Confusion & Contradiction in the UN ‘Cybercrime’ Convention

On Aug. 9, an ad hoc United Nations committee unanimously adopted draft language for a new cybercrime convention (the Draft Convention). The Draft Convention represents an effort by certain repressive, anti-democratic regimes to erect a veneer of legitimacy through international law for efforts to target subversive elements within their own societies. Indeed, while generally referred to as a “cybercrime” convention, the Draft Convention goes far beyond any good-faith effort to address the proliferation of malicious cyber actors—many of which operate in the service of the Draft Convention’s original sponsors. Reflecting the Draft Convention’s lengthy, contentious drafting process, its official name is a hollow dissemblance: “Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes.” The Draft Convention has generated significant criticism that its overly broad language and lack of meaningful human rights safeguards makes it susceptible to abuse by authoritarian governments. And yet the United States, and the U.S. Department of Justice in particular, has endorsed this document, notwithstanding its many and obvious flaws. 

In addition to the Draft Convention’s fundamental danger as a means of laundering authoritarianism across borders, the document almost certainly poses a conundrum for the Justice Department, specifically, and the U.S. diplomatic establishment, generally. The Draft Convention would weaken the United States’s ability to resist requests from authoritarian governments, whether or not made pursuant to a mutual legal assistance treaty (MLAT), and weakens the United States’s ability to dissuade foreign states from assisting in improper, suppressive investigations launched from states such as Russia or Iran. Were the U.S. to sign and later ratify the Draft Convention in its current form, the U.S. and Justice Department in particular would face diplomatic complications of its own making.

Authoritarian Origins

If passed by the UN General Assembly, the Draft Convention would, for all practical purposes, replace the existing international framework on cybercrime: the Budapest Convention. The Budapest Convention, which was drafted by the Council of Europe to facilitate cooperation among nations to combat cybercrime, has served as the sole international convention on cybercrime for nearly 25 years. Adopted in 2001, the Budapest Convention has 68 signatories, including the United States and nearly all Western democracies.

Although subject to its own criticisms, the Budapest Convention by and large avoids the Draft Convention’s most egregious pitfalls that make it ripe for abuse by authoritarian regimes. For example, the Budapest Convention is limited to specific substantive offenses, such as illegal access, illegal interception, data interference, system interference, computer-related forgery, and computer-related fraud. In addition, each and every one of the Budapest Convention’s evidence-gathering measures are made subject to human rights protections. 

The main criticism of the Budapest Convention, and purported impetus for the Draft Convention, is not substantive but, rather, is that the Budapest Convention is the product of a drafting process led by Western, democratic nations. A number of authoritarian states such as Russia and China have rejected the Budapest Convention and have long advocated for a new international cybercrime convention. Therefore, in 2019, Russia, with support from Belarus, China, Iran, Syria, Venezuela, and others, sponsored a UN resolution to adopt a new international cybercrime resolution. The UN General Assembly passed the resolution despite opposition from the United States and the European Union, forming an ad hoc committee to craft the convention. 

An Overview of the Draft Convention

Despite originally opposing the Russia-led resolution, many Western nations, including the United States, were heavily involved in an attempt to shape the Draft Convention in the ad hoc committee. Notwithstanding their input, the Draft Convention differs significantly from the Budapest Convention and has garnered significant criticism as a result.

Critics of the Draft Convention have observed that it lacks specific safeguards for basic human rights and includes broad language that is ripe for abuse by authoritarian governments. Most notably, the substantive offenses defined in the Draft Convention, such as illegal access, illegal interception, and interference with electronic data, do not contain any meaningful intent requirement and are broadly and ambiguously defined. For example, in one provision, the Draft Convention states that “illegal access” must be “intentionally committed.” However, the next section—which subtly but importantly diverges from the Budapest Convention’s analogous language—arguably allows states to bypass any meaningful intent requirement. It outlines that “a State Party may require that the offence be committed by infringing security measures, with the intent of obtaining electronic data or other dishonest or criminal intent or in relation to an information and communications technology system that is connected to another information and communications technology system.” That reference to “other ... criminal intent” exceeds the Budapest Convention’s language, which focuses squarely on intentional and dishonest access; the Draft Convention’s inclusion of “other” criminal intent is in line with its original sponsors’ targeting of journalists and other critics of the state. 

Far more troublesome is that the Draft Convention encompasses “serious crimes,” which is broadly defined to include any “conduct constituting an offence punishable by a maximum deprivation of liberty of at least four years or a more serious penalty.” The Draft Convention also contains expansive provisions for the exchange of evidence and the provision of assistance between parties—provisions that fail to prevent unreasonable search and seizure or protect other basic rights, and which are seemingly not subject to the human rights protections applicable only to certain “chapters” of the Draft Convention. The Draft Convention also contains unusually broad jurisdictional hooks. For example, the Draft Convention extends not only to offenses “committed in the territory of [a] State Party” but also to offenses “committed against a National of that State Party,” “committed by a national of that State Party,” and “committed against the State Party.” 

The Draft Convention also lacks specific human rights safeguards. The convention provides blandly and nonspecifically that “States Parties shall ensure that the implementation of their obligations under this Convention is consistent with their obligations under international human rights law.” It further states that “[n]othing in this Convention shall be interpreted as permitting suppression of human rights or fundamental freedoms, including the rights related to the freedoms of expression, conscience, opinion, religion or belief, peaceful assembly and association, in accordance and in a manner consistent with applicable international human rights law.” To the extent that this is meant as a substantive protection, it is difficult to reconcile with the intent of the Draft Convention’s staunchest proponents or with the domestic and transnational repression practiced by those states.

Additionally, for each state party, the convention’s procedural and evidence collection mechanisms are made “subject to conditions and safeguards provided for under its domestic law, which shall provide for the protection of human rights, in accordance with its obligations under international human rights law, and which shall incorporate the principle of proportionality” (emphasis added). However, the Draft Convention fails to include any language implementing these provisions, leaving them open to interpretation and without any substantial effect. Of course, any pretense that the authoritarian sponsors of this Draft Convention would, under their own domestic laws, be constrained from violating basic freedoms is farcical. This is a treaty intended by its sponsors to whitewash transnational harassment of journalists and artists; the measures negotiated by Western states do little to constrain that fundamental intent and, as described below, present obstacles to future resistance.

The Justice Department’s Invited Conundrum

The aforementioned problems should have been sufficient to ensure that the United States and its allies would reject the Draft Convention in favor of drawing cooperative nations into the framework of the Budapest Convention. But specific complications will stalk the Justice Department, should the Draft Convention be ratified. The Draft Convention, if passed by the General Assembly, will undoubtedly undermine the Justice Department’s ability to reject bad-faith MLAT requests out of hand. The Draft Convention will also box the department into a weak and troubling framework when responding to requests from non-MLAT countries. 

The United States has MLATs with more than 50 foreign nations, which facilitate the cooperation between American and foreign investigative authorities, including the exchange of evidence. All MLATs with foreign states, including with authoritarian governments such as China and Russia, provide the Justice Department with significant latitude to reject requests that would violate American public policy or constitutional principles. For example, the U.S.-China MLAT provides that the “Requested Party may deny assistance” under the following circumstances:

• “the request relates to conduct that would not constitute an offense under the laws in the territory of the Requested Party, provided that the Parties may agree to provide assistance for a particular offense, or category of offenses, irrespective of whether the conduct would constitute an offense under the laws in the territory of both Parties”;

• “the execution of the request would prejudice the sovereignty, security, public order (ordre publique), important public policy o other essential interests of the Requested Party”;

• “the request relates to a political offense or the request is politically motivated or there are substantial grounds for believing that the request was made for the purpose of investigating, prosecuting, punishing, or otherwise proceeding against a person on account of the person's race, religion; nationality, or political opinions”; and 

• “the execution of the request would be contrary to the Constitution of the Requested Party.”

The U.S.-Russia MLAT contains similar, although somewhat more limited language, as do others with governments generally considered to be authoritarian. 

It is easy to envision scenarios in which the Draft Convention, with its broadly defined substantive offenses, broad jurisdictional hook, and lack of robust human rights guardrails—particularly with respect to the exchange of evidence—conflicts with the carefully negotiated MLAT protections described above. For example, it is not far-fetched to imagine scenarios in which authoritarian states submit MLAT requests to facilitate the prosecution of journalists working on news pieces critical of the regime or political dissidents coordinating their opposition to the regime for the simple transmission or receipt of electronic communications, arguing that they constitute “illegal interception” or simply a “serious offense” under the Draft Convention. Indeed, “illegal interception” does not contain a criminal intent requirement and simply requires that the interception be “in relation to an information and communications technology system that is connected to another information and communications technology system.” And, of course, “serious crime” requires only that the conduct be punishable under the requesting party’s domestic law for at least four years. It is also conceivable that the United States receives MLAT requests for data that is simply maintained about—but is never transmitted, received, or otherwise accessed by—journalists, political dissidents, or whistleblowers abroad, such as bank records, as long as the underlying crime being investigated carries a penalty of at least four years of imprisonment. 

While the Draft Convention provides that existing treaties on mutual legal assistance will apply to foreign requests assistance where such treaties are already in force, the Draft Convention will undoubtedly complicate the Justice Department’s ability to push back on bad-faith requests under existing MLATs. When the most recent statement of international law is in direct tension with any decision to resist requests that fall under the scope of the Draft Convention, the department’s ability to swiftly and strongly reject such requests is undercut. Rather, if the Draft Convention is adopted by the General Assembly, requesting states will be able to credibly argue that repressive requests that fit within the broad scope of the Draft Convention, such as targeting of “seditious” journalists, have a clear basis under international law—international law of which the United States would have become a willing supporter. Requesting states will likely cite the Draft Convention’s broad mandate for mutual cooperation—which is in obvious tension with the reference to existing MLATs’ sub-rosa right to object—providing that “States Parties shall afford one another the widest measure of mutual legal assistance in investigations, prosecutions and judicial proceedings in relation to the offences established in accordance with this Convention, and for the purposes of the collection of evidence in electronic form of offences established in accordance with this Convention, as well as of serious crimes.” In short, rather than the Justice Department rejecting bad-faith requests that violate human rights and basic freedoms out of hand, prosecutors and diplomats will be in the awkward position of rejecting such requests under one treaty (a bilateral MLAT, if it exists) while squaring that rejection with the apparent legitimization of improper requests under the Draft Convention. 

The Draft Convention will also undercut the Justice Department’s ability to push back against problematic requests from the many countries with which the United States does not have an MLAT, a list that includes many states in which the threat of domestic and transnational repression is ever present. Currently, the Justice Department is not required to entertain such requests beyond receiving and, as convenient, rejecting ad hoc letters rogatory. However, the Draft Convention will lock the United States into troubling mutual legal assistance obligations with these nations as to the investigation of whatever they may deem to be a “serious crime.” The provisions lack the same robust human rights and constitutional safeguards as the typical MLAT signed by the United States. Shifting the burden to states that respect the rule of law, the Draft Convention requires that a requested state articulate “substantial grounds” for rejecting a request on the grounds “that the request has been made for the purpose of prosecuting or punishing a person on account of that person’s sex, race, language, religion, nationality, ethnic origin or political opinions, or that compliance with the request would cause prejudice to that person’s position for any one of these reasons.” In addition, while the Draft Convention contains certain additional grounds on which a requested party may reject a request, such grounds are ambiguously defined and again shift the burden of rejection to rule-of-law nations, inviting allegations of double standards when rejecting troublesome requests that undergirded the propaganda and insincere critiques of the Budapest Convention put forth by the Draft Convention’s repressive sponsors. What’s more, the Draft Convention, if broadly adopted, would also undercut the Justice Department’s and broader U.S. efforts to advocate to third countries that improper requests from repressive regimes be rejected under their own systems—thus transposing the same conundrum that the United States will face domestically to its efforts to stop transnational repression abroad.

***

The Draft Convention now moves to the UN General Assembly for a final vote, which is expected to happen by the end of 2024. If adopted by the UN General Assembly, the Draft Convention would be the first new international convention on cybercrime in nearly 25 years. 

The current and future U.S. presidential administrations, along with other Western democracies, can and should reject the Draft Convention. The efforts that would be deployed to combat and counteract repressive requests masquerading as legitimate law enforcement should instead be devoted to deploying the resources necessary to building a robust cybersecurity infrastructure at home and abroad, working to bring additional partners from across the globe into the ambit of the Budapest Convention, while maintaining robust protection for human rights and the rule of law.