UN Cybercrime Convention Negotiations Enter Final Phase With Troubling Surveillance Powers Still on the Table

This is Part II  in EFF’s ongoing series about the proposed UN Cybercrime Convention. Read Part I for a quick snapshot of the ins and outs of the zero draft;  Part III for a deep dive on Chapter V regarding international cooperation: the historical context, the zero draft's approach, scope of cooperation, and protection of personal data., and Part IV, which deals with the criminalization of security research.

As one of the last negotiating sessions to finalize the UN Cybercrime Convention approaches, it’s important to remember that the outcome and implications of the international talks go well beyond the UN meeting rooms in Vienna and New York. Representatives from over 140 countries around the globe with widely divergent law enforcement practices, including Iran, Russia,  Saudi Arabia, China, Brazil, Chile, Switzerland, New Zealand, Kenya, Germany, Canada, the U.S., Peru, and Uruguay, have met over the last year to push their positions on what the draft convention should say about across border police powers, access to private data, judicial oversight of prosecutorial practices, and other thorny issues.

As we noted in Part I of this post about the zero draft of the draft convention now on the table, the final text will result in the rewriting of criminal and surveillance laws around the world, as Member States work into their legal frameworks the agreed upon requirements, authorizations, and protections. Millions of people, including those often in the crosshairs of governments for defending human rights and advocating for free expression, will be affected. That’s why we and our international allies have been fighting for users to ensure the draft convention includes robust human rights protections.

Going into the sixth negotiating session, which begins August 21 in New York, the outcome of the talks remains uncertain. A variety of issues are still unresolved, and the finalization of the intricate text faces approaching deadlines. The foundational principle of the negotiations—“nothing is agreed until everything is agreed upon”—underscores the complexity and delicate nature of these discussions. Every element of the draft convention is interrelated, and the resolution of one aspect hinges on the consonance of all other areas of the text.

In Part I, we shared our initial takeaways about the zero draft—some bad provisions were dropped, but ambiguous and overly broad spying powers to investigate any crime, potentially including speech-related crimes, remain. In Part II we’ll delve deeper into one of the convention’s most concerning provisions: domestic surveillance powers.

These provisions endow governments with extensive surveillance powers but only offer weak checks and balances to prevent potential law enforcement overreach. States could misuse such powers by misrepresenting protected speech as cybercrime and exploiting the broad scope of these spying powers beyond their initial purpose. While we successfully advocated for the exclusion of many of the most problematic non-cybercrimes from the draft convention's criminalization section, the draft still permits law enforcement to collect and share data for the investigation of any crime, including content-related crimes, rather than limiting these powers to core cybercrimes. The existing human rights obligations under Article 5, although a positive inclusion, are not sufficiently robust. Combined with the draft’s inherent ambiguity, this could lead to the abusive or disproportionate misapplication of these domestic surveillance powers.

Below, we’ll talk about the domestic spying chapter of the draft convention:

Criminal Procedural