BY KAREN GULLO AND KATITZA RODRIGUEZ

October 2017
The Russian Federation presents a letter to the UN General Assembly containing a draft of the United Nations Convention on Cooperation in Combating Cybercrime, intended for circulation to Member States. 

November 2019
A resolution, sponsored by Russia—along with Belarus, Cambodia, China, Iran, Myanmar, Nicaragua, Syria, and Venezuela—to set up an international convention to combat cybercrime passes in the UN General Assembly. The resolution was opposed by the US, the EU, and other nations. Human rights organizations, including the Association for Progressive Communications and EFF, urged the General Assembly to vote against the resolution, citing concerns that it “could undermine the use of the internet to exercise human rights and facilitate social and economic development.” 

December 2019
The UN General Assembly adopts a resolution to create an Ad Hoc Committee (AHC) to draft a UN Convention “on countering the use of information and communications technologies for criminal purposes.” Participation in the AHC is open to all Member States of the world, as well as non-member state observers (like the EU and the Council of Europe), civil society, and nongovernmental organizations (NGOs) to varying degrees. The United Nations Office on Drugs and Crime (UNODC), through the Organized Crime and Illicit Trafficking Branch, Division for Treaty Affairs, serves as Secretariat for the Ad Hoc Committee. However, the timing of this effort was controversial, as another UN General Assembly Resolution had raised concerns that cybercrime laws “are in some instances misused to target human rights defenders or have hindered their work and endangered their safety in a manner contrary to international law.”

August 2020
The AHC postpones its first organizational meeting in New York to 2021 because of COVID-19.

January 2021
Human Rights Watch raises alarms that UN member states are beginning the process for a cybercrime treaty whose “champions are some of the world’s most repressive governments…the initiative raises serious human rights concerns." 

May 2021
The AHC convenes the inaugural organizational session, with representatives from over 160 countries agreeing on an outline and modalities for negotiations. The AHC calls for at least six negotiating sessions lasting 10 days each starting in 2022, to be held in New York and Vienna. The General Assembly passes  the proposal amid complaints by the UK and other countries that Member States were not consulted about the final text and the drafting process lacked inclusivity. 

Many speakers had similar objections, with several diverging over the AHC’s decision-making structure. Setting the terms for negotiations, Brazil introduced an amendment requiring the committee to gain approval of a two-thirds majority of representatives, rather than a simple majority favored by Russia, “before which the Chair shall inform the Committee that every effort to reach agreement by consensus has been exhausted.” The amendment was approved 88 to 42, with 32 abstentions. In a separate iconic decision seeking greater transparency and inclusion, Member States approved a list of representatives to participate in the work of the AHC from relevant academic institutions, private sector, and NGOs including EFF, Eticas, Red en Defensa de los Derechos Digitales, Global Partners Digital, Hiperderecho, and Instituto Panameño de Derecho y Nuevas Tecnologías, among others. NGOs with ECOSOC consultative status can attend as well, such as Privacy International, Human Rights Watch, and Derechos Digitales.

December 2021
Ahead of the AHC’s first negotiating session, EFF, Human Rights Watch, and over 100 organizations and academics working in 56 countries, regions, or globally, urge members of the AHC in a letter to ensure human rights protections are embedded in the final product. The proposed UN CybercrimeTreaty is being put forward at the same time UN human rights mechanisms are raising alarms about the abuse of cybercrime laws around the world, the letter says. The groups emphasize, “It is essential to keep the scope of any convention on cybercrime narrow to protect human rights.”

January 2022
The Committee to Protect Journalists (CPJ) warns that the proposed UN Cybercrime Treaty could endanger journalists by handing new tools to authorities seeking to punish those who  report on the news. “Many authorities around the world already invoke cybercrime or cybersecurity laws to punish journalists – not for secretly hacking into networks or systems, but for openly using their own to publicize wrongdoing,” CPJ said in a statement.

February 2022
The first official 10-day session of the AHC meets in New York and negotiations begin. EFF and human rights NGOs participate remotely and in person, and emphasize the importance of protecting human rights in any proposed UN Cybercrime Treaty. The crisis in Ukraine looms large over the talks, which coincides with rare emergency UN General Assembly and Security Council sessions, where members condemned Russia’s invasion of Ukraine.

A road map and mode of work is adopted, addressing the objectives, scope, and structure of the convention. Importantly, approval was given for intersessional consultations to be held between AHC negotiating sessions to solicit the input of a diverse range of stakeholders, including human and digital rights organizations, on the formation of the draft treaty.

Member States submissions to the first session demonstrate a pronounced lack of consensus about what constitutes a "cybercrime" and how expansive the treaty will be. States including Brazil, Dominican Republic, the European Union (EU), Liechtenstein, Norway, Switzerland, the UK, and the US advocate for a narrower crime-related focus, warning against the use of this treaty to impose broader controls on the internet. Some states have also called for the inclusion of content-related crimes, such as incitement of terror (China, Russia), disinformation (China, Indonesia), and copyright infringement (Indonesia, Liechtenstein, Mexico, Norway, Russia, US).  

March 2022
The first Intersessional consultation with rights organizations and other multi-stakeholders held in Vienna. During a panel discussion before UN Member States, ARTICLE19 expresses concerns about the need for a cybercrime convention and risks that the convention would perpetuate existing abuses of cybercrime laws. AccessNow calls for avoiding over-expansive approaches to criminalization. From the floor, EFF emphasizes the importance of prioritizing the protection of human rights, as failing to do so can have dire consequences, and stresses that the scope of the convention should be restricted solely to criminal matters.

April 2022
Human Rights Watch, EFF, and Privacy International call attention to the shift in geopolitical dynamics that has led many states that were initially opposed to the treaty (nearly a third of UN members) to now actively participate and even take leadership roles in the negotiations.

May 2022
Second negotiating session held in Vienna. The AHC solicits input from a diverse range of stakeholders on proposed text for the criminalization, general provisions, and procedural measures and law enforcement chapters of the treaty. EFF, Privacy International, and Human Rights Watch submit a statement to the AHC emphasizing the importance of including only core cybercrimes in the treaty and avoiding overly broad provisions. During an oral statement in front of UN Member States, EFF, Privacy International, and Human Rights Watch reiterated the need to focus on crimes that specifically target information and communications technologies (ICTs). EFF defined core cybercrimes as offenses in which ICTs serve as both the direct objects and instruments of the crimes. The groups also call for any future treaty to ensure that provisions dealing with illegal, unlawful, or unauthorized access to ICTs do not criminalize security research, the work of whistleblowers, and other novel and interoperable uses of technology that ultimately benefit the public. The session is attended by representatives of 143 UN Members States. 

June 2022
Second intersessional consultation with multi-stakeholders takes place in Vienna. Prior to the meeting, EFF voices concern that some UN Member States are suggesting ambiguous provisions to combat hate speech, extremism, or terrorism, which could significantly jeopardize free expression. For example, Jordan proposes using the draft treaty to criminalize “hate speech or actions related to the insulting of religions or States using information networks or websites,” while Egypt calls for prohibiting the “spreading of strife, sedition, hatred or racism.” Russia, in collaboration with Belarus, Burundi, China, Nicaragua, and Tajikistan,  proposed to criminalize a range of content-related offenses, including vaguely-defined extremism-related acts. The ambiguous terminology used could potentially lead to overly broad interpretations, in many instances failing to meet freedom of expression human rights standards. 

The Office of the United Nations High Commissioner for Human Rights (OHCHR) highlighted that any future cybercrime treaty should not include offenses based on the content of online expression, stating, "Cybercrime laws have been used to impose overly broad restrictions on free expression by criminalizing various online content such as extremism or hate speech." The necessity of mandating universal adoption of such content-related offenses, which lack consensus among member states and have been used to prosecute activists, is called into question. Such offenses also include criminalizing the distribution of materials that “incite illegal acts motivated by political, ideological, social, racial, ethnic, or religious hatred.” Additionally, the same proposal mandates each State party to legislate against humiliating individuals or groups through ICT based on race, ethnicity, language, origin, or religious affiliation. Adopting these provisions would result in criminalizing protected speech.

India's proposals concerning terrorism support offenses are equally problematic, as they lack a globally agreed-upon definition. The term "terrorism" has often been misused to target activists critical of their governments, underscoring the absence of a global consensus on this term. Consequently, such ambiguous provisions pose a risk of stifling political dissent and threatening free speech. 

July 2022 
Civil society sends a letter to the Ad Hoc Committee, requesting the reopening of the accreditation process for stakeholders who missed the initial registration period, which was denied. 

August 2022
Third negotiating session held in New York, in which human rights organizations, including EFF, deliver oral statements regarding the chapters on international cooperation, technical assistance, and preventive measures. Ahead of the negotiations, EFF emphasized that the international cooperation chapter needs to include a dual criminality mechanism and should not have an open-ended scope that applies to every type of crime. EFF also urged governments to invest more resources and training to improve mutual legal assistance treaty (MLAT) systems operation. The session is attended by representatives of 149 UN Member States.

Despite the fact that the convention is about cybercrime, some states argue it should form the basis for international cooperation in evidence gathering for any crime under investigation. The EU, for example, put forward compromise language, saying it remains open to the concept of cooperation applying to the collection of evidence in not just serious crimes, but any crime—a provision in the Budapest Convention—as long as strong human rights safeguards are in place.

Submissions from Brazil and Russia suggest that cooperation could include mutual assistance for investigations and prosecutions in “civil and administrative” cases and other investigations of undefined “unlawful acts.”

November 2022
Third intersessional consultation with multi-stakeholders held in Vienna. EFF and the Office of the High Commissioner for Human Rights (OHCHR) are invited to present their views to Member States. EFF continues to advocate for a more narrowly-focused treaty that includes strong safeguards for human rights protections to prevent potential abuses in the future. OHCHR emphasized that any proposed UN Cybercrime Treaty should reference international human rights laws or regional human rights instruments and standards in the preamble. This would help guide the elements, interpretation, and application of the Treaty, ensuring that it aligns with universally recognized human rights principles. The session was attended by representatives of 149 Member States. 

After the intersessional, the AHC releases the Consolidated Negotiating Document (CND), a draft text of proposed convention provisions created from Member State proposals. The draft has three chapters, starting with a general provisions that include a statement of purpose, scope of application, and a general human rights provision. The second chapter deals with substantive criminal provisions to be adopted at the national level, and is divided into 11 “clusters.” Many of the clusters in the second chapter of the CND may also include content-related crimes that have the potential to interfere with protected speech and fail to comply with Article 19(3) of the International Covenant on Civil and Political Rights. The CND also includes a third chapter on criminal procedural measures and law enforcement, which covers topics such as jurisdiction, z the scope of procedural measures, conditions and safeguards, production orders, search and seizure, real-time collection of traffic data, real-time data collection, and interception of content data, and the establishment of criminal records among other surveillance powers.

December 2022
EFF and 10 other civil society organizations write to the AHC, in a letter supported by dozens of other groups and academics around the world, expressing grave concerns that the CDN “risks running afoul of international human rights law.” The letter recommends a series of revisions and modifications to the CDN to address troubling provisions that could lead Member States to treat various kinds of speech—much of which would be fully protected under international human rights law—as a criminal offense. Additionally, the letter says core cybercrime offenses in the text would impose some restrictions that might interfere with the essential working methods of journalists, whistleblowers, and security researchers and need to be revised. 

EFF and Privacy International submit comments requesting that Member States include robust checks and balances in the draft Treaty to align it with the existing jurisprudence of human rights courts and bodies. For example, the draft text should incorporate the principles of legality, necessity, and proportionality, and require prior independent (preferably judicial) authorization, post-ante independent monitoring, and the right to an effective remedy. EFF and Privacy International also ask for safeguards that ensure any investigative powers listed in the Convention be conducted in ways that do not compromise the security of digital communications and services.

January 2023
The Fourth negotiating session of the Ad Hoc Committee (AHC) held in Vienna, with representatives from 149 UN Member States in attendance. The committee discusses the CND. EFF, Derechos Digitales, R3D, Global Partners Digital, and Access Now deliver oral statements highlighting that among the most concerning features in the CND is the extensive and growing list of proposed criminal offenses intended for inclusion in the draft convention. China's proposal that the Treaty criminalize “dissemination of false information" in the latest version of the CND, published on January 21, further fuels concerns. 

During negotiations, much of the discussion about the criminalization chapter focused on content-related offenses under Clusters 5 and 7. The AHC Chair adopted a proactive approach to address the most contentious issues, taking discussions outside the formal plenary and into informal groups that were closed to NGO stakeholders. The most contentious material is  found in Clusters 3, 6, 8, and 9 and Chapter III, Procedural measures and law enforcement, Article 47, 48 and 49 in Cluster 2.  Proposed offenses in these clusters cover a wide array of conduct   for which there is no unified consensus on how it should be defined,  from “copyright infringement,”  “encouragement or coercion to suicide,” and “incitement to subversion,” to “terrorism,” “extremism,” and “drug trafficking.” For the procedural measures and law enforcementas, the most contentious topics are the Articles on interception of content, real-time interception, collection of Stored content and traffic data, and administration of electronic evidence, among others. The language of the proposals is vague, which could lead to overboard interpretation and enforcement. During negotiations, several countries, including Singapore, Malaysia, and Russia, seek to delete Article 42, which provides essential human rights safeguards against surveillance powers. 

March 2023
Fourth intersessional consultation held with multi-stakeholders in Vienna and online, with 61 Member States and non-member observer States in attendance. During a panel discussion titled "Effective and responsive cooperation and other aspects of the chapter on international cooperation," a panelist from INTERPOL questioned the effectiveness of mutual legal assistance treaties (MLATs), citing bureaucratic processes across multiple jurisdictions and resource constraints. In response to INTERPOL's concerns, civil society has expressed reservations about its approach. As stated in Principle 12 of the Necessary and Proportionate Principles, endorsed by over 400 NGOs:

“Where States seek assistance for law enforcement purposes, the principle of dual criminality should be applied. … States may not use mutual legal assistance processes and foreign requests for Protected Information to circumvent domestic legal restrictions on Communications Surveillance.”

INTERPOL maintains that the complexity of preserving communication records held by private companies or requesting basic subscriber information, traffic, or content data is further complicated because countries holding data have different evidentiary standards. These concerns have been met with skepticism. In prior sessions, EFF warned that making such argument could pose a “real risk that, in an attempt to entice all States to sign a proposed UN cybercrime convention, bad human rights practices will be accommodated, resulting in a race to the bottom.” 

April 2023
Fifth negotiating session of the AHC held in Vienna and online. EFF continues to raise concerns that the latest draft is too broad in scope, lacks strong commitments to human rights and called for detailed conditions and safeguards to be included. EFF, ARTICLE 19, Access Now, Epicenter.works, and Global Partners Digital briefed the media about the draft’s most alarming language and provided insight into the potential impact on users and tech companies. EFF and Latam allies Red en Defensa de los Derechos Digitales (R3D), Derechos Digitales, and Fundación Karisma, held a separate briefing in Vienna, warning that, without appropriate human rights safeguards, the proposed treaty is incompatible with Inter-American human rights standards reinforcing freedom of expression, privacy, and due process.

August 2023
With a “zero draft” on the table at the sixth negotiating session in New York (August 21 through September 1), delegates began article-by-article discussions in a bid to reach consensus. The new draft dropped some troubling provisions but retained open-ended cross-border surveillance powers. Specifically, most proposals to explicitly include crimes other than core cyber crimes were toned down. A list of 30 such offenses was whittled down to 11. But a new Article 17 compelled States to apply the convention to crimes “established in accordance with other international conventions and protocols,” which reintroduced some non-cyber crimes offenses back into the text and turned them into cybercrimes. A series of closed-door, informal discussions among delegates on key articles, including scope of application and human rights safeguards, are held throughout the session. EFF, Privacy International, Human Rights Watch, Article19, Access Now, Global Partners Digital, Derechos Digitales, among others submitted detailed comments and made several interventions during the meeting. On August 10 in Las Vegas, EFF tells a packed house at DEFCON that the draft treaty could shatter security and harm political activists, human rights defenders, journalists, security researchers, whistleblowers, and millions more around the world for decades to come. Meanwhile, we convened a second media briefing inside the UN premises to brief reporters about critical flaws in the zero draft.

September 2023
EFF warns the proposed UN Cybercrime Treaty expands cross-border surveillance powers, threatens LGBTQ+ individuals and gender rights

October - November 2023
Concerns keep mounting over the proposed treaty, which critics fear could fail to protect free speech and human rights while not effectively combating cybercrime. EFF and Human Rights Watch published an op-ed in EurActiv calling the treaty “A menace in the Making.”

December 2023
With final discussions approaching, a revised zero draft was released. Its contents only heightened concerns that the proposed treaty will criminalize expression and dissent, create extensive surveillance powers, and facilitate cross-border repression. Old problems re-emerged with a broadened scope encompassing a long list of non-cybercrimes. Delegates held closed-door talks in Vienna, attempting to reach consensus on what crimes to include in the treaty.

January 2024
EFF and 110 rights groups submit a statement to the ACH chair ahead of the concluding negotiating session in February clearly outlining civil society non-negotiable redlines for the proposed UN Cybercrime Treaty, and asserting that states must address critical gaps in the text or reject the proposed treaty if these essential changes are not implemented. The Cybersecurity Tech Accord, an industry group representing 177 tech and cybersecurity companies including Meta and Microsoft, submits a statement to the ACH that the zero draft is not fit for its intended purpose and proposes a set of minimum necessary changes to the draft, without which states should decline to ratify the convention. NGOs and tech companies urgently warn: The UN proposed UN Cybercrime Treaty draft will make cyberspace less secure and undermine human rights due to its critical flaws.

February 2024
Delegates convene in New York for what is supposed to be the final negotiating session to reach consensus and craft a final draft to be annexed for consideration and adoption by the UN General Assembly later this year. It was obvious from the first few days of floor talks that delegates were far apart on scope and human rights, among other issues. Meanwhile, 124 prominent security researchers and cybersecurity organizations from around the world issued a statement to the Ad-Hoc Committee chair calling on delegates to modify flawed language in the text that would hinder researchers’ efforts to enhance global security and prevent the actual criminal activity the treaty is meant to rein in.

After two weeks of talks, ongoing disagreements and conflicts among delegates over human rights, covered crimes, and other issues results in the session being unexpectedly suspended by the Ad-Hoc Committee chair after it was clear that consensus could not be reached. The chair calls for negotiations to be postponed to a later date.

March-May 2024
A new concluding negotiating session is scheduled for July 29 to August 9 at the UN in New York. Meanwhile, a series of delegate-only meetings about the treaty are held in Vienna.

June 2024
A new draft of the treaty, dated May 24 and released on June 14, incorporates a new title and language from delegates that attempt to cement the treaty’s worst flaws. The new title, “United Nations Convention against Cybercrime (Crimes Committed through the Use of an Information and Communications Technology System),” embraces the concept promulgated by Russian, Egypt, and other states with weak human rights protections that the treaty should authorize broad surveillance powers without robust safeguards and data protection principles for not just core cybercrimes but for any crime where a computer is used. EFF expresses serious concerns with the new draft, calling it a “blank check for surveillance abuses,” and again states that delegates should reject the proposed treaty unless it’s revised to fix serious problems.

July-August 2024
The final negotiating sessions is scheduled for July 31 to August 9 in New York. The new draft may be put to a vote in this session. If not approved by consensus, the treaty may be approved by a two-thirds majority vote. EFF keeps raising alarms that the UN Cybercrime Draft Convention dangerously expands state surveillance powers without robust privacy and data protection safeguards, posing significant risks to global human rights.

September 2024
The 79th session of the UN General Assembly (UNGA 79) will open on Tuesday, 10 September 2024. If approved, the UN Cybercrime Treaty final draft will be presented to the General Assembly for consideration during the session.