UN Cybercrime Draft Treaty Timeline

October 2017
The Russian Federation presents a letter to the UN General Assembly containing a draft of the United Nations Convention on Cooperation in Combating Cybercrime, intended for circulation to Member States. 

November 2019
A resolution, sponsored by Russia—along with Belarus, Cambodia, China, Iran, Myanmar, Nicaragua, Syria, and Venezuela—to set up an international convention to combat cybercrime passes in the UN General Assembly. The resolution was opposed by the US, the EU, and other nations. Human rights organizations, including the Association for Progressive Communications and EFF, urged the General Assembly to vote against the resolution, citing concerns that it “could undermine the use of the internet to exercise human rights and facilitate social and economic development.” 

December 2019
The UN General Assembly adopts a resolution to create an Ad Hoc Committee (AHC) to draft a UN Convention “on countering the use of information and communications technologies for criminal purposes.” Participation in the AHC is open to all Member States of the world, as well as non-member state observers (like the EU and the Council of Europe), civil society, and nongovernmental organizations (NGOs) to varying degrees. The United Nations Office on Drugs and Crime (UNODC), through the Organized Crime and Illicit Trafficking Branch, Division for Treaty Affairs, serves as Secretariat for the Ad Hoc Committee. However, the timing of this effort was controversial, as another UN General Assembly Resolution had raised concerns that cybercrime laws “are in some instances misused to target human rights defenders or have hindered their work and endangered their safety in a manner contrary to international law.”

August 2020
The AHC postpones its first organizational meeting in New York to 2021 because of COVID-19.

January 2021
Human Rights Watch raises alarms that UN member states are beginning the process for a cybercrime treaty whose “champions are some of the world’s most repressive governments…the initiative raises serious human rights concerns.” 

May 2021
The AHC convenes the inaugural organizational session, with representatives from over 160 countries agreeing on an outline and modalities for negotiations. The AHC calls for at least six negotiating sessions lasting 10 days each starting in 2022, to be held in New York and Vienna. The General Assembly passes  the proposal amid complaints by the UK and other countries that Member States were not consulted about the final text and the drafting process lacked inclusivity. 

Many speakers had similar objections, with several diverging over the AHC’s decision-making structure. Setting the terms for negotiations, Brazil introduced an amendment requiring the committee to gain approval of a two-thirds majority of representatives, rather than a simple majority favored by Russia, “before which the Chair shall inform the Committee that every effort to reach agreement by consensus has been exhausted.” The amendment was approved 88 to 42, with 32 abstentions. In a separate iconic decision seeking greater transparency and inclusion, Member States approved a list of representatives to participate in the work of the AHC from relevant academic institutions, private sector, and NGOs including EFF, Eticas, Red en Defensa de los Derechos Digitales, Global Partners Digital, Hiperderecho, and Instituto Panameño de Derecho y Nuevas Tecnologías, among others. NGOs with ECOSOC consultative status can attend as well, such as Privacy International, Human Rights Watch, and Derechos Digitales.

December 2021
Ahead of the AHC’s first negotiating session, EFF, Human Rights Watch, and over 100 organizations and academics working in 56 countries, regions, or globally, urge members of the AHC in a letter to ensure human rights protections are embedded in the final product. The proposed UN CybercrimeTreaty is being put forward at the same time UN human rights mechanisms are raising alarms about the abuse of cybercrime laws around the world, the letter says. The groups emphasize, “It is essential to keep the scope of any convention on cybercrime narrow to protect human rights.”

January 2022
The Committee to Protect Journalists (CPJ) warns that the proposed UN Cybercrime Treaty could endanger journalists by handing new tools to authorities seeking to punish those who  report on the news. “Many authorities around the world already invoke cybercrime or cybersecurity laws to punish journalists – not for secretly hacking into networks or systems, but for openly using their own to publicize wrongdoing,” CPJ said in a statement.

February 2022
The first official 10-day session of the AHC meets in New York and negotiations begin. EFF and human rights NGOs participate remotely and in person, and emphasize the importance of protecting human rights in any proposed UN Cybercrime Treaty. The crisis in Ukraine looms large over the talks, which coincides with rare emergency UN General Assembly and Security Council sessions, where members condemned Russia’s invasion of Ukraine.

A road map and mode of work is adopted, addressing the objectives, scope, and structure of the convention. Importantly, approval was given for intersessional consultations to be held between AHC negotiating sessions to solicit the input of a diverse range of stakeholders, including human and digital rights organizations, on the formation of the draft treaty.

Member States submissions to the first session demonstrate a pronounced lack of consensus about what constitutes a “cybercrime” and how expansive the treaty will be. States including Brazil, Dominican Republic, the European Union (EU), Liechtenstein, Norway, Switzerland, the UK, and the US advocate for a narrower crime-related focus, warning against the use of this treaty to impose broader controls on the internet. Some states have also called for the inclusion of content-related crimes, such as incitement of terror (China, Russia), disinformation (China, Indonesia), and copyright infringement (Indonesia, Liechtenstein, Mexico, Norway, Russia, US).  

March 2022
The first Intersessional consultation with rights organizations and other multi-stakeholders held in Vienna. During a panel discussion before UN Member States, ARTICLE19 expresses concerns about the need for a cybercrime convention and risks that the convention would perpetuate existing abuses of cybercrime laws. AccessNow calls for avoiding over-expansive approaches to criminalization. From the floor, EFF emphasizes the importance of prioritizing the protection of human rights, as failing to do so can have dire consequences, and stresses that the scope of the convention should be restricted solely to criminal matters.

April 2022
Human Rights Watch, EFF, and Privacy International call attention to the shift in geopolitical dynamics that has led many states that were initially opposed to the treaty (nearly a third of UN members) to now actively participate and even take leadership roles in the negotiations.

May 2022
Second negotiating session held in Vienna. The AHC solicits input from a diverse range of stakeholders on proposed text for the criminalization, general provisions, and procedural measures and law enforcement chapters of the treaty. EFF, Privacy International, and Human Rights Watch submit a statement to the AHC emphasizing the importance of including only core cybercrimes in the treaty and avoiding overly broad provisions. During an oral statement in front of UN Member States, EFF, Privacy International, and Human Rights Watch reiterated the need to focus on crimes that specifically target information and communications technologies (ICTs). EFF defined core cybercrimes as offenses in which ICTs serve as both the direct objects and instruments of the crimes. The groups also call for any future treaty to ensure that provisions dealing with illegal, unlawful, or unauthorized access to ICTs do not criminalize security research, the work of whistleblowers, and other novel and interoperable uses of technology that ultimately benefit the public. The session is attended by representatives of 143 UN Members States. 

June 2022
Second intersessional consultation with multi-stakeholders takes place in Vienna. Prior to the meeting, EFF voices concern that some UN Member States are suggesting ambiguous provisions to combat hate speech, extremism, or terrorism, which could significantly jeopardize free expression. For example, Jordan proposes using the draft treaty to criminalize “hate speech or actions related to the insulting of religions or States using information networks or websites,” while Egypt calls for prohibiting the “spreading of strife, sedition, hatred or racism.” Russia, in collaboration with Belarus, Burundi, China, Nicaragua, and Tajikistan,  proposed to criminalize a range of content-related offenses, including vaguely-defined extremism-related acts. The ambiguous terminology used could potentially lead to overly broad interpretations, in many instances failing to meet freedom of expression human rights standards. 

The Office of the United Nations High Commissioner for Human Rights (OHCHR) highlighted that any future cybercrime treaty should not include offenses based on the content of online expression, stating, “Cybercrime laws have been used to impose overly broad restrictions on free expression by criminalizing various online content such as extremism or hate speech.” The necessity of mandating universal adoption of such content-related offenses, which lack consensus among member states and have been used to prosecute activists, is called into question. Such offenses also include criminalizing the distribution of materials that “incite illegal acts motivated by political, ideological, social, racial, ethnic, or religious hatred.” Additionally, the same proposal mandates each State party to legislate against humiliating individuals or groups through ICT based on race, ethnicity, language, origin, or religious affiliation. Adopting these provisions would result in criminalizing protected speech.

India‘s proposals concerning terrorism support offenses are equally problematic, as they lack a globally agreed-upon definition. The term “terrorism” has often been misused to target activists critical of their governments, underscoring the absence of a global consensus on this term. Consequently, such ambiguous provisions pose a risk of stifling political dissent and threatening free speech. 

July 2022 
Civil society sends a letter to the Ad Hoc Committee, requesting the reopening of the accreditation process for stakeholders who missed the initial registration period, which was denied. 

August 2022
Third negotiating session held in New York, in which human rights organizations, including EFF, deliver oral statements regarding the chapters on international cooperation, technical assistance, and preventive measures. Ahead of the negotiations, EFF emphasized that the international cooperation chapter needs to include a dual criminality mechanism and should not have an open-ended scope that applies to every type of crime. EFF also urged governments to invest more resources and training to improve mutual legal assistance treaty (MLAT) systems operation. The session is attended by representatives of 149 UN Member States.

Despite the fact that the convention is about cybercrime, some states argue it should form the basis for international cooperation in evidence gathering for any crime under investigation. The EU, for example, put forward compromise language, saying it remains open to the concept of cooperation applying to the collection of evidence in not just serious crimes, but any crime—a provision in the Budapest Convention—as long as strong human rights safeguards are in place.

Submissions from Brazil and Russia suggest that cooperation could include mutual assistance for investigations and prosecutions in “civil and administrative” cases and other investigations of undefined “unlawful acts.”

November 2022
Third intersessional consultation with multi-stakeholders held in Vienna. EFF and the Office of the High Commissioner for Human Rights (OHCHR) are invited to present their views to Member States. EFF continues to advocate for a more narrowly-focused treaty that includes strong safeguards for human rights protections to prevent potential abuses in the future. OHCHR emphasized that any proposed UN Cybercrime Treaty should reference international human rights laws or regional human rights instruments and standards in the preamble. This would help guide the elements, interpretation, and application of the Treaty, ensuring that it aligns with universally recognized human rights principles. The session was attended by representatives of 149 Member States. 

After the intersessional, the AHC releases the Consolidated Negotiating Document (CND), a draft text of proposed convention provisions created from Member State proposals. The draft has three chapters, starting with a general provisions that include a statement of purpose, scope of application, and a general human rights provision. The second chapter deals with substantive criminal provisions to be adopted at the national level, and is divided into 11 “clusters.” Many of the clusters in the second chapter of the CND may also include content-related crimes that have the potential to interfere with protected speech and fail to comply with Article 19(3) of the International Covenant on Civil and Political Rights. The CND also includes a third chapter on criminal procedural measures and law enforcement, which covers topics such as jurisdiction, z the scope of procedural measures, conditions and safeguards, production orders, search and seizure, real-time collection of traffic data, real-time data collection, and interception of content data, and the establishment of criminal records among other surveillance powers.

December 2022
EFF and 10 other civil society organizations write to the AHC, in a letter supported by dozens of other groups and academics around the world, expressing grave concerns that the CDN “risks running afoul of international human rights law.” The letter recommends a series of revisions and modifications to the CDN to address troubling provisions that could lead Member States to treat various kinds of speech—much of which would be fully protected under international human rights law—as a criminal offense. Additionally, the letter says core cybercrime offenses in the text would impose some restrictions that might interfere with the essential working methods of journalists, whistleblowers, and security researchers and need to be revised. 

EFF and Privacy International submit comments requesting that Member States include robust checks and balances in the draft Treaty to align it with the existing jurisprudence of human rights courts and bodies. For example, the draft text should incorporate the principles of legality, necessity, and proportionality, and require prior independent (preferably judicial) authorization, post-ante independent monitoring, and the right to an effective remedy. EFF and Privacy International also ask for safeguards that ensure any investigative powers listed in the Convention be conducted in ways that do not compromise the security of digital communications and services.

January 2023
The Fourth negotiating session of the Ad Hoc Committee (AHC) held in Vienna, with representatives from 149 UN Member States in attendance. The committee discusses the CND. EFF, Derechos Digitales, R3D, Global Partners Digital, and Access Now deliver oral statements highlighting that among the most concerning features in the CND is the extensive and growing list of proposed criminal offenses intended for inclusion in the draft convention. China’s proposal that the Treaty criminalize “dissemination of false information” in the latest version of the CND, published on January 21, further fuels concerns. 

During negotiations, much of the discussion about the criminalization chapter focused on content-related offenses under Clusters 5 and 7. The AHC Chair adopted a proactive approach to address the most contentious issues, taking discussions outside the formal plenary and into informal groups that were closed to NGO stakeholders. The most contentious material is  found in Clusters 3, 6, 8, and 9 and Chapter III, Procedural measures and law enforcement, Article 47, 48 and 49 in Cluster 2.  Proposed offenses in these clusters cover a wide array of conduct   for which there is no unified consensus on how it should be defined,  from “copyright infringement,”  “encouragement or coercion to suicide,” and “incitement to subversion,” to “terrorism,” “extremism,” and “drug trafficking.” For the procedural measures and law enforcementas, the most contentious topics are the Articles on interception of content, real-time interception, collection of Stored content and traffic data, and administration of electronic evidence, among others. The language of the proposals is vague, which could lead to overboard interpretation and enforcement. During negotiations, several countries, including Singapore, Malaysia, and Russia, seek to delete Article 42, which provides essential human rights safeguards against surveillance powers. 

March 2023
Fourth intersessional consultation held with multi-stakeholders in Vienna and online, with 61 Member States and non-member observer States in attendance. During a panel discussion titled “Effective and responsive cooperation and other aspects of the chapter on international cooperation,” a panelist from INTERPOL questioned the effectiveness of mutual legal assistance treaties (MLATs), citing bureaucratic processes across multiple jurisdictions and resource constraints. In response to INTERPOL’s concerns, civil society has expressed reservations about its approach. As stated in Principle 12 of the Necessary and Proportionate Principles, endorsed by over 400 NGOs:

“Where States seek assistance for law enforcement purposes, the principle of dual criminality should be applied. … States may not use mutual legal assistance processes and foreign requests for Protected Information to circumvent domestic legal restrictions on Communications Surveillance.”

INTERPOL maintains that the complexity of preserving communication records held by private companies or requesting basic subscriber information, traffic, or content data is further complicated because countries holding data have different evidentiary standards. These concerns have been met with skepticism. In prior sessions, EFF warned that making such argument could pose a “real risk that, in an attempt to entice all States to sign a proposed UN cybercrime convention, bad human rights practices will be accommodated, resulting in a race to the bottom.” 

April 2023 (scheduled)
Fifth negotiating session of the AHC will be held in Vienna and online. Participants will discuss  chapters in the CND not addressed in previous sessions. These new chapters cover the preamble, provisions on international cooperation, preventive measures, technical assistance among Member States, the mechanism of implementation, and the final provisions of the proposed comprehensive international convention.

June 2023 (scheduled)
Fifth intersessional consultation with multi-stakeholders to be held in Vienna.

August 2023 (scheduled)
Sixth session of AHC to be held in New York. A zero draft text of the convention is planned.

January – February 2024 (precise dates to be determined)
Potential concluding session of AHC to be held in New York, which will include discussion, finalization, and approval of the draft text of the convention. The draft will be annexed for consideration and adoption by the UN General Assembly in 2024.