Delegates at the UN in New York have wrapped up a two-week (28 February-11 March) meeting to kick off the negotiations for a global cybercrime treaty.

Overshadowed by Russia’s invasion of Ukraine – and with relations between the West and Russia at a low point – member states did nevertheless manage to achieve consensus on the negotiation’s processes, but major differences on policy remain unresolved. The crisis and human tragedy of the invasion have already left an indelible mark on this process and will shape the rest of this negotiation. The likelihood of bridging the gaps needed for a consensual and progressive outcome is under more stress than ever.

An unavoidable overshadowing

The first session of the inaugural meeting of the UN Ad Hoc Committee (AHC) on 24 February was a procedural one. However, it was immediately apparent that the war would overshadow the negotiation process of the cybercrime treaty – which was itself instigated by Russia. Many delegates condemned the invasion, while some (the US and Australia, and France speaking on behalf of the EU) questioned outright how it could even be possible to negotiate with Russia in these conditions. They drew attention to reported cyberattacks in Ukraine after Russia had advanced into its territory. Russia responded by calling on countries not to politicize the committee’s work nor to spread allegations of cyberattacks. The chair of the committee, the Algerian ambassador to the UN in Vienna, urged the committee to focus on the substantive issues at hand. Despite the strong statements, the Ad Hoc Committee did move forward in line with its planned agenda.

Given the war in Ukraine, it was perhaps unavoidable that the committee would have to address the long-debated crossover between cybersecurity and cybercrime – and whether this negotiation was appropriate at this time. Interestingly, the cyber component of the war has been hard to characterize. A number of attacks, including distributed denial-of-service (DDoS) attacks on Ukrainian government websites have been attributed to Russia by the West. Russian government websites have also been forced offline. There are alleged unaffiliated ‘patriotic hackers’ conducting DDoS attacks on behalf of Russia. Then there is the soft power of the internet, which includes the use of Twitter and video messages by Ukrainian President Zelensky and Ukrainian citizens, and the alleged hacking of Russian news channels by Anonymous to show clips of the war to the Russian public. Russia has responded by passing ‘fake news’ laws that have led foreign correspondents to leave the country for fear of arbitrary arrest, and by banning several Western media and social media platforms.

In all, this amounts to a breakdown in relations that means finding consensus on this debate will be very difficult. But it also reveals the multidimensional power of the global internet and information and communications technology. At the heart of this power lie disagreements about what cybercrime is and how it should be tackled. From some of Russia’s responses to the coverage of the war it is evident the type of action on cybercrime that Russia – and other member states that seek to control dissent and free expression – would like to pursue under this new treaty.

Stalling on substantive issues, movement on process

Throughout the meeting, member states and non-governmental stakeholders were able to lay out their initial positions on the treaty, which exposed the chasms and their differing on key concepts, as well as the potential benefits and risks.

There were some areas of relative agreement. Firstly, was consensus on the need for capacity building and technical assistance, with widespread acknowledgment of the digital gap between the Global North and South. There was also broad support, at least in principle, for the involvement of civil society, NGOs, academia and the private sector in understanding and developing best practices to combat cybercrime. How the treaty encompasses the role of these external stakeholders will be a test of how committed delegations are to ensuring meaningful cooperation with civil society in the process.

We can expect existing international mechanisms to form the legal foundation of any new treaty, and the UN Convention against Corruption, the UN Convention against Transnational Organized Crime, and the Council of Europe’s Budapest Convention were frequently cited. As templates, these would provide the precedent for a normative framework for criminalization of certain acts, and for facilitating international cooperation and evidence sharing between countries (although some of the potential models suggested during the meeting for evidence and data sharing are extremely different). There were also calls to institute other elements of these treaties, such as on prevention.

Major gaps were apparent, however, on how to incorporate, uphold (or indeed ignore) international human rights law and fundamental freedoms as the treaty is implemented. This is one of the biggest dividing lines among member states, with Western and Latin American countries, and many international NGOs, red-flagging this point as their core concern of the process. This grouping upheld the need for freedoms and human rights, especially as new mechanisms of criminalization could impinge on such rights, particularly if the treaty were to be implemented in the vein of the proposals put forward by Russia, China, Egypt and Iran. In turn, countries aligned to this group warned against diluting or weakening the new tools that the treaty could provide to law enforcement and criminal justice systems in the name of human rights.

Several states emphasized the need for concrete definitions of cybercrime and cyber-dependent crimes. Western and other pro-Budapest Convention states underscored how the Convention must address cyber-dependent crimes, and not provide a vehicle for internet regulation or governance by restricting freedom of expression or association. China and others motivated for the treaty to incorporate broader acts, such as hate speech and ‘malicious content’.

Way forward

Despite the differences on substance and the context of geopolitical tensions, the committee adopted a road map to advance the process. The committee has decided to frontload major decision-making into the first four months. States must submit draft text on a number of sections within the month for the May/June 2022 negotiating meeting in Vienna; and a second critical batch is due in July ahead of the third meeting (August/September 2022 in New York).

• By April 8 2022: States must submit contributions on criminalization; the general provisions; and the provisions on procedural measures and law enforcement.
• By 1 July 2022: States must submit contributions on international cooperation; technical assistance; prevention measures; the mechanism of implementation; the final provisions; and the preamble.

This short timeline favours countries that already have a clear concept of what they want in the treaty (i.e. Russia’s pre-submitted full draft treaty) or to borrow from existing frameworks, like the Budapest Convention. Again, this promotes the West vs. Russia focus shaping the process and leaves out a great number of engaged countries from outside these two polarized groups.  It also means many of the external stakeholders who signed up for this committee will most likely have to react to drafts as they are developed, rather than provide initial inputs in a collaborative way.

Despite the technical possibility of participation and the progress that has been made on agreeing on a road map among member states, the outcome of these negotiations will undoubtedly be shaped by geopolitics. Russia has been the key promoter of this agenda and pushed the issue to a vote in the General Assembly in 2019. Russia’s subsequent impatience to push the process forward quickly based on its own priorities had already led to it losing influence over the negotiations. And Russia is in a worse position than ever.

The question now is, if Russia is not able to drive forward the agenda, which looks likely, will one of its main allies in this negotiation (China, for example) pick up the baton, or will other blocs take the initiative and shape the process to their priorities? For example, could Brazil or South Africa emerge as Russia loses its hold on the reins with a more progressive, Global South and human rights-centred agenda? Or will more countries fall in line with the Budapest vision of countering cybercrime? It remains to be seen, but it is clear that the initiator of the process has lost the initiative, and damaged the prospects of a new treaty being agreed to, as well as a unified multilateral response to organized crime more generally.

Note: External stakeholders were given speaking roles at the Ad Hoc Committee meeting and there will be intersessional meetings with so-called ‘multi-stakeholders’ taking place in Vienna and online on 24 and 25 March.

We will update on our social media channels and website with new information, but you can check the Ad Hoc Committee website here.

image credits: www.eff.org