A Brave New World: United Nations Ratifies Convention Against Cybercrime

The General Assembly's adoption of the United Nations Convention against Cybercrime represents a monumental and controversial step towards mitigating global cybercrime.

[1]

On December 24, 2024, the United Nations (UN) adopted a landmark treaty on the prevention of cybercrime, marking the first comprehensive global treaty discussing the issue.[2] Following multiple rounds of negotiations, the UN Ad Hoc Committee’s Draft Convention Against Cybercrime was presented to the General Assembly for adoption.[3] Drafters of the Convention believe its provisions will allow the international community to effectively and cooperatively mitigate and prosecute crimes utilizing digital and technological means. However, some skeptics are wary of the treaty, arguing that it could put human rights, namely the right to free expression, in jeopardy.[4]

Ahead of the Ad Hoc Committee’s final meeting, the United Nations Office of the High Commissioner on Human Rights (OHCHR) published an information note expressing its support for the mission of the Convention, while noting its specific human-rights related concerns.[5] The OHCHR is largely concerned with the broad terms of the Convention, particularly as seen in Article 4 and Articles 7-11.[6] Article 4 of the Convention broadens its scope to include criminal offenses created by other treaties and conventions under international law, so long as they are committed with computer or information systems.[7] The OHCHR takes issue with the formulation of cybercrimes outlined in Articles 7-11 because those provisions do not require any element of criminal intent to commit the relevant crime.[8] These broad provisions leave more potential for governments to abuse the Convention to suppress freedom of expression and quell political dissidence.[9] 

Furthermore, the procedural terms of the Convention also fail to adequately mitigate the risk of human rights abuses. There is a notable lack of oversight for states’ actions under the Convention, as parties’ governments may act without any judicial authorization, such as a warrant.[10] In fact, states may use the Convention’s mechanisms to investigate any crime, regardless of its nature or severity.[11] Provisions allowing for the search and seizure of data and computers may be abused by governments seeking to gain information about political adversaries or silence expression that is critical of those in power.[12] Moreover, the Convention lacks any language requiring the searching party to have a reasonable belief the crime has been committed and that evidence of the offense will be found in the search.[13] This absence would allow government officials to demand access to data and information, regardless of whether they have any basis to believe that the Convention is invoked.[14] The OHCHR is concerned that the generous procedural terms of the Convention, combined with its broadly defined crimes, invites governments to disregard or even actively limit human rights.

Critics of the Convention on Cybercrime are understandably concerned about the potential for human rights violations. However, there is also an understanding that new policies are necessary to combat a new world of crime. Technology and the internet are ever evolving and criminals are using these tools to expand their enterprises. Therefore, governments need to be able to engage in law enforcement in both the real world and the cyber world. In adopting the Convention, the UN has armed member states with measures they can employ to mitigate cybercrime.[15] The Convention will take effect upon its acceptance, approval, or accession by forty UN states—with a formal ceremony set to place in Hanoi, Viet Nam in 2025.[16]

---

[1] Artur Widak, Photograph of silhouette in front of United Nations crest, in Tirana Hassan, Upcoming Cybercrime Treaty Will Be Nothing But Trouble, Hum. Rts. Watch (Aug. 7, 2024, 9:54 AM), https://www.hrw.org/news/2024/08/07/upcoming-cybercrime-treaty-will-be-nothing-trouble.

[2] United Nations Convention Against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes, U.N. Off. on Drugs & Crime [hereinafter United Nations Convention Against Cybercrime], https://www.unodc.org/unodc/en/cybercrime/convention/home.html (last visited Mar. 22, 2025).

[3] United Nations: Member States Finalize a New Cyber Crime Convention, U.N. Off. on Drugs & Crime (Aug. 9, 2024), https://www.unodc.org/unodc/frontpage/2024/August/united-nations_-member-states-finalize-a-new-cybercrime-convention.html.

[4] Michael Weissenstein, The UN Is Moving to Fight Cybercrime But Privacy Groups Say Human Rights Will Be Violated, AP News (Aug. 9, 2024, 2:16 PM), https://apnews.com/article/united-nations-cybercrime-computer-technology-39fe999d78f615912d0bdb2011290665.

[5] Human Rights and the Draft Cybercrime Convention, U.N. Hum. Rts. Off. of the High Comm’r (July 25, 2024), https://www.ohchr.org/en/documents/tools-and-resources/human-rights-and-draft-cybercrime-convention.

[6] U.N. Hum. Rts. Off. of the High Comm’r, Information Note: Human Rights and the Draft Cybercrime Convention 3 (2024), https://www.ohchr.org/sites/default/files/documents/issues/civicspace/DRAFT-CYBERCRIME-CONVENTION.pdf.

[7] Id.

[8] Id. at 3–4.

[9] Id. at 3.

[10] Id. at 10.

[11] Id. at 8.

[12] See id. at 10 (considering the possibility of a member state “using criminal law to prosecute a political opponent for her legitimate use of her right to freedom of expression, [in an attempt to gain] access to stored electronic data such as emails . . .”).

[13] Id. at 9.

[14] Id.

[15] United Nations Convention Against Cybercrime, supra note 2.

[16] Id.