On 29 January 2024, the concluding session of the Ad Hoc Committee negotiating a new United Nations cybercrime convention begins its work. By 9 February, the committee is mandated to deliver a draft convention to the UN General Assembly.

If you have been following this process, you already know that states started this final session a long way from having reached consensus on the proposed new treaty. At the beginning of the two-week session at the UN, it was difficult to predict what would happen.

The Ad Hoc Committee wrapped up its final day without adopting a treaty, but instead opting for another meeting later this year (subject to United Nations General Assembly approval and resources). The GI-TOC will continue its reporting on this process as it moves towards its new deadline.

The GI-TOC was present at this session, following closely, and reported on it below in our Cyber Convention Check-In.

Join our UN engagement mailing list to automatically receive our regular updates in your inbox.

#1: The Final Countdown [26 January 2024]

Background

There is no doubt that the internet, and technological advances in general, have supercharged transnational organized crime in recent decades, causing myriad harms and enabling perpetrators to work more easily across borders and evade justice. At the same time, repressive regimes have armed themselves with ‘cybercrime’ legislation to repress opposition voices, journalists, civil society and others, for carrying out activities that should not be considered crimes.

It is in this context that these negotiations are happening – even though there has never been consensus on whether this convention is needed. The committee was born out of the polarized positions of member states – its creation had to be voted on, as states could not reach an agreement on whether a convention was needed – unlike the consensus-based negotiation that delivered the UN Convention against Transnational Organized Crime and the UN Convention Against Corruption. Moreover the range of issues under negotiation go far beyond what one could understand as ‘cybercrime’. Even the word ‘cybercrime’, and what constitutes a cybercrime, have not yet been agreed among states.

The outcome of the negotiation may well have an unprecedented impact on human rights (including digital rights), privacy, data protection and a range of other issues of relevance to us all. It also affects the role of the United Nations, in a highly fragile and fragmented geopolitical context.

The GI-TOC has provided regular analysis on the negotiations since the committee began its work in 2021. Our latest brief provides an overview of what is being discussed, and what might emerge at the last session. Read the brief here: https://globalinitiative.net/analysis/united-nations-cybercrime-negotiations-final-phase/

In that report, we set out the various possible conclusions that the negotiating committee could come to: will it adopt a treaty that resembles the Council of Europe Budapest Convention? Will it adopt something in the mould of the draft convention submitted earlier by Russia and its allies? Will states agree to something that sits midway between those two very different visions? Will there be a vote? Will they be able to make any decision at all? Could they extend the negotiations?

There are many possible scenarios. Find out what is happening at the UN session by following our Cyber Convention Check-in. We will keep our eyes and ears to the ground to give you the latest news, in your inbox, throughout the proceedings.

#2: Out of the frying pan, into human rights and safeguards [30 January 2024]

On 29 January, the concluding session of the Ad Hoc Committee (AHC) kicked off in New York. During the session’s first meeting, the Chair spoke about the history of the process, the modalities of the concluding session and what changes she had made to the revised draft text of the convention.

In her opening remarks, the Chair implied that the draft text was close to consensus. However, by the time she opened the floor for contributions on Article 5 on respect for human rights and Article 24 on conditions and safeguards, the positions of member states suggested otherwise.

Articles 5 and 24 

Iran opposed the inclusion of explicit references to human rights provisions, stating that the focus of the meeting should be on the mandate of the AHC, which should not fall within the scope of a human rights treaty. According to Iran, the UN Convention Against Corruption does not contain any reference to human rights treaties and it is common practice not to discuss human rights issues in such conventions. This position was supported by Nicaragua, Cuba, Egypt, Russia, Pakistan, Belarus, Saudi Arabia, Eritrea, Venezuela, China, Syria, India and Yemen. Russia considered the possibility of putting these articles to a vote during the concluding session, which the Chair allowed the AHC to do, but there was no support for the proposal.

Conversely, Jamaica, speaking on behalf of the Caribbean Community, supported the inclusion of Articles 5 and 24 as drafted, with minor proposed changes. Their position appeared to be broadly in line with the views expressed by countries such as Nigeria, the United Kingdom (UK), Paraguay, Brazil, Morocco, El Salvador, Ecuador, Peru, the United States (US), Singapore, Australia, Korea, Chile, Uruguay, Argentina, Japan, Algeria, Iceland, Albania, Costa Rica, Uganda, Ghana, Mexico, South Africa, Norway, Georgia, Colombia, Thailand, Paraguay, Israel, Switzerland, Panama, France, Canada, Austria, Vanuatu and Germany.

However, the UK, Brazil, Egypt (on behalf of the African Group) and the European Union (EU), in particular, expressed more nuanced views. The positions of the UK and Brazil positions gained notable traction. The UK made a specific proposal to amend Article 24 to clarify its position on safeguards in order to build the trust and confidence that would allow for greater cooperation. Brazil proposed an amendment to Article 24 that would include a reference to the principle of legality alongside the principle of proportionality. Egypt broadly supported the provisions on technical assistance and capacity building coming under Article 24 (7). The EU stressed that the future convention could not be fully effective without human rights provisions, and that a broader scope of Article 24 should be accompanied by stronger safeguards and no additional offences under the criminalization chapter. Support for these statements was as follows:

• Ecuador, the US, Singapore, the EU, Australia, Argentina, the Czech Republic, Albania, Costa Rica, Mexico, Norway, Georgia, Paraguay, Israel, Switzerland, Canada and Vanuatu supported the UK proposal (interestingly, India appreciated the UK’s efforts to bring clarity to the application of Article 24, arguing that the current scope of the article was unclear and that the UK proposal was commendable);
• Ecuador, Australia, Argentina, Albania, Costa Rica, Dominican Republic, Mexico, Norway, Colombia, Paraguay, Switzerland and Panama got behind Brazil’s proposal;
• the Czech Republic, Albania, Norway, the Netherlands, Poland, France, Sweden, Italy and Germany aligned with the EU statement; and
• Tanzania and Mauritania agreed with Egypt’s contribution.

These different positions already emerged on the first day of the concluding session. And, given that the Chair hopes to consider the convention as a whole this week so that work can continue next week, the opening discussion on Articles 5 and 24 makes that goal look ambitious.

Discussions on Articles 5 and 24 continued informally, behind the scenes in closed sessions (not open to civil society observers). However, discussions on scope and human rights safeguards are expected to continue in the morning session of day 2. For a process previously defined by inclusivity, the closed nature of the evening sessions seems like a missed opportunity.

On human rights and safeguards, the following resources provide an overview of the submissions made to strengthen the treaty’s human rights provisions:

• Proposal by Canada, on behalf of a group of 50 states and the EU, to the AHC to further define the scope of the draft convention;
• Joint submission by multiple organizations under operative paragraphs 8 and 9 of UN General Assembly resolution 75/282.

#3: Terminological turbulence [1 February 2024]

On 30 and 31 January (days 2 and 3), the concluding session of the Ad Hoc Committee (AHC) continued in New York. During the meetings, the committee held detailed discussions on the draft treaty’s chapters on general provisions, criminalization, procedural measures and law enforcement, preventive measures and technical assistance, implementation mechanism and final provisions.

As they went through the provisions, delegates either reached agreement ‘ad referendum’ (i.e. subject to the agreement of others) on certain articles, referred what was still to be agreed into ‘informals’ (closed sessions in the margins) or discussed them in more detail in plenary.

General provisions and criminalization

The morning session of day 2 (30 January) opened with a discussion of the articles on general provisions, particularly Article 1 on the statement of purpose. While the Chair asked whether the article had been agreed ad referendum, Egypt immediately aligned itself with the statement made on 29 January on Article 1 on behalf of the Africa group, supporting the inclusion of a reference to technology transfer in Article 1 (3). This position was widely supported by Iran, South Africa, Tunisia, Russia, Syria, Cabo Verde, Namibia, India, Nigeria, Senegal and Egypt. The US, Israel, Norway, Canada, the EU, Albania and the UK did not support the proposal.

This session also focused on issues around terminology. Opposing views were expressed on the use of terms such as ‘dishonest intent’, ‘copying’ and ‘theft’. The Chair urged the Committee not to spend time on wording rather than substance, and some member states emphasized that they were free to use different wording to suit national legislation and that word-for-word implementation of the convention was not necessary. Very few articles were agreed to ad referendum, with member states either needing to think more about the remaining articles in these chapters or the articles being pushed to informals.

Procedural measures and law enforcement

The afternoon session of day 2 focused on procedural measures and law enforcement. Much of the discussion revolved around the scope of the convention. On the scope of procedural measures, Singapore proposed to delete paragraph 2 (b) on the means of criminal offences, which was supported by Switzerland, the EU, El Salvador, Malaysia, Lichtenstein, Chile, Mauritania, Georgia and Japan, but opposed by Tanzania, Syria, Russia, Jamaica (on behalf of the Caribbean Community), Cabo Verde, Nicaragua, Iran, Eritrea and the Republic of Korea. During discussions on Article 31 on the freezing, seizure and confiscation of the proceeds of crime, Japan proposed to add additional language on the degree of seriousness of the offence and to reintroduce references to the scope throughout the article, which was supported by Albania, Switzerland, Canada, Sweden, Ecuador, the Republic of Korea, Vanuatu, Iceland, Paraguay, Georgia, the UK, the US, the EU and Singapore, but opposed by Russia and Eritrea.

Preventive measures and technical assistance

The morning session of day 3 (31 January) focused on preventive measures and technical assistance. While many of the articles under preventive measures were agreed ad referendum, the issue of technology transfer continued to divide the committee. Terminology also posed a problem for the AHC’s discussions on preventive measures, particularly when it came to ‘stakeholders’ and ‘gender-based violence’, while the scope again became a point of contention. The stalemate described above concerned Article 54 (1) under the article on technical assistance and capacity building. One of the changes the US wanted was to make the reference to technology transfer less binding, by adding the words ‘voluntary and’ and ‘mutually agreed terms’, which was supported by the EU, Albania, Norway, Israel and Switzerland. However, the Chair maintained that most of the committee wanted the draft text for this article to remained unchanged, with many of these states representing developing countries.

Implementation mechanism and final provisions

The afternoon session of day 3 was largely devoted to the implementation mechanism and final provisions. With regard to the implementation mechanism, Article 57 on the Conference of the States Parties to the convention saw Canada propose including the inclusive modalities of the AHC itself, with the phrase ‘based on the modalities agreed in the resolution A/RES/75/282’ after ‘in this article’, and in the same paragraph, the EU wanted to add ‘multilingualism’ to the principles list, both of which were supported by Norway, New Zealand, the UK, Albania, Lichtenstein, Iceland, Japan, Vanuatu, Ecuador, Israel, Australia and Peru. Article 58, on the Secretariat, showed a division of opinion, with Russia proposing to replace ‘UNODC’ (for the United Nations Office on Drugs and Crime) with ‘Secretary General’ in paragraph 1, which was supported by Mali, Iran, Pakistan and Syria, but opposed by Japan, Israel, Albania, the US, Canada, the EU, South Africa and Chile. Qatar, Panama, Australia, New Zealand, Papua New Guinea and Vanuatu preferred the article in its current form. Brazil suggested a compromise amendment to paragraph 1 to read ‘the Secretary General through the UNODC’, which received support from Cabo Verde, Colombia, Mauritania, and São Tomé and Príncipe.

Ultimately, the session focused on the final provisions, specifically Article 64 on the entry into force of the convention, which highlighted another impasse between states. In paragraphs 1 and 2, Russia proposed 30 parties as the threshold for entry into force (as opposed to 40), which was supported by Egypt, Namibia, Burkina Faso, Iran, Mauritania, Papua New Guinea and Mali. However, Mexico intervened to say that it was crucial to increase the threshold so that the convention would enter into force after the 60th ratification, as this could facilitate domestic ratification processes for each country. This was supported by Iceland, Senegal, Switzerland, Australia, Colombia, the EU, the US, El Salvador, New Zealand, Peru, Canada, Singapore, Israel, Norway, Costa Rica, Lichtenstein, Chile, the UK, Panama, Guatemala, Japan and the Central African Republic. However, Brazil, South Africa, Zimbabwe, China, Cabo Verde, Indonesia, Qatar, Jamaica on behalf of the Caribbean Community, Paraguay, São Tomé and Príncipe and Ecuador continued to support the text as it stands (i.e. 40 ratifications).

Discussions on the Secretariat and entry into force could make for a complicated negotiations on the draft resolution prepared by the UNODC to accompany the convention. This resolution, despite the lack of agreement on many of the key issues, calls for states to begin making financial contributions to the UNODC, for a state to host a high-level political conference to adopt the convention, and to inaugurate an ‘International Anti-Cybercrime Day’, despite the continued lack of agreement on what constitutes cybercrime.

So far, three of the 10 days have passed, with little agreed. Delegates are working behind the scenes in informals, and we are waiting to see what proposals will come out of these discussions. We expect to see a step-change in the pace and nature of discussions in week 2.

#4: Turning up the heat [2 February 2024]

As the first week of the final session of the Ad Hoc Committee (AHC) in New York draws to a close, the committee is under pressure to consider the full breadth of the draft and to reach consensus by the end of the second week. The fourth day of the final session (1 February) was marked by periods of rapid jumping from provision to provision, as well as detailed discussion of specific articles covering a wide range of the draft treaty’s chapters on international cooperation and criminalization. The full-speed approach of the plenary, coupled with the backstage nature of the more substantive discussions, has deprived multi-stakeholders of opportunities to contribute. 

While the plenary discussions may feel like they are moving quickly through the draft convention, delegates have been working simultaneously and in night-time informal sessions behind the scenes on the most sensitive issues related to the scope of the convention. These are all problems with the scope of implementation specifically, including key provisions on criminalization, procedural measures and international cooperation chapters, as well as provisions on human rights and legal safeguards.

International cooperation  

The morning plenary session of day 4 (1 February) focused on several provisions of the international cooperation chapter, in particular on extradition, mutual legal assistance, the 24/7 network for information exchange, and the preservation of stored data under Articles 37–38 and 40–44.

With regard to the provisions on extradition, much of the focus was on whether or not to include the phrase ‘any reason for refusal’ in paragraph 18, which refers to the obligation of the requested State Party to inform the requesting State of its decision on an extradition request. The Chair’s proposal to include ‘as appropriate’ in an attempt to find a middle ground was supported by Australia, the US, Georgia, Malaysia, Vietnam, Panama and Japan and opposed by Cabo Verde and Mali. Another issue related to extradition concerned the article on the transfer of sentenced persons (Article 38) and whether the provision should refer to ‘the rights of sentenced persons and issues relating to consent, rehabilitation and reintegration’. While many countries were in favour of keeping the article as it stands, a few countries suggested to the Chair that a solution might be to add ‘where appropriate’ to this phrase.

Much of the morning was also spent discussing the scope of the 24/7 network (Article 41 of the draft treaty). The US shared concerns about the broad scope of the network as currently presented in the Chair’s draft and proposed to limit the scope by removing the reference to ‘the procedure is covered by Article 35 of this Convention’. This proposal was supported by a large number of member states, including Japan, Australia, Singapore, Georgia, the UK, Israel, Albania, New Zealand, Canada, Brazil, Iceland, Argentina, Norway, Moldova, Paraguay, Senegal, the EU, Costa Rica, Switzerland, Panama, Jamaica (on behalf of the Caribbean Community), Colombia, the Central African Republic, Peru, Chile, Ecuador, Mauritania, Malaysia and Burkina Faso. Russia, on the other hand, proposed adding the word ‘prevention’ to the paragraph, a move supported by Kazakhstan, Belarus, Mali, Rwanda, Malaysia and Vietnam. Iceland, the UK, the EU, the US, Japan, Canada, Georgia, Jamaica (on behalf of the Caribbean Community), Kenya and Switzerland did not agree with the proposed addition.

Criminalization

In the afternoon session, which focused on the criminalization chapter, the committee picked up the pace and several peripheral paragraphs (apart from the fundamentals discussed in informals) were agreed ad referendum (Article 10 (1a), Article 14 (1–3), Article 18 (2–4) and Article 22 (2a–2d)). The debates centred on whether the chapter should include a wider range of crimes or whether it should be narrower – a familiar line of division in the AHC. Russia expressed its frustration at feeling ignored in its attempts to introduce more offences into the convention. On the other hand, Iceland expressed its discomfort with the broad scope of what was already on the table in Article 16 (on laundering of the proceeds of crime).

The main concerns related to the inclusion in paragraph 2 of Article 16 proposed by Japan and supported by the EU and Vanuatu, which Brazil and Cameroon found problematic (‘a certain degree of seriousness’ – in relation to the nature of the offences concerned), and the discussion on ‘unlawful’ and ‘dishonest’ intent, which was previously discussed in relation to language in Article 6. Some delegations suggested using both words, which was accepted by Iran but opposed by the US, the UK and Cameroon, so no agreement was reached.

Also during the discussions on Article 16, the US introduced a proposal to clarify that the predicate offences referred to are related to cyber-related crimes and not money laundering in general. This proposal was supported by the UK, New Zealand and Australia.

A compromise ahead?

It is still unclear what path member states will take to try to reach a compromise. One of the key issues that member states are addressing at informals is the scope of cooperation concerning electronic evidence. One of the options that appears to be under discussion is a broader scope for cooperation on electronic evidence, including for ‘serious crimes’ in general, which could be linked to a thinner criminalization chapter and some kind of agreement on how other crimes could be added to the convention in the future. The Global Initiative Against Transnational Organized Crime and many other private sector observers have highlighted the human rights risks inherent in extending the scope of cooperation on electronic evidence to a wider and undefined set of crimes, particularly if the definition of serious crimes is based solely on the length of the sentence.

A compromise proposal on the human rights and safeguards provisions is also expected to be formally presented as the negotiation progresses in informals. It remains to be seen how these informals, currently taking place behind closed doors, will lead to formal proposals and ‘package deals’. And while we cannot see behind those doors, we know that things are heating up inside.

#5: Entering the tunnel [5 February 2024]

The first week of the final session of the Ad Hoc Committee (AHC) ended with an ambitious timetable. A new ‘package deal’ on the core issues of human rights and scope is expected to be presented for discussion by member states today and tomorrow, theoretically allowing the Chair to adhere to the timetable and reach the expected consensus by mid-week. For some, this is a very tall order, especially given that there are still fundamental differences on several provisions of the draft, as the discussions on the last day of the first week’s plenary session show. Even if member states come closer on the basics and agree on a ‘package deal’, there is still an enormous amount of work to be done on the language details – an exercise that will require some monumental dotting of i’s and crossing of t’s. If they do not rapidly reach an agreement, a vote, or a series of votes, will have to be taken.

Criminalization of cyber-dependent crimes

The morning plenary of day 5 (2 February) continued with the discussion on the criminalization provisions. Tensions began when Egypt made a statement, on behalf of the Arab Group, expressing concern about human rights provisions that could ‘interfere with the sovereignty and internal affairs of states’. Pakistan, Russia, Iran and Iraq followed in support.

Member states spent a considerable amount of time trying to find a compromise on two key provisions in the criminalization chapter dealing with cyber-dependent crimes, namely the articles on online sexual abuse (Article 13) and non-consensual distribution of intimate images (Article 15).

The importance of protecting children is undeniable, but one of the impossible crossroads faced by delegates was on the legal implications of the term ‘without right’. This wording seeks to safeguard those who may be in possession of the abuse material but have no intention of committing the offence, for example a person who has been trusted with the material by the victim. If the wording is retained, a person could only be prosecuted if they possess abusive material ‘without right’ to do so. While some states (including Austria, Norway, Argentina, Switzerland, the Caribbean Community, Georgia, Nigeria, Kenya, the Philippines, Korea and Canada) called for its retention, Egypt, Russia and others (Algeria, Zimbabwe, Côte d’Ivoire, Saudi Arabia, Bahrain and Chad) were very vocal in their opposition.

The second issue relates to whether consent would be an excludable element of the offence in Article 15. This would avoid over-criminalization by excluding criminal liability if the material is authorized by the person whose image is being disseminated. The risk of over-criminalization would be exacerbated, for example, in countries where pornography is a criminal offence. Those in favour of maintaining intent as a requirement of the offence explained that without considering the victim’s consent, the convention would risk criminalizing the very victims it seeks to protect. Canada, for example, said that a provision designed to protect privacy could instead turn the issue into a ‘moral offence’.

International cooperation

The afternoon session was devoted to provisions on international cooperation. While several provisions were proposed for discussion by the Chair, a point of contention regarding Article 45 prevented further progress. The EU considered articles 29, 30, 45 and 46 to be extremely intrusive and therefore objected to them from the outset. In a sign of compromise, the EU accepted the articles, but on the condition that paragraphs 1 and 2 of Article 45 use the word ‘may’ instead of ‘shall’, giving member states some discretion to provide mutual legal assistance in real-time traffic data collection.

This is a sensitive measure, as it could impose an obligation on states to cooperate in the exchange of data, which could also conflict with states’ obligation to respect privacy rights. Canada, the United States, Norway, Georgia, the United Kingdom, Malaysia, Israel, Albania, Jamaica (on behalf of the Caribbean Community), Mongolia, Iceland, Paraguay, Vanuatu, Panama, the Philippines, Japan, the Netherlands, New Zealand, Iceland, Ireland, Germany, Maldives, France, Montenegro, Slovakia and Sweden supported the EU’s proposal, while Egypt, Russia, Cuba, South Africa, Tanzania, Brazil, Eritrea, Iran, Pakistan, Namibia, Oman, Qatar, Mauritania, Tunisia, Nicaragua, Argentina, Zimbabwe, Indonesia, Malawi, Yemen, Ecuador, Algeria, Burkina Faso, Colombia, Senegal, Sudan and Mali opposed it.

What comes next?

As the AHC’s concluding session enters its second (and final) week, questions about the future of the process remain unanswered. Key decisions will have to be made on Canada’s human rights proposal – a catch-all provision with the caveat that the convention cannot be used as a tool of repression. Another proposal on the table is New Zealand’s suggestion to include the possibility of refusing to cooperate if there are reasons to believe that the request was made for the purpose of prosecuting or punishing a person on the basis of an individual characteristic. This would incorporate some elements the Canadian proposal.

The stakes are high – especially where human rights are concerned. A compromise convention remains the primary objective of the AHC’s mandate. The question is whether it can be achieved by the end of this week. Some are still sceptical that a draft convention adopted by consensus for submission to the UN General Assembly is possible, given the significant differences that have emerged over the past week. Failure to conclude the process would also be problematic, as it would expose deeper fractures in multilateralism and risk a draft that is not widely agreed being put to a simple majority vote. If no progress is made by mid-week, the AHC may have to consider reinventing itself and postponing a final decision on the text.

The success of a consensus-based approach depends on the reactions to the Chair’s new draft compromise proposals over the next few days, as delegates now enter the ‘tunnel’ phase of the negotiations. Will they all come out together in a few days’ time? Or will they emerge from different places?

For further analysis of the various scenarios, the GI-TOC has outlined other outcomes of this process that are still possible at this stage.

#6: Jumping the gun in public, playing with fire in the dark [6 February 2024]

On 5 February (day 6), the concluding session of the Ad Hoc Committee (AHC) continued its second week of work in New York. During the plenary (open) meeting, the committee discussed item 4 of the agenda on the draft resolution to be considered by the UN General Assembly, before returning to parts of the convention to try to reach an agreement. The informal (closed) meetings continued their discussions on possible compromises on the core issues of the convention – such as its scope and human rights safeguards.  

An example of what was informally discussed is the inclusion in Article 44 (mutual legal assistance provision) of the possibility of issuing a data request to service providers when a requesting authority may not be aware of the location of data stored by service providers. This provision would allow member states to bypass the authority of other member states in order to obtain data, with serious consequences (such as secret cross-border data flows and the violation of data protection rights). On the fundamental issues still under discussion, the compromise proposals that the Global Initiative Against Transnational Organized Crime has seen on the scope and human rights safeguards still contain major ambiguities and risks – such as sharing of electronic evidence on a very wide range of activities. 

Plenary discussion jumps the gun on draft resolution for consideration by the UN General Assembly

Despite the lack of agreement on the core issues of the convention, including on its name, the Chair attempted to secure agreement on a resolution to accompany the convention in the plenary on the morning of 5 February. The resolution was justified as being based on the resolutions that carried the UN Convention against Transnational Organized Crime and UN Convention against Corruption through the General Assembly (the very different circumstances of these processes were not remarked on). The resolution includes measures such as welcoming the initiative of an as yet unnamed country to host a high-level conference for the convention’s adoption, inviting states to donate money to the UN Office on Drugs and Crime (when the question of who should be the secretariat of the convention has not yet been decided), and establishing an ‘International Cybercrime Day’ (when states cannot even agree on the term ‘cybercrime’). To say that discussion of the resolution was premature would be an understatement. Surprisingly, however, states did not raise concerns about the concept of the resolution itself. However, as is characteristic of the AHC, polarized positions on the details soon emerged.  

Russia, Iran and the US (in that order) opened the discussion by presenting three fundamentally different positions on the naming of the convention, and on whether a protocol on additional forms of offences should be negotiated after the convention’s adoption. Russia’s proposal to change the name of the convention to alternative 1 ‘Countering the use of information and communications technologies for criminal purposes’ was supported by Eritrea, Egypt, Cuba, Mali, Burkina Faso, Nicaragua, Iran, Venezuela, Algeria, Namibia, Sudan, the Central African Republic, Syria, Uganda, the Democratic People’s Republic of Korea, the Democratic Republic of Congo, Pakistan and Zimbabwe. The US proposed to keep the title ‘Countering cybercrime’, which was supported by Morocco, Canada, Vanuatu, Japan, Georgia, the Republic of Korea, Chile, the EU and its member states, Iceland, Paraguay, Peru, Albania, Costa Rica, Australia, Israel, the UK, Tonga, Timor-Leste, New Zealand, Panama, Malawi, Côte d’Ivoire, Lebanon, Kiribati, Oman, Norway, Kenya, the Dominican Republic, Rwanda, Malaysia, Liechtenstein, Saudi Arabia, Colombia, Nigeria and Tanzania. So, while the US’s proposal comfortably has the numbers, the situation remains a crisis of consensus. This is compounded by the fact that Iraq and Angola have each proposed different changes to the naming of the convention, with almost no support.  

Russia proposed a new paragraph to further pre-judge the outcome of the negotiations, which is still being considered behind closed doors as part of the so-called Chair’s package. The idea would be that a protocol addressing additional forms of offences and relevant mechanisms, consistent with the scope and implementation of the convention, could be the subject of future negotiations by an extended AHC in the next year and a half (i.e., before this treaty potentially enters into force). Given that the scope of the convention has not yet been defined, it is not surprising that this idea was quickly dismissed by the US and others. The concept itself is also dangerous, as a group of member states not party to the convention could potentially negotiate a protocol to expand its scope and extend the criminalization chapter through the back door.

Stakeholders finally have their say

In contrast to the continuing lack of consensus among member states, multi–stakeholders made their consensus with each other as clear as daylight during their allotted speaking time. One stakeholder went so far as to say that the AHC process has ‘united civil society and industry opposition in a way I have never seen in international relations’. Whether in relation to victims, safeguards, human rights, consistency, scope or access to data, there was a general sense that it was disappointing that key concerns raised by stakeholders had not been addressed and that the draft was still not fit for purpose. Following these interventions, the Chair noted that the committee was not moving forward in its work, that there were clearly divergent views and issues, and that there was a need to amend the resolution. 

General provisions, criminalization and Jurisdiction

The afternoon meeting in plenary discussed the first three chapters of the draft convention text, specifically articles 1, 6–8, 11–13, 16 and 18–22. Article 13 on offences related to online child sexual abuse or child sexual exploitation material received the most attention. The EU proposed a change of terminology in paragraphs 2 and 5; there was a discussion on the deletion of ‘without right’, with Jamaica ultimately withdrawing its proposal in favour of consensus; Egypt recalled its proposal to delete paragraphs 3 and 5; and there was a discussion on the definition of ‘child’, with Egypt, Mauritania and Syria supporting the use of the Committee on the Rights of the Child (CRC) definition, but the US (which has not ratified the CRC) stating that it cannot support this definition as it does not consider international criminalization or cybercrime. On the positive side, Article 16 (2) (c-e), Article 18 (1), Article 19 (1–3), Article 20 and Article 21 (1, 3, 5, 6 and 8) were agreed to ad referendum. 

Crunch time, with a lot at stake

Throughout the proceedings on day 6 of this concluding session, it became clear that a concerted effort is needed to ensure proper scrutiny of proposals by both time-pressed delegates and external stakeholders – whether on the resolution to adopt the convention or on the core issues of the convention itself. Unfortunately, there is still too much risk, ambiguity and lack of transparent decision-making as the committee enters its final days and potentially makes an indelible decision to adopt a legally binding convention – with implications for real people around the world and for the future of the UN itself.

#7: Terms, terms, terms [7 February 2024]

On 6 February (day 7), the concluding session of the Ad Hoc Committee (AHC) continued its series of meetings. As delegates stretch themselves to keep track of several sub-track discussions (including a compromise package) in informals, some important provisions were brought to the plenary for the first time, including the chapter on the use of terms and Article 36 on data protection. Prevention, technical assistance and information exchange, and the implementation mechanism were also discussed. Meanwhile, the core discussions on scope and safeguards continued in informals, with a revised ‘package’ from the Chair expected to be debated for the first time in the plenary today.

Procedural measures and law enforcement and international co-operation

The morning session opened with many articles in chapter 4 on law enforcement and chapter 5 on international co-operation being adopted ad referendum. In particular, articles 25–27, 31–34 (1–3) and 37 (1, 2–3, 8 and 10) were adopted ad referendum.

Terminology

Although some progress seems to have been made on the terminology chapter as a whole, the discussions in the plenary still reflected divided positions on the technical nomenclature being used throughout the convention. Most of the morning discussion centered on whether member states would prefer to use the term ‘information and communications technology system’, which was supported by Russia, Mauritania, China, Egypt, Venezuela, Iran, Burkina Faso, Bahrain, Mali, Oman, Morocco, Mozambique, Namibia, Malaysia, Algeria, India, Papua New Guinea, Vietnam, Senegal, Sierra Leone, Indonesia, El Salvador and Tanzania. The EU and its member states proposed  ‘information system/data system’ as the preferred term, which was supported by Norway, the Czech Republic, Georgia, the UK, Albania, Canada, Côte d’Ivoire, Costa Rica and Vanuatu.

There are still outstanding definitions to be agreed on that have not yet come up in the plenary. One is the paragraph defining stakeholders within the scope of the convention. The Chair’s proposal is to include ‘relevant stakeholders’, in line with the use of the term in General Assembly resolution 75/282 (which mandated the AHC). The importance of stakeholders in this process has been widely acknowledged. A provision open to a broad set of actors, including international and regional intergovernmental organizations, non-governmental organizations, civil society organizations, academic institutions and the private sector, could therefore consolidate the AHC as a model for stakeholder engagement.

Another key term that is yet to come out in the plenary discussion on terminology is ‘serious crimes’. In the current convention draft, the definition of serious crimes is linked to the length of the sentence (inspired by the UN Convention Against Transnational Organized Crime). However, as previously noted by the GI-TOC, the current use of ‘serious crimes’ has the potential to significantly amplify the scope of the convention and is a key term to consider in conjunction with discussions on human rights safeguards.

Gender

Another recurring issue of nomenclature came to light during the afternoon session. This was the use of terminology around gender in the preventative measures chapter. The Chair’s draft includes the need to develop strategies and policies to prevent and eradicate gender-based violence. This is a very important provision to protect the needs of people who, because of their gender, are disproportionately affected by the crimes under the convention. However, Russia reiterated its position to delete this term (supported by Nigeria, Iran, Pakistan, Saudi Arabia, Mauritania, Qatar, Oman, Bahrain and Kuwait). The member states in favour were very clear that this was a key provision and included Iceland, Colombia, the EU, Costa Rica, Chile, El Salvador, Switzerland, Albania, Mexico, the US, Panama, Peru, the Republic of Korea, Cabo Verde, Sweden, Australia, Kiribati, Lebanon, Ecuador, Paraguay, Norway, Moldova, Canada, Brazil, Georgia, Germany, New Zealand, São Tomé and Príncipe, the Philippines and Thailand.

Technical assistance and information exchange

Discussion of the US’s proposal to weaken the expectation of technology transfer through the convention, by adding the word ‘voluntary’, was revived in the afternoon session. Yemen, Colombia, Iran, El Salvador and Pakistan did not support it. In the end, the US withdrew it due to controversy and for the sake of consensus, which appears to be a considerable compromise. However, Iran pushed further by proposing to delete the caveat ‘where possible’ from the paragraph, which was not supported by the US, El Salvador, Colombia, Peru, Jamaica (on behalf of the Caribbean Community) and Panama. The Chair ultimately asked Iran to reflect and reconsider the paragraph as drafted.

Implementation mechanism

With regard to Article 57 (3), in an effort to duplicate the inclusive and clear modalities of the AHC itself, Canada had proposed to add language related to the rules of procedure of the Conference of the States Parties. In the afternoon session, it proposed an amendment to add ‘taking into consideration General Assembly resolution 78/782 of 26 May 2021’ after ‘set forth in this article’, which was supported by Norway, Japan, the EU, Chile, the US and Vanuatu. Egypt requested more time to consider this proposal and suggested removing the final sentence of this paragraph or deleting ‘inclusivity’, which was supported by Vietnam but not by Norway, Japan, the US and Vanuatu. Russia, Iran and Vietnam reserved their position on the Canadian proposal. And as seems to have become the rule rather than the exception, no consensus was reached.

The Chair will present a draft of the main compromise package on scope and human rights safeguards to the plenary today. In a sign that this is a serious moment of decision, the Chair has announced that the morning meeting of the plenary will be held from 11.00 am to 1.00 pm (starting one hour later than normal) to consider the further revised package, and that no informals will be held today.

The mood in New York does not feel positive, and the signs from the public discussions so far do not bode well for a consensus. Three days to go.

#8: To be, or not to be [8 February 2024]

To be, or not to be? That is the question facing member states during the last two days of the concluding session of the Ad Hoc Committee to Elaborate a Comprehensive International Convention on Countering the Use of Information and Communications Technologies for Criminal Purposes.

According to the Chair’s methodology, the morning session of 7 February was dedicated to discussing the ‘package’ (i.e. provisions on the core issues on which member states had not reached agreement) while the afternoon was devoted to the revised draft, which had been circulated to member states on the evening of 6 February. As became clear during the morning session, the package required more time than initially provisioned, and the discussions stretched into the afternoon. Most of the member states present in the plenary opted to take the floor to express their support (or lack thereof) for the compromise proposed by the Chair. The Chair then decided to hold a reading of the revised draft on Thursday, with the exception of the articles included in the ‘package’ and articles 13 and 15 (provisions relating to online sexual abuse and non-consensual dissemination of intimate images). These provisions require further deliberation by member states.

After seven sessions, the main question remains the same: is this a focused cybercrime treaty or a broader instrument for criminalizing and facilitating international cooperation on a wide range of crimes? As it stands, the treaty is still a confusing mix of both, and perhaps that is why it has been such an enormous effort to ‘strike the right balance’.

A compromise?

One of the most controversial elements of the package is Article 59 (3) on human rights and non-discrimination, which was the subject of extensive discussion during the morning and afternoon sessions on Wednesday. This provision seeks to encapsulate Canada’s proposal for an additional paragraph to be included in the article on scope (Article 3). This proposal is an important safeguard to prevent the convention from being misused to persecute individuals on the basis of individual characteristics, including expression, opinion, conscience and belief. Member states opposing this provision argue that the language proposed by Canada lacks a legal basis. As a compromise, the Chair’s package incorporates some of the language originally suggested by Canada, but places it in the implementation chapter of the convention (rather than under scope). During the session, Canada proposed new language that could accommodate those who felt that this proposal lacked a legal basis, but no concrete decision was taken. 

Where the room could not agree on Canada’s proposal, it seemed to come closer to a compromise through New Zealand’s proposal, which addresses the same issues. That is, to move the non-discrimination clause currently in Article 37 (15) to an overarching provision applicable to the entire international co-operation chapter in Article 35. This is a welcome step towards a more protective framework – especially if the scope remains broad, allowing for cooperation on any serious crime. In the morning and afternoon sessions, this proposal was supported by the EU, Brazil, Argentina, Uruguay, Canada, Chile, the US, Liechtenstein, Mexico, Peru, Singapore, Sweden, Norway, Iceland, Colombia, Georgia, Japan, Albania, Costa Rica, Australia, Kiribati, Vanuatu and Moldova. It was not supported by Egypt, Cuba, Mauritania, Iraq, Oman, Burkina Faso, Libya, Tanzania, Namibia and Bahrain, which argued that more safeguards were not needed when articles 5 and 24 already covered the protection of human rights.

Coming out of yesterday’s sessions, the Chair is now considering the comments put forth and continuing with consultations. The Chair said she would try to work on the New Zealand approach and another proposal put forward by Cuba and Zimbabwe in an attempt to find a common solution. This approach proposed merging articles 5 and 59 (3) and moving them to the implementation part of the text. The Chair will try to present an outcome as soon as possible so that an agreement can be reached to avoid a vote.

As the clock ticks, delegates are preparing for all possible scenarios, including a vote or acceptance that the AHC concluding session will not be conclusive. The pressure of time may yet help to make progress. During yesterday’s session, Iceland strongly articulated its own position on the Chair’s package as being close to or on many of its redlines when it comes to human rights and freedoms.  Equally, any progress based on the Chair’s latest proposals fills many observers with trepidation and fear of the negative impact it will have on rights and safety online.

#9: Decision time. [9 February 2024]

On 8 February (day 9), the concluding session of the Ad Hoc Committee to Elaborate a Comprehensive International Convention on Countering the Use of Information and Communications Technologies for Criminal Purposes held its penultimate day of discussions.

Following the Chair’s methodology, delegates focused on the reading of the further revised draft text (excluding the articles included in the Chair’s compromise package). Although some might have expected the reading to be more straightforward than the discussions on the package deal, the day’s proceedings highlighted the ongoing disagreements – often exposing the different cultural and social values that countries bring to this negotiation.

Back to the beginning

Member states once again spent most of the morning discussing the preamble and articles 1 and 2 of the convention. The Chair asked member states not to reopen the debates, but rather to express whether the preamble as a whole was acceptable. However, it quickly became clear that member states still had some divergent issues on which they were not ready to agree. The plenary heard concerns about the broad scope of the convention as reflected in the preamble, the reference to a list of crimes, and possible conditionalities on technology transfer (an important point for developing countries, for example, who want to keep as many opportunities for capacity-building open as possible, as opposed to Western countries who do not want to commit to this unconditionally).

Russia expressed disagreement with the use of the word ‘cybercrime’ in the title – again exposing the fundamental disagreements at the heart of the negotiations. With regard to Article 2 on the use of terminology, there still seems to be concern about the definition of ‘serious crimes’ and ‘child’. These are both terms that are inextricably linked to two sets of provisions that are still being debated by member states (namely, the scope and provisions relating to the exploitation of children online).

A question of values

The afternoon session was primarily devoted to the criminalization chapter. Although articles 13 and 15 were not originally intended to be part of the plenary reading, member states returned from the informals and the provisions were discussed at the plenary. There was considerable debate on both provisions’. Egypt, citing moral values, made a statement on behalf of itself and Algeria, Bahrain, Iraq, Jordan, Kuwait, Libya, Mauritania, Morocco, Oman, Palestine, Qatar, Saudi Arabia, Sudan, Syria, the UAE, Yemen and Iran to make their position clear on these points, including the deletion of Article 15. A point of disagreement for them is in the exception of liability regarding ‘material that is produced as part of a consensual sexual relationship [between those who have reached the legal age of sexual consent] where such material is maintained exclusively for the private use of the persons depicted.’

Therefore, proposals to delete some key paragraphs from the article (paragraphs 3 to 5, which include safeguards to prevent the criminalization of children who engage with their own sexuality and to ensure privacy protections) were strongly opposed by Jamaica (on behalf of the Caribbean Community), Liechtenstein, Argentina, Norway, Australia, Japan, Uganda, Iceland, Switzerland, Vanuatu, Georgia, Austria, the UK, New Zealand and the EU. The statements opposing the deletion of these protections and exclusions laid bare the different cultural and social principles invoked between this group and the predominantly Arab group that wished to remove them, representing the fundamental difference of opinion that seems difficult to bridge.

There was also contention over the new paragraph 6 of Article 15, which enables a broad scope of criminalization and which was not supported by several delegations, including the EU, the US, Australia, Liechtenstein, Iceland, Switzerland, Jamaica (on behalf of the Caribbean Community), Canada, Georgia, Austria, the UK, New Zealand and Japan.

There was similarly plenty of debate on Article 6(2), with the same discussion on articles 7, 11 and 12 and the addition of ‘criminal intent’ to the draft text. Yemen, Russia, Pakistan, Indonesia, Tanzania and Venezuela supported the text, while New Zealand, Albania, Australia, the UK, the US and the Netherlands opposed it, preferring the phrasing ‘dishonest intent’. Article 16(2)(c) – on predicate offences – was also the subject of disagreement, with several delegations objecting to the inclusion of paragraph 2(c), which attempts to characterize the ‘seriousness’ of the predicate offence.

Jumping ahead to chapter V on international cooperation for the last 30 minutes of the day, most of the discussion on articles 45 and 46 saw delegations reiterating earlier discussions on whether they supported the use of ‘may’ or ‘shall’ at the beginning of the sentences, i.e. making the provisions on mutual legal assistance mandatory or voluntary. On Article 48, the US supported clarifying that this article applies only to offences established in accordance with the convention, which was supported by New Zealand, Switzerland, Canada, Norway, Iceland and Argentina.

Endgame

Today is the last day for member states to conclude negotiations and present a final draft text. It is up to the Chair to choreograph the rest of the session, but her power rests in the hands of the member states who have the right to respond, to call for votes or to negotiate on her proposals for the way forward. At this stage, there simply does not seem to be the space or the time left today to make the major compromises that are needed, to have them legally reviewed and to sign a consensus-based draft convention.

So, if there is going to be a vote or a series of votes, today is the day. The other option, which seems more reasonable and realistic at this point, is to seek an extension of the committee’s mandate. This would, of course, require the allocation of resources and space in the UN, as well as a clear political will on the part of member states to reach a conclusion in a later session. Either way, we should have clarity on what the endgame of the negotiations will look like by 6.00 p.m. EST today.

Thank you for reading our daily updates from the Cyber Convention negotiations. We will be reporting in more detail on the entire session once it has concluded. 

And it looks like we could be back for another session later in the year …

Find out what is happening at the UN session by following our Cyber Convention Check-in. We will be keeping our eyes and ears on the ground to bring you the latest news in your inbox throughout the proceedings.

Stay informed with regular updates on this page until February 9, 2024. Sign up to our UN engagement mailing list to receive the Cyber Convention Check-in in your inbox.