The UN’s proposed cybercrime convention: notes from the fourth session

Earlier this month, the UN’s Ad Hoc Committee on Cybercrime (AHC) concluded its fourth session to discuss a proposed UN convention on cybercrime. At the meeting, states had their first opportunity to negotiate draft text, focusing on the first three chapters (on criminalisation, procedural measures and general provisions).

Before the session, we provided our input, and contributed to a joint letter—signed by 79 civil society organisations in more than 45 countries—highlighting our concerns about the many risks the text poses to human rights.

Below, we feed back from the negotiations on the first three chapters of the draft text, drawing out key areas of agreement and disagreement, and considering what’s to come.

General provisions

The general provisions set out the headlines for what states have agreed to, including on the scope of the convention, terminology, jurisdiction, and the complementarity of the convention to international human rights law treaties. The provision relating to the use of terms was quickly delegated to an informal group by the chair for further discussion between the fourth and fifth sessions (one of the four informal groups created by the chair which were held outside the formal plenary and closed to non-governmental stakeholders). This reflects just how contentious the negotiations are—ordinarily, a lack of definitional clarity would be a major hindrance in agreeing a treaty of this kind; in this case, it is the only way states have found to proceed.

The proposed Article 5 (respect for human rights) also proved contentious. Certain states sought express recognition of the complementarity of the convention with a number of international human rights treaties (including the EU and its member states, Canada, New Zealand, US and Ecuador). We also welcomed proposals by Venezuela and others to avoid references to a closed list of “vulnerable” groups—language which does not reflect the international law obligation of non-discrimination—and by Switzerland, Canada and others to strengthen gender mainstreaming language.

At the same time as these positive proposals, others sought the deletion of the article in its entirety (India, China, Syria, Russia, Iran and Tonga). Including respect for human rights in the general provisions reinforces the protective and cross-cutting application of human rights throughout the implementation of the convention. Rather than the article being deleted, we need this to be strengthened throughout the text.

Criminalisation

Much of the discussion under the criminalisation chapter focused on the content-related offences included under Articles 18-21 and Articles 24-25 (known as clusters 5 and 7 of the draft text). Reflecting discussions in the last three sessions held last year, there was broad support among states for the inclusion of child sexual abuse material offences (Articles 18-21). But now that pen has been put to paper, the draft text on this is deeply contested, and the revised draft reads as an unwieldy maze of red.

The extent of support for various content-related offences is worrying from a human rights perspective. These offences are inappropriate within a global cybercrime convention and include language that risks capturing the legitimate sexual expression of adolescents. As noted by the Office of the High Commissioner for Human Rights (OHCHR), the use of vague terms like “grooming”—especially when linked to “unlawful” sexual conduct as determined under states’ domestic law—has been used to abuse and discriminate against LGBTQI people. It was promising to hear certain states (the Republic of Korea, Switzerland and others) calling for the removal of vague terms.

One example of the recurring disagreements over how much should be left to domestic legislation versus defined in the convention was the debate over whether the convention should mandate aggravated (higher) penalties for certain offences. Other disagreements related to the language on criminal intent, harm, and the use of “unlawful interference” versus “interference without right”. While we welcome the recognition by certain states (Australia, the US and others) of the need to ensure the text is appropriately drafted so that the legitimate activities of security researchers will not be criminalised, the text still falls short of ensuring this will not happen.

The Chair began negotiations by designating some of the most contentious (and rights-violating) proposals in the chapter—including problematic provisions on extremism and terrorism—for discussion in informal groups (the groups created by the Chair which were held outside the formal plenary and closed to non-governmental stakeholders). It’s unclear how these discussions will proceed, but it’s possible they’ll be dropped as a result of the lack of consensus. It’s also possible that these contentious provisions could resurface in a new or merged form—something we’ll be looking out for.

A last minute scare came with the inclusion of China’s proposed offence on the “dissemination of false information” in one of the revised versions of the draft text. Yet this received so little support (and clear condemnation from New Zealand, the US, Japan, the Republic of Korea, Colombia and others) that it is difficult to see how it could be kept.

Procedural measures and law enforcement

This chapter is hugely important from a human rights perspective. It must include strong safeguards to ensure procedural and investigative powers are only used where necessary and proportionate, and with limitations on their scope and duration, among other safeguards and conditions. We were pleased to hear calls from states that echoed those of civil society. For example, many states welcomed the inclusion of references to proportionality and necessity (Chile, Norway, Slovenia and others) and made proposals to strengthen the article on safeguards (Article 42) by including reference to the right to an effective remedy (the EU and member states) and to international human rights law treaties (Australia).

At the same time, some dangerous proposals were put forward. A few states, led by Egypt, questioned the relevance of globally accepted principles of proportionality and necessity in governing states’ use of procedural powers. Singapore, Malaysia, Russia and others sought the deletion of Article 42 (safeguards), referring to it as duplicative of Article 5 (respect for human rights). There was also an attempt by states from within one of the informal groups—the group set up to discuss Articles 40, 47 and 48—to take discussion of procedural safeguards (Article 42) out of the (open) plenary and into the (closed) group, which would have meant no multistakeholder oversight of state negotiations on one of the most vital articles of the convention. This disaster was averted as the proposal was rejected by the Chair.

Articles 42 and 5 are, in fact, complementary and mutually reinforcing. Together, they underscore compliance with international human rights law treaties as a condition for the application of the convention, and insert concrete safeguards and conditions for the use of the powers contained within it. Going forward, it is vital for states to strengthen this area of the text, not to weaken it, and for it to be bolstered by specific safeguards and limitations within all relevant chapters.

Again, the Chair designated some of the most contentious and damaging proposals—Article 47 on the real-time collection of traffic data and Article 48 on the interception of content data, alongside Article 40 on jurisdiction—to further discussion in a dedicated informal group. While the next steps remain unclear, it’s essential that any changes to these articles ensure they do not permit any blanket or indiscriminate data retention measures.

One area in which states appeared to converge was on permitting the sharing of e-evidence for a broad scope of crimes. This is perhaps unsurprising given that, in spite of many and varied disagreements, there is a shared will to strengthen international cooperation and facilitate the sharing of e-evidence.

A note on process, and what’s to come

In some ways, the AHC has departed positively from more securitised UN processes and shown more openness to multistakeholder engagement. But, despite some bright spots, engaging in the process as a civil society organisation has been difficult due to a lack of clarity, consistency and transparency at several points. Most notable has been the use of informal (closed) co-facilitated discussions, preventing non-governmental stakeholders from following the full course of the negotiations.

Clarity, consistency and openness are even more necessary during the current “intersessional” period. In the next few weeks, states will be submitting their proposals on the first part of the convention, and preparing their input on the second part. Informal groups have also published their working documents with state proposals for the articles under discussion, but it’s unclear how these groups will continue their discussions in the intersessional, and how non-governmental stakeholders can input. It appears that much will be negotiated on, but with few formal pathways for non-governmental stakeholders to contribute.

At the next (fifth) session—scheduled for 11-21 April—states will continue negotiating the second part of the convention (on international cooperation, preventive measures, technical assistance and the mechanism of implementation and the final provisions). After the fifth session, the chair will produce a “zero” draft, due to be released in August. The zero draft is a fairly advanced stage of the treaty and negotiations over its contents will be even more politicised.

We’ll continue to keep a watchful eye on the process and to advocate for a treaty which respects, protects and fulfils human rights.