Global Cybercrime and Government Access to User Data Across Borders: 2022 in Review

Since the new UN cybercrime treaty began to take shape in 2022, EFF has been fighting on behalf of users to make sure robust human rights safeguards and rule of law standards are the basis of any final product.

There’s a lot at stake—the proposed UN cybercrime treaty has the potential to rewrite criminal laws around the world, adding new offenses and creating new police powers for both domestic and international investigations, and implicating the rights of billions of people worldwide.

Our push for human rights safeguards in the UN treaty follows a campaign since 2013 to strengthen human rights protections in government investigative powers. In 2017 that effort led us to advocate for changes (through submissions and testimony) in the now-approved Council of Europe’s Second Additional Protocol to the Budapest Cybercrime Convention. The Protocol is another instrument, approved on May 2022, expanding cross-border access to potential evidence in criminal investigations.

We raised concerns that the Protocol not only fails to require adequate oversight, but even creates government powers that bypass existing accountability mechanisms. Unfortunately, our core concerns about weak privacy standards in the Protocol were not addressed, and it was approved by Member States at the Council of Europe without robust safeguards. Existing signatories of the Budapest Convention have been invited since May 2022 to sign the new Protocol; the United States and 29 other countries have already done so. Next, countries will have to implement its provisions, and many of those countries may require reforms in their domestic criminal law. The treaty will finally enter into force once five countries have ratified it.

But we haven’t retreated. As the battle moves to the implementation phase, we released a comprehensive overview and guide about the new Protocol for countries in Latin America, as well as a handy outline of key issues Latin American civil society organizations can raise in urging the government to carefully consider the implications of acceding to the treaty.

2022-2023: The UN Cybercrime Battle Continues

And now a new debate has begun at the United Nations. While the Council of Europe mostly excluded civil society and even privacy regulators from timely participation in negotiations and drafting of the Protocol, EFF, and other human and digital rights organizations have had a seat at the table as meetings convened by the UN to begin work on its cybercrime treaty. Civil society successfully persuaded the UN Ad-Hoc Committee overseeing the process to approve the participation of EFF and other nongovernmental organizations an