A United Nations committee has presented the final draft of a treaty to combat transnational cybercriminal organizations. Opponents of the treaty, however, warn that it contains few human rights protections and could be abused by repressive governments to prosecute journalists, cybersecurity researchers and protesters.

If the UN General Assembly adopts the convention against cybercrime, all signatory states would have to criminalize “unauthorized access to an information or communications technology system” or the interception of data or communications. In addition, the treaty would require signatories to have a mechanism to secure stored data and certain components of traffic data, the draft says.

The agreement, adopted on August 8, requires a wide range of companies – including those in the financial services, travel, technology and telecommunications sectors – not only to support national law enforcement agencies but also to assist with requests from the agreement’s signatories, says Nick Ashton-Hart, head of the Cybersecurity Tech Accord negotiating delegation.

“Unfortunately, the adopted draft does not solve any of the problems that we or other parts of the private sector or civil society have raised,” he says. “Security researchers and penetration testers – as well as investigative journalists, whistleblowers and others – are at risk of being prosecuted because the criminalisation chapter is so poorly and vaguely drafted.”

The UN Convention against Cybercrime is not the first treaty to take into account the needs of nations seeking to cooperate in combating cybercrime. The Council of Europe Convention on Cybercrime, often the Budapest Conventionhas provided a framework for cooperation since 2001. Most European countries as well as the United States, Japan and Brazil are among the more than 75 signatories.

The UN treaty on cybercrime is adopted

The UN treaty is not without supporters. Russia proposed the UN Cybercrime Convention in 2017And Vietnam is a vocal supporter – but both countries are not signatories to the Budapest Convention. There is no longer any possibility of changing the text of the treaty, which is due to be adopted by the General Assembly at its next session, which begins in September, says Ashton-Hart.

It is unlikely that the US or Europe would adopt the legal provisions of the agreement, he says.

“Because the convention allows any cooperation under constant secrecy and has no control mechanism, it invites abusive requests for cooperation that can be used to undermine secure systems that billions of people and millions of companies rely on every day,” he says. “Without (cooperation) from the US and the EU, there is little point in anyone else joining this convention. They can join the Budapest Convention, which works today, and get what they need instead.”

To underline this situation, the section entitled “Article 24: Conditions and Safeguards” was left blank in the latest version of the Treaty.

The US State Department stressed that while the fight against cybercrime is extremely important, without appropriate protection the UN treaty could be abused by governments to restrict freedom of expression and target journalists and protesters.

“The United States will continue to strongly condemn and combat the ongoing human rights abuses we observe around the world by governments that abuse and misuse cybercrime laws and other cyber-related laws and tools to target human rights defenders, journalists, dissidents, and others,” said State Department spokesman Matthew Miller. said in a statement.

Far-reaching powers for repressive governments

The US and technology companies are not the only opponents of the wording of the UN Convention on Cybercrime. The Freedom Online Coalition (FOC) – a group of 40 nations that advocate for human rights – has rejected the current draft of the UN Convention on Cybercrime, fearing it could be abused by repressive governments to undermine human rights. Founded in 2011, the FOC includes the United States, Australia, the United Kingdom, member states of the European Union and other countries such as Mexico, Tunisia and Japan.

The UN Convention against Cybercrime is crucial for improving cooperation between nations in combating and preventing cybercrime and collecting electronic evidence, but more safeguards need to be put in place, The FOC stated in a statement on 26 July.

“To ensure broad and effective cooperation under this treaty, concrete safeguards are needed and human rights protections must be integrated into the treaty framework,” the group said. “Among these provisions, we particularly emphasize ensuring that the treaty cannot be used, either domestically or internationally, to facilitate the repression of conduct protected by international human rights law.”

The UN Convention against Cybercrime will be submitted to the General Assembly, where it can be adopted with a yes vote from the 40 members.