On 29 July 2024, the reconvened session of the Ad Hoc Committee (AHC) to conclude negotiations on a new UN convention on cybercrime will begin. The AHC is mandated to submit a draft convention to the UN General Assembly by 9 August.

Member states had intended to conclude negotiations at the scheduled final session in February 2024. However, disagreements on several key issues hampered consensus and delegates are coming into this meeting with the aim of closing these gaps.

Since the AHC began its negotiations in 2022, competing visions for this convention have not been reconciled. Some countries have pushed for a treaty with a narrow scope and clear rights protections and safeguards. Others, who have pushed for an expanded instrument with intrusive and far-reaching powers (including through possible supplementary protocols), will be pleased with the Chair’s new text and resolution to be discussed next week. The divergence of views may again delay the process next week, or the final text may ultimately be decided by a vote. At this stage, it is difficult to know what will happen during the two-week session and whether the AHC will emerge with a treaty or end in uncertainty, or even whether the life of the AHC will be extended further into the future.

Related analysis

We have reported on and analyzed the negotiations since the AHC began its work in 2021. See our latest and forthcoming analysis below ahead of the next session:

• Our new briefing paper assesses the negotiation of the supplementary protocols to the UN Convention Against Transnational Organized Crime and the lessons delegates should take away as they head into the reconvened final session of the AHC. The background, modalities and implications of a potential additional protocol to the cybercrime convention remain unclear, but the protocol is likely to be at the centre of discussions in New York next week.
• As part of our podcast series on the UN and organized crime, a forthcoming special episode discusses the role of safeguards in promoting cooperation. Leading experts in international cooperation explain the need for safeguards and how the convention can help develop a common understanding of minimum guarantees to build trust between states and enable cooperation.
• Our latest article delves into in the geopolitics ahead of the upcoming session and explores why the treaty’s current title risks clashing with existing legal frameworks at best, and redefining cybercrime at worst.

#1: Here we go again [30 July 2024]

As scheduled, on 29 July, the AHC convened in New York to conclude negotiations on a new UN convention on cybercrime. The Chair of the AHC (the Algerian diplomat Faouzia Mebarki) explained the methodology of the work over the next two weeks and the rationale behind the changes and compromises proposed in the revised draft text of the convention. According to the work programme, the Chair expects to have a final draft text and interpretative notes by the end of week 1 (which would mean that all compromise proposals from states would have to be submitted by then). This would allow member states to enter week two with a final document to adopt in plenary by consensus or vote. 

The Chair’s plan looks ambitious, given the discussions that followed her presentation yesterday. Member state interventions, which mainly focused on the changes to articles outlined by the Chair, reflected the same issues from previous sessions: whether the balance between human rights and state powers was appropriate, particularly in articles 24, 35 and 40; divergent views on the convention’s title, which for many would confuse the terminology between cybercrime and information and communications technology; and lack of consensus on a key article on child sexual abuse material and exploitation. The interventions revealed a continued lack of a shared vision for the treaty.   

The potential for this convention to include additional crimes beyond those listed in the final draft is one of the main points of discussion that already emerged on the first day of the session, i.e. whether the convention will allow for supplementary protocols. States were divided on this idea, which (such as the convention itself) was proposed by Russia. While there was partial support for the protocols, some states would prefer to postpone this discussion and focus on ratifying and implementing the main convention before considering additional protocols. Some states, including Ecuador, Liechtenstein, South Africa and Vanuatu, argued that discussing protocols one year after the convention enters into force (the timeframe proposed by the Chair) would be premature and that not all countries would have the resources to enter into negotiations on a convention that has not yet been implemented. 

As the session progresses, other key issues that remain unresolved are: 

• Ratifications: Mexico has concerns about the current low threshold of ratifications for the convention to enter into force and has proposed raising the threshold to 60 countries. This is supported by some member states, including Australia, Canada, the Dominican Republic, Egypt, Iceland and Pakistan.  

• Article 4: The UK, Canada and Australia questioned the intent and possible misinterpretation of Article 4, which requires member states to criminalize offences established in other UN instruments when committed online.  

• Article 6 on human rights and safeguards: While many member states support the current wording, others (including India, South Africa and Malaysia) believe that paragraph 2 could be deleted. Paragraph 2 outlines important human rights safeguards that balance the broader scope of the convention. 

 Outside the meeting room, the human rights risks of the treaty and warnings from civil society and the private sector are beginning to attract press attention. The negotiations even featured in the UN Secretary-General’s daily press briefing yesterday. When asked about the Secretary-General’s position on a possible UN treaty that could increase human rights abuses, his spokesperson said: ‘We very much hope that member states will find consensus, and as with any treaty, in a way that continues to guarantee all of human rights contained in the Universal Declaration of Human Rights.’    

#2: A dark moment [1 August 2024]

On the second day of the AHC, delegates continued to stake out positions in the plenary, mostly focusing on well-trodden ground. Member states outlined general stances on the latest draft, and it was clear that many had not changed their minds about compromising on the key sticking points.  

On day three, member states disappeared into informal discussions behind closed doors, focusing on the articles that had been most debated during the first two days. These included safeguards and scope of the convention, links to other UN conventions (Article 4), child sexual exploitation online, human rights (Article 6) and an additional protocol to the convention.  

In addition, member states agreed on provisions included in the international cooperation and criminalization chapters. Of particular concern to the tech industry and advocacy groups was the adoption of articles 29 and 30 (real-time collection of traffic data and interception of content data), which include language that ‘compels’ service providers to turn over data to countries that request it. 

The language is taken from the Council of Europe’s Budapest Convention on Cybercrime, but as has been pointed out, this is a global treaty between countries with very different interests and interpretations of its purpose.  With this wording, countries would be able to request data from service providers if they believe that ‘a range of serious crimes as determined by domestic law’ have been committed. This could lead to the persecution of individuals on political and social grounds, and issues related to sexuality and reproductive health, if the crime is punishable by more than four years in prison. In addition, the scope of all measures in this chapter, including articles 29 and 30, currently includes ‘other criminal offences committed by means of an information and communications technology system’. These offences do not require a minimum sentence of four years, meaning that states could request data even for crimes that carry lesser penalties.   

More worryingly, both articles include a clause allowing governments to pass legislation that would ‘oblige a service provider to keep confidential the fact of the execution of any power provided for in this article and any information relating to it’, meaning that service providers would not be able to publicly disclose countries’ requests for data. Microsoft and others strongly opposed this and still hope to see it removed. The Cybersecurity Tech Accord, a coalition of technology firms, called the adoption of these two articles a ‘dark moment in this process’. 

This issue has led to growing despair for onlookers. While there is a sense among delegates that they are moving towards a final treaty and thus a conclusion to this painful process, multiple stakeholders – including business groups, tech companies and civil society – are deeply dissatisfied with the current draft and continue to question its applicability in the real world, where lawmakers will have to adopt it. The Washington Post Press Freedom Partnership released a statement yesterday urging the US to reject the treaty in order to protect journalists worldwide. 

During the Chair’s multistakeholder briefing on day two, participants acknowledged the Chair’s openness to multistakeholder participation but also expressed fundamental concerns about the current draft. Many have voiced that the submission of the Office of the UN High Commissioner for Human Rights should be the minimum basis for a functioning treaty – something that is certain to meet with resistance from a number of member states. The plenary was cut short during the morning of day three so that states could attend informal meetings, leaving stakeholders out of the room as delegates continued their negotiations in private. Multistakeholder submissions can be read here.

#3: The most difficult articles: criminalization [5 August 2024]

At the end of last week, the AHC debated issues related to ratifications and gender mainstreaming. On Friday 2 August, the draft resolution was discussed and there was disagreement on where a list of crimes was added in the preamble, while the main discussion was on protocols. The afternoon session concluded discussions on the draft resolution and the Chair explained her aim to submit the final text of the convention to the Secretariat by 18h00 ET today.

On Thursday, member states discussed the number of ratifications needed for the convention to enter into force. The original proposal by Russia was 30 state parties, which was increased to 40 by the chair. Mexico proposed increasing the number to 60. This would provide an important safeguard to the convention: the higher number of ratifications, the greater the likelihood of the convention garnering wider agreement. As many as 42 states (including the EU) showed support for the Mexican proposal; 39 supported the chair’s proposal; only 15 states supported the Russian proposal for 30 ratifications.

Thursday’s negotiations also saw some challenges concerning the preamble. The key disagreement related to paragraph 10, which sets out language on gender mainstreaming. States such as Iran, Mauritania and Yemen would prefer to have the reference (and paragraph) removed from the text. Nigeria proposed weakening the language that emphasizes the importance of mainstreaming a gender perspective by replacing the word ‘affirming’ with ‘noting’. This would appear to accommodate the needs of states that do not feel they should be obliged to mainstream gender in their policies. Nigeria’s proposal was supported by 11 member states. Many countries rejected the modification, arguing that the current draft is already a compromise and already includes a caveat that allows for flexibility. The discussion remained open and the chair suggested others show flexibility, although they would prefer the original.

The title of the conventions is still a sticking point, and clearly states are far from reaching consensus here. The argument that the current draft title ends up defining cybercrime was put forward by Lebanon. Mali proposed removing the brackets and adding the conjunction ‘and’, so the title would read ‘United Nations Convention against Cybercrime and Crimes Committed Through the Use of ICTs’ – agreed to by Russia. Using both terms in the title continues to expand the scope of the convention.

Friday’s session discussed the preamble, where there was debate over paragraph 4 where a list of crimes was added. Egypt proposed deleting the list, which many member states would accept, as long as the paragraph reflects that the convention allows for international cooperation in a broader set of crimes. The main discussion was on protocols during which, except for CARICOM, who proposed a change to the timeline and location, and Russia, who added language amendments to the text, previous arguments were repeated with regard to timing, location, inclusivity and duration. Brazil will lead the discussion on protocols on 5 August.

The final session of the first week concluded discussions on the draft resolution where paragraphs 6–9 and 11 failed to reach consensus, were kept open and only paragraph 10 was adopted ad referendum. Syria made a joint statement on behalf of over 20 countries reiterating their views on articles 14 and 16. The chair described these criminalization articles as ‘the most difficult ones’, and they continue to be discussed in the informal discussions. 

Informals on Friday evening and over the weekend took place, and in today’s morning session, the facilitators presented the outcomes of these, and any paragraphs agreed on will be adopted ad referendum by the chair. The tension in the room was palpable, with delegations reopening several articles that had already been agreed upon.

However, the discussions taking place in the plenary were not the only source of tension: delegations were faced with a new proposal to serve as a basis for discussion on provisions related to human rights and safeguards, on supplementary protocols, scope, offences related to child sexual abuse material and on the title of the convention prepared by the chair. These are critical points to be decided ahead of a final draft treaty on Wednesday and will be considered during the rest of the meeting this week.

#4: To deal or not to deal [6 August 2024]

The second week of the AHC started on 5 August. Member states discussed the outstanding provisions on terminology, international cooperation, and new proposals on provisions related to human rights and safeguards, on supplementary protocols, on offences related to child sexual abuse material – and on the updated title for the convention proposed by the Chair following informal meetings that had taken place over the weekend. 

As mentioned in issue 3 above, the atmosphere was tense. Tempers even flared as delegates started discussing the new proposal pushed forward by the Chair on the main pending provisions of the updated draft text of the convention (UDTC), which include the outstanding provisions that delegates continue to disagree over. 

On the subject of how human rights would be safeguarded in the convention, changes were proposed to articles 6,2 and 24. Here, however, many delegations expressed a preference to retain the text as drafted and shared before the beginning of the first week.  

Article 6,2 in particular dominated proceedings. This sets out how the Convention should not be interpreted as permitting suppression of human rights, and lists the most pressing rights that risk being violated should the Convention be misused.  The Chair’s compromise did not settle the issue. A group of delegations, including Western countries, the EU and some Latin American countries, were vociferously in favour of retaining the original draft text. Australia and others reminded those in the room that article 6,2 is an essential safeguard for a convention with such a broad scope. At the other end of the spectrum, delegations from Russia, Iran, Egypt and others reiterated calls to delete the article, or at least the lists of rights, and to replace the word ‘suppression’ with ‘restriction’ of rights.  

In terms of article 24, the Chair’s main modifications on safeguards were twofold: 

• In relation to judicial review, the updated text proposed that any judicial or independent review is limited to review taken at the domestic level or established by any legal instrument to which the state is a party. This formulation may limit international oversight of the arbitrary application of the powers of the convention. Many member states voiced their concerns that this addition would be unnecessary.   

• A provision that extends human rights safeguards to include crimes for which e-evidence was obtained by international cooperation should be included in article 24 on safeguards,  instead of appearing in article 23 on procedural measures. This provision is also key to keep the balance between rights and state powers. 

On protocols to the convention, the proposal of the Chair on the main pending provisions of the UDTC takes into consideration Brazil’s proposal to split the threshold of the convention into two. The convention would state that for the adoption of protocols, the threshold is higher (ratification by 60 states) and for the convention to enter into force it would need 40 states parties. The new draft also includes a longer time frame to negotiate the protocol and does not bind states to a specific outcome. However, the proposal reflects neither the broader issue of whether the discussion on having protocols is premature, nor the inclusivity of the process. This was a concern voiced by many states in the first week of the reconvened session. For many countries, it is important that the focus should be implementing the main convention, and not allocating more resources to protocols.  

The proposal also includes a new title: ‘United Nations Convention against Cybercrime Committed through the Use of Information and Communications Technology Systems’. In its proposed extended form, the title still risks defining cybercrime as any crimes committed with the use of ICTs. The proposal adds to the preamble of the Convention a definition whereby cybercrime, as referred to in the convention, means crimes committed through the use of ICTs established in accordance with the convention. The bottom line is that the proposed title aims to accommodate two different terms that cannot be reconciled.  

Overall, the provisions of the proposal are becoming a complex interpretative exercise, which certainly will not make implementation easier. While delegations are doing their best to finalize the process in the time frame and reach consensus, for many the new text risks tipping the convention in the direction of a wider scope for criminalization. This risks opening the door for countries adopting the treaty to take punitive measures against multiple criminal offences and lower safeguarding of rights – a risk that has been amply highlighted by civil society organizations and many states during the negotiations. 

The Chair’s plan is to continue to discuss the provisions on articles 14 and 16 of her proposal and the draft text will be shared on Wednesday 7 August for the convention to be adopted on Thursday. 

#5: Doomsday [7 August 2024]

After member states spent the beginning of the second week of the reconvened AHC session discussing the provisions related to key sticking points that have prevented consensus, the Chair made available a new draft treaty, a draft resolution to be presented to the UN General Assembly and the interpretative notes that should accompany the convention. The plenary session that was expected to be held on 7 August was cancelled, so that delegations could consult internally ahead of the 8 August session, where a decision on the final text of the convention is expected to be made.  

Among the key areas where friction is expected in the adoption of the text are article14, which cover offences related to child sexual abuse material (CSAM). The main issues of contention are: 

• 14,1: The inclusion of references to ‘without right’. This terminology reflects criminal intent, a requirement to constitute criminal responsibility and not penalize individuals who possess CSAM but do not intend to commit crime. 

• 14,3: The requirement that the material identified represents an existing person or depicts child abuse and exploitation – an important requirement to protect freedom of expression, as stated by Japan. 

• 14,4: The possibility of excluding criminalization of children in cases of self-generated material. 

Iceland, UK, Norway, Netherlands, Australia, Japan and others were in favour of provisions covering the issues above, as this would provide a more protective framework to children while combating CSAM. On the other side of the spectrum, Iran, Russia, Syria, Mauritania, Saudi Arabia and others voiced their opposition to the provisions at large.  

The new circulated draft treaty offers provisions covering the elements mentioned, which are expected to be hardly debated in the session today. At 10 a.m. New York time, member states will reconvene at the United Nations headquarters to discuss and adopt the final text. The draft still contains expansive powers and has concerning knock-on effects on society at large and the private sector, and implications for data protection. A full analysis of the text of the treaty can be found here.  

This is the day that many delegates have waited for for two and a half years, when the final outcome of the AHC will be known. Will it be the doomsday many states were hoping to avoid? 

#6: Members approve cyber convention by consensus [8 August 2024]

Yesterday at the UN in New York, after nearly three years of negotiations, member states adopted a new convention against cybercrime. They convened in the morning but shortly afterwards closed the session, so governments could speak privately to try to find consensus on adopting the existing draft treaty with no further changes. This followed a day and a half of informal deliberations on the final text, draft resolution and interpretative notes shared by the AHC Chair. 

In the afternoon, the meeting opened again. Iran raised several objections to the draft and took them to a vote among member states. Under the rules of procedure, to be successful a member state needs a two-thirds majority of the members present to vote in their favour. Iran asked for a vote on articles 6,2 (on human rights); 14, paragraphs 1 and 3; 16, paragraph 1 (offences related to child sexual abuse material); 24 (conditions and safeguards) and 40,22 (grounds for refusal). In all of the cases on which they took issue, Iran fell far short of the two-thirds majority needed for their proposals to be accepted. In the case of one vote, Iran was backed by the Democratic Republic of the Congo; other than that they were the only government to raise objections during the session on the final text of the treaty. Once this process had wrapped up, the Chair asked the committee to adopt the convention by consensus. No objections were raised.  

Following the vote, member states took the floor to give explanations of their positions on the convention and complement the Chair for the process. While some delegations expressed optimism about the convention and the potential for international cooperation to combat cybercrime, others expressed reservations and concerns about certain articles, particularly those related to the protection of children (Niger, Djibouti, Pakistan, Papua New Guinea, Vietnam, Iraq, Guatemala, Mali) and human rights (Malaysia, Mali, Iraq, Vietnam) as well as the title of the convention (Russia, Cuba). The last day of the session, Friday 9 August, will be given over to member states who still wish to express their positions and to formalities, including the adoption of the meeting reports.  

The convention will now be submitted to the UN General Assembly for formal adoption. To enter into force, 40 sates need to become signatories to the treaty. Although there are some positive aspects in the treaty, such as the express reference to human rights and a grounds for refusal for mutual legal assistance on the basis of non-discrimination, there are numerous inherent risks that member states will no doubt be paying close attention to. While the treaty confers much cooperative enforcement powers to governments, including the legal right to access e-data for use as evidence, it is worryingly lacking on oversight detail and could present global surveillance threats – as many have warned.  

The GI-TOC will attend the session and regularly report on proceedings. We will keep our eyes and ears to the ground to give you the latest news, in your inbox, throughout the session.

To receive our updates, sign up to our UN engagement mailing list here.

To access the updates from the concluding session of the Cyber AHC (between 29 January and 9 February 2024) click here.