Controversial UN Cybercrime Treaty Signed by 65 Countries

More than 60 countries formally signed the United Nations Convention against Cybercrime in Hanoi, establishing the first global treaty aimed at strengthening international efforts to combat digital crime.

The landmark agreement, however, was met with strong opposition from a coalition of human rights organizations and major technology companies who warn the pact’s broad language could enable state overreach and expanded surveillance.

The new global legal framework is intended to bolster international cooperation in the fight against a wide array of digital offenses, ranging from child pornography and money laundering to transnational cyberscams, a growing criminal industry that has particularly plagued Southeast Asia and defrauded victims out of billions annually.

UN Secretary General Antonio Guterres welcomed the signing ceremony in Vietnam’s capital. Describing the event as an “important milestone,” he added that it was “only the beginning.”

He stressed the urgent need for collective action, stating, “Every day, sophisticated scams, destroy families, steal migrants and drain billions of dollars from our economy… We need a strong, connected global response.”

A compromise document with vague definitions

The Convention, which was originally proposed by Russian diplomats in 2017 and approved by consensus last year after extensive negotiations, is designed to enter into force once ratified by 40 states. While supporters argue it provides a necessary mechanism for cross-border law enforcement, critics point to the treaty’s broad and vaguely defined scope as a serious threat to fundamental liberties.

Critics argue that the language could be exploited by governments to repress dissent and enable the cross-border targeting of political opponents. Sabhanaz Rashid Diya, founder of the Tech Global Institute think tank, voiced her apprehension regarding the potential for data abuse.

“There were multiple concerns raised throughout the negotiation of the treaty around how it actually ends up compelling companies to share data,” she said. “It’s almost rubber-stamping a very problematic practice that has been used against journalists and in authoritarian countries.”

Democratic countries that signed the treaty may view it as a “compromise document” containing provisions for human rights. However, rights groups, in a joint letter signed by more than a dozen organizations, have categorically slammed these existing safeguards as “weak,” arguing they are insufficient to prevent abuse.

Implications for corporate data and human rights

The concerns surrounding the treaty center on two main areas: its potential to undermine corporate IT systems and its threat to the safety of cybersecurity researchers.

The tech industry, through groups like the Cybersecurity Tech Accord representing over 160 firms including Meta, Dell, and Infosys, chose not to attend the signing ceremony. These companies have previously warned that the convention’s stipulations could be interpreted to criminalize legitimate cybersecurity research, and allow states to “cooperate on almost any criminal act they choose.” This potential overreach, they caution, poses “serious risks to corporate IT systems relied upon by billions of people every day.”

An established alternative, the Council of Europe’s Budapest Convention on Cybercrime, offers a rights-respecting framework for international cooperation, which industry leaders argue the new UN treaty fails to match.

Furthermore, the diplomatic choice of Hanoi as the signing location has itself drawn scrutiny. Vietnam’s government has a track record of using laws to “censor and silence any online expression of views critical of the country’s political leadership,” according to Deborah Brown of Human Rights Watch.

Brown also noted the geopolitical dynamics at play, observing that Russia, a key proponent of the Convention, “will certainly be pleased once it’s signed.” However, she added a pointed criticism: “A significant amount of cybercrime globally comes from Russia, and it has never needed a treaty to tackle cybercrime from within its borders. This treaty can’t make up Russia’s lack of political will in that regard.”

The signing by 65 nations, a list the Vietnamese government has not fully disclosed, is expected to include not only traditional allies of Russia and China but other states keen to acquire new digital enforcement tools.