Negotiations Over UN Cybercrime Treaty Under Way in New York, With EFF and Partners Urging Focus on Human Rights

While tensions run high across the globe over the invasion of Ukraine, the world’s governments are meeting at the UN this week and next to find common ground on a proposed treaty to facilitate international cooperation and coordination in computer crime investigations. The treaty, if approved, may reshape criminal laws and bolster cross-border police surveillance powers to access and share user data, implicating the privacy and human rights of billions of people worldwide. Earlier this week, EFF spoke to the treaty’s drafting committee, highlighting some of our privacy and human rights concerns. Two weeks of initial negotiations, hosted by the Ad-Hoc Committee Secretariat from the UN Office on Drugs and Crime, kicked off on Feb. 28 with statements from over 60 Member States about what the treaty should encompass. Common themes include questions over what constitutes cybercrime, new expedited international cooperation powers, the need to build upon existing treaties, developing mechanisms for technical assistance and capacity building at the national level, especially for developing countries, and the importance of adherence to the protection of human rights and fundamental freedoms at the heart of the initiative.

Crisis in Ukraine

The Ukraine crisis looms large over the talks, with many Member States voicing solidarity with Ukraine and questioning whether Russia (who was the initial driving force behind the adoption of this treaty) could debate in good faith and defend claims of sovereignty in formulating cybercrime provisions while invading Ukraine and unleashing cyberattacks. "These cyberattacks are not conducive to a constructive engagement with Russia on this treaty," the EU representative pointed out, capturing a sentiment shared by many negotiating states. Despite high levels of distrust, Member States are proceeding with the negotiations as planned. EFF addressed the Ad-Hoc Committee March 1, via videoconferencing, saying cybercrime poses a threat to human rights, and expressing concerns that investigative powers adopted in the treaty will seek to accommodate the worst police surveillance practices across participating states.  "Any proposed obligations to enable investigation and prosecution should adhere to human rights law…There is a real risk that, in an attempt to entice all States to sign a proposed UN cybercrime convention, bad human rights practices will be accommodated, resulting in a race to the bottom,” EFF Policy Director for Global Privacy, Katitza Rodriguez told the committee. EFF also reminded the committee that cybercrime provisions have been used against whistleblowers, security researchers, human rights defenders, political dissidents and members of LGBTQ+ communities in ways that are inconsistent with human rights. Great care must be taken when enshrining these provisions in an international instrument. The upcoming negotiations are sure to be contentious, with wide areas of disagreement about the very broad scope of the Treaty already apparent  (as we discussed earlier). There is some agreement that the treaty should criminalize certain acts defined as  “core cybercrime.” EFF understands this to include crimes that inherently target information and communications technologies (ICTs)—a list of potential crimes can be found in Articles 2-6 of the Budapest Convention and include: illegal access to computing systems, illegal interception of communications, data interference, system interference, and misuse of devices. While even this core group of offenses has led to human rights problems in the past, some states would go further. New Zealand, Australia, UK and the US want to recognize new crimes, those where ICTs increase the scope, speed, and scale of the offense, at least to the extent information technologies are a factor. The US and Australia also point out that an online crime committed anonymously may play a role in framing what derivative crimes legitimately fall within the scope of the treaty.

Fighting Cybercrime Shouldn't Come at the Expense of Human Rights Protections

EFF addressed the Ad-Hoc Committee again on March 2, recommending that the objectives of this treaty should be dual: addressing specific challenges posed by cybercrime, on the one hand, and ensuring robust protections for human rights in cybercrime inves