards, contending that they should remain a matter for domestic law. As a result, basic human rights requirements such as the need for court approval of surveillance and the right to an effective remedy for people whose privacy, for example, is wrongfully invaded are optional.

Article 40(22) of the treaty permits states parties to refuse cooperation with an investigation or request for digital evidence if they can demonstrate that assistance will facilitate prosecution on the basis of a set of protected characteristics, including race, sex, and religion, or on the basis of political views. But this Article sets a high threshold for demonstrating that requests are abusive and for limited human rights abuses. It will be difficult to implement in practice. The Convention also allows for refusal on other grounds, but these are not mandatory and could require amendments to states’ national frameworks before they could be invoked.

The Convention’s flaws cannot easily be mitigated because it lacks a mechanism for suspending states that systematically fail to respect human rights or the rule of law. The best way to prevent the worst harm under the treaty would be for states not to ratify it. However, for rights-respecting states intent on ratification, there are steps they can take to mitigate its most harmful effects.

First, governments should adjust or clarify domestic frameworks, as necessary, and make formal reservations to the treaty that ensure that their efforts to implement it are less likely to fuel human rights violations. States could, for example, indicate that they will limit the availability of intrusive real-time wiretapping techniques to a small set of the most serious crimes. Governments should also ensure that their national surveillance frameworks fully adhere to the necessary and proportionate principles that offer guidance on how human rights law applies to digital surveillance.

Second, governments should condition any international law enforcement cooperation under the treaty on the existence of dual criminality by using reservations or declarations under the Convention and, where necessary, adopting new measures in national law. Doing so would decrease the number of countries required to provide assistance for serious offenses that criminalize behavior protected under international human rights law.

Third, they should leverage what human rights safeguards exist in the treaty and make any necessary changes to national law so that they do not engage in international cooperation when it is likely to facilitate human rights abuses, including with any state that has a relevant track record of systematically violating human rights. States should also invest heavily in resources for scrutinizing foreign requests for assistance to ensure they are not abusive. By doing so, states parties will reduce the chance of becoming complicit in another state's human rights violations.

Fourth, they should exercise transparency in implementing the treaty, including, at minimum, statistical reporting of requests received, and whether these were approved, approved in part, or refused. Given how broad mutual legal assistance will be under the treaty, both in terms of the powers created and the scope of crimes that are eligible, data is needed to understand the type of cooperation happening under the treaty and whether states parties are exercising their right of refusal on human rights grounds.

Fifth, any funding or other capacity-building support under the treaty should take into account the recipient’s human rights record and have robust human rights safeguards built in. The treaty includes a chapter on technical assistance, and it is expected that significant funding will be allocated to assist states parties in its implementation. Conditioning such support on the existence of effective rights safeguards would help mitigate some of the risks of abuse associated with the treaty.

Funding for implementation should also be directed to the UN Office of the High Commissioner for Human Rights. OHCHR consistently provided guidance throughout the negotiations on how to align this treaty with international human rights law. Unfortunately, such guidance was not taken up by negotiators. However, as the treaty moves toward implementation, the human rights office’s expertise will be invaluable in mitigating the risks to human rights that are baked into this treaty.

Finally, states should ensure that rules of procedure surrounding the treaty’s implementation and an additional protocol for which negotiations are set to begin in the new year provide a robust role for relevant stakeholders. The participation of civil society in the treaty negotiations undoubtedly improved the text from a human rights perspective.

None of these steps will fix the treaty’s fundamental flaws. But rights-respecting states that have decided to support the treaty despite those flaws can hit the brakes before it goes completely off the rails.