The UN Cybercrime Convention: where do we go from here?
On 8 August 2024, amidst widespread concern by many observers, including GPD, the text of the draft United Nations Convention against combating cybercrime was agreed to by governments in New York, marking the conclusion of a fractious three year negotiation process.
Along with a large group of civil society organisations working locally, regionally and globally to promote a human rights respecting approach to digital technologies, GPD engaged throughout the negotiation process. The final result is disappointing and falls critically short of the basic, minimum requirements set out by 100+ civil society groups, and most recently by civil society and industry as the draft entered its final negotiations. Specifically, we criticised the overly broad criminal provisions and expansive procedural and cooperation powers without adequate or consistent conditions and safeguards.
Despite these fundamental and wide-ranging concerns, the Convention was agreed by the Ad Hoc Committee on Cybercrime (AHC). Next, it will proceed for approval by the UN General Assembly’s Third and Fifth committees, before being tabled for adoption by the General Assembly itself, most likely in early 2025. Given its critical flaws, we join the chorus of actors calling for the Convention not to be adopted by states at the General Assembly nor ratified or acceded to domestically (see for instance here and here). However, if the Convention does proceed, there should be careful scrutiny of the text and consultation with human rights groups and experts to ensure it is implemented and interpreted in a manner to provide for heightened safeguards and limit any negative impacts on human rights.
Advocacy to avert adoption should also be accompanied by active engagement in any negotiations around an optional protocol to the Convention, which was agreed to during the negotiations. This protocol, which would provide for a further expanded scope of offences, is anticipated to pave the way for restrictions on expression in a manner incompatible with international standards, as well as increasing the risk of arbitrary and punitive application of the Convention’s powers.
While continuing to advocate for adoption to be averted, we should, in parallel, use this time to learn lessons from how this process unfolded: via a close analysis of the negotiation process, its modalities of engagement and the ability for stakeholders to shape the final outcome. This is imperative not only in the context of the present Convention and its potential adoption and ratification, it is also necessary to more broadly consider the trajectory of civil society engagement in future UN processes; elucidating the limits and potential of accommodating multistakeholder principles of open, transparent and inclusive engagement approach within a multilateral paradigm.
How did we arrive at this critical and rights-threatening juncture?
As we outlined in a piece for Open Global Rights, the proposal to initiate a process to negotiate the Convention was only narrowly passed—with a large number of states voting against or abstaining, some arguing that the UN was not the right place to advance discussions against cybercrime already covered by other regional and international instruments. This criticism was reinforced by human rights groups, who have documented how existing cybercrime laws at the national and regional levels are frequently misused by states to target human rights defenders, journalists, whistleblowers, and technologists; impose unjustified restrictions on expression; and justify disproportionate surveillance powers. In this context, many voiced concerns about the risk of new global standards resulting in a “race to the bottom” on human rights protections.
As some noted at the time, the inception of the process in this manner made it incredibly challenging to influence the outcome in a rights-respecting manner. On the one hand, considerable analysis and engagement was needed to rebut a series of deteriorative proposals made by certain governments throughout the development process (including proposals to incorporate provisions criminalising the dissemination of fake news, extremism, hate speech or incitement and terrorism—terms which lack a universally agreed definition and whose inclusion in domestic cybercrime laws have resulted in well-documented abuses). Other governments and certain stakeholders, by contrast, held that to reject the process would undermine the principle of multilateralism, with spillover effects on the rule of law and digital cooperation.
This latter point is key, in a context where the UN’s role in digital technology governance—particularly global AI governance—is increasingly debated and questioned. Wider concerns around a “global governance deficit”, referring to fragmented and overlapping regulatory frameworks related to digital technologies, alongside “gaps” affecting whole regions, clearly coloured these discussions. It may account for why certain governments who rejected the process at its inception overrode their concerns—judging it more important to show support for a consensually negotiated, harmonised framework for digital cooperation, on an issue of ever-growing importance.
This combination of factors—including rights-violating proposals on one hand, and geopolitical caution on the other—combined to frustrate the possibilities for advocates to shape the course of negotiations, while ultimately increasing the likelihood of a more flawed and damaging instrument.
A critical appraisal of the process
Regarding the process, one caveated win for human rights defenders was the early establishment of modalities that allowed for the participation of different stakeholders, including civil society and the private sector, in the negotiations. The opportunities for stakeholders to be in the room and follow the discussion afforded the possibility to actively contribute by providing guidance to governments and suggestions for how to mitigate negative human rights impacts of some of the discussed proposals. The opportunity to make oral interventions reflected an element of openness and inclusion of a wider range of perspectives of those groups able to follow the process. However, there were ongoing issues relating to last minute calls for interventions without advance notice which created difficulties for stakeholders to make themselves available at short notice and take advantage of these opportunities.
Another positive element to highlight was the enabling of remote participation for some of the AHC meetings, decreasing the cost barriers for some groups, particularly in the global Majority, who may have been unable to fund travel to meetings or square their engagement with busy agendas and competing priorities. It is notable that this last element was questioned during the process but fiercely defended by certain governments that valued the stakeholder contributions.
The engagement of civil society groups was also facilitated by close and real-time coordination between groups—either on the ground or following remotely—which provided a level of partnership and flexibility in collectively tackling the advocacy opportunities available, and expanded outreach to a more diverse set of governments to provide perspectives and recommendations. It is remarkable that this strong coordination was sustained over the three years of negotiations, weathering personnel changes and resource constraints—a testament to the resilience and commitment of groups within our field. It is particularly encouraging that so many actors from the global Majority were able to participate, both on the ground and remotely; and we are honoured that GPD was able to help facilitate, support and fund this. It is also worth noting how the widely recognised threats to human rights posed by the Convention text provided an opportunity for civil society to collaborate with private companies also worried by those outcomes. This relatively unusual alignment could provide a template for future coordination across stakeholder groups, where appropriate and consistent with our values, and warrants further exploration.
We have not been quiet in our disappointment on the final outcome of the Convention. But we also want to underscore how proud we are of the fierce action taken by a coalition of civil society groups, which—against the odds—have managed to carve out concrete commitments from several governments to mitigate a race to the bottom and insert critical baseline human rights protections in articles 6 and 24 of the Convention. This coordinated civil society action has unquestionably had a positive impact on the outcomes of this process, even if the final result does not reflect the human rights standards we collectively pursued during its drafting.
A final takeaway from this process is the need to think and approach governments in a flexible and variegated manner. Governments, after all, are not monoliths: they are coalitions of different perspectives and mandates. A diplomatic branch of a member state has a different set of priorities and sensibilities than an investigative or prosecutorial body; to effectively advocate to them, we need to tailor our framing and tactics accordingly.
Next steps for advocacy
With the text yet to be adopted, many will continue the work to avert the signatory and ratification process. If and when the Convention is adopted at the General Assembly, it will turn to individual governments to ratify or accede; this is not a simple process, and is likely to require parliamentary approval in many contexts.
During this period, much work can be undertaken to advocate nationally. As we have captured above, governments are far from being monolithic, and some of the compelling arguments we developed against the final text of the Convention—which illustrate how overly broad and risky it is from a human rights perspective—may find a more willing audience when moving to a national context.