Will the new Cybercrime Treaty be used as a tool for government repression?

The treaty is expected to be ad­opted by a UN Ad Hoc Committee later this week and move to the 193-member General Assembly for final approval.

Deborah Brown, Deputy Di­rector for Technology, Rights, and Investigations at Human Rights Watch (HRW), said governments would then need to sign and ratify the treaty, which means going through national processes.

“We anticipate that as countries move to ratify the treaty it will face considerable scrutiny and pushback from legislators and the public because of the threat it poses to human rights.”

The treaty, she pointed out, would expand government surveil­lance and create an unprecedented tool for cross-border cooperation between governments on a wide range of crimes, without adequate safeguards to protect people from abuses of power.

“Negotiations are also expected to start on a protocol to accompa­ny the treaty to address additional crimes and further expand the trea­ty’s reach. We urge governments to reject a cybercrime treaty that undermines rights,” Brown said.

Recognising the growing dangers of cybercrime, the UN says mem­ber states have set about drafting a legally-binding international treaty to counter the threat.

Five years later, negotiations are still ongoing, with parties unable to reach an acceptable consensus, and the latest meeting of the Com­mittee members in February did not conclude with an agreed draft, with countries unable to agree on wording that would balance human rights safeguards with security concerns.

One of the nongovernmental organisations taking part in the negotiations is Access Now, which defends and extends the digital rights of people and communities at risk around the world.

Whilst the February session was still taking place at UN Head­quarters, Raman Jit Singh Chima, the Senior International Counsel and Asia Pacific Policy Director for Access Now, spoke to Conor Lennon from UN News, to explain his organisation’s concerns.

“This treaty needs to address “core cybercrime”, namely those crimes that are possible only through a computer, that are sometimes called “cyber depen­dent” crimes, such as hacking into computer systems, and undermin­ing the security of networks”, said Chima.

Clearly, these should be criminal­ised by states, with clear provisions put in place enabling governments across the world to cooperate with each other.

“If you make the scope of the treaty too broad, it could include political crimes. For example, if someone makes a comment about a head of government, or a head of state, that might end up being penalised under the cybercrime law,” he pointed out.

“When it comes to law enforce­ment agencies cooperating on this treaty, we need to put strong human rights standards in place, because that provides trust and confidence in the process”.

Also, if you have a broad treaty with no safeguards, every request for cooperation could end up being challenged, not only by human rights advocates and impacted communities, but by governments themselves, he warned.

Meanwhile, the joint statement by CSOs points to critical short­comings in the current draft of the treaty, which threatens freedom of expression, privacy, and other human rights.

The draft convention contains broad criminal provisions that are weak –- and in some places nonexistent -– human rights safe­guards, and provides for excessive cross-border information sharing and cooperation requirements, which could facilitate intrusive surveillance.

“Cybercrime regimes around the world have been misused to target and surveil human rights defend­ers, journalists, security researchers, and lesbian, gay, bisexual and trans­gender people, in blatant violation of human rights”.

The draft convention’s over­breadth also threatens to under­mine its own objectives by diluting efforts to address actual cybercrime while failing to safeguard legitimate security research, leaving people less secure online, the CSOs warn.

“National and regional cyber­crime laws are regrettably far too often misused to unjustly target journalists and security researchers, suppress dissent and whistleblowers, endanger human rights defenders, limit free expres­sion, and justify unnecessary and disproportionate state surveillance measures”.

Throughout the negotiations over the last two years, civil society groups and other stakeholders have consistently emphasized that the fight against cybercrime must not come at the expense of human rights, gender equality, and the dig­nity of the people whose lives will be affected by this Convention.

In an oped piece in Foreign Policy in Focus, Tirana Hassan, ex­ecutive director of Human Rights Watch, says the new treaty, backed by Russia, is aimed to stifle dissent.

She points out that Cyber­crime—the malicious hacking of computer networks, systems, and data—threatens people’s rights and livelihoods, and governments need to work together to do more to address it.

But the cybercrime treaty sitting before the United Nations for adoption, could instead facilitate government repression, she noted.

By expanding government surveillance to investigate crimes, the treaty could create an unprec­edented tool for cross-border cooperation in connection with a wide range of offenses, without adequate safeguards to protect people from abuses of power.

“It’s no secret that Russia is the driver of this treaty. In its moves to control dissent, the Russian government has in recent years significantly expanded laws and regulations that tighten control over Internet infrastructure, online content, and the privacy of com­munications,” said Hassan.

But Russia doesn’t have a mo­nopoly on the abuse of cybercrime laws. Human Rights Watch has documented that many govern­ments have introduced cybercrime laws that extend well beyond ad­dressing malicious attacks on com­puter systems to target people who disagree with them and undermine the rights to freedom of expres­sion and privacy, she pointed out.

For example, in June 2020, a Philippine court convicted Maria Ressa, the Nobel prize-winning journalist and founder and exec­utive editor of the news website Rappler, of “cyber libel” under its Cybercrime Prevention Act.

The government has used the law against journalists, columnists, critics of the government, and or­dinary social media users, including Walden Bello, a prominent pro­gressive social activist, academic, and former congressman.

In Tunisia, authorities have invoked a cybercrime law to detain, charge, or place under investigation journalists, lawyers, students, and other critics for their public state­ments online or in the media.

In Jordan, the authorities have arrested and harassed scores of people who participated in pro-Pal­estine protests or engaged in online advocacy since October 2023, bringing charges against some of them under a new, widely criticised cybercrimes law.

Countries in the Middle East- North Africa region have weap­onised laws criminalising same-sex conduct and used cybercrime laws to prosecute online speech.

The treaty has three main prob­lems: its broad scope, its lack of human-rights safeguards, and the risks it poses to children’s rights, said Hassan.

“Instead of limiting the treaty to address crimes committed against computer systems, networks, and data—think hacking or ransom­ware—the treaty’s title defines cybercrime to include any crime committed by using Information and Communications Technology systems.”

The negotiators are also poised to agree to the immediate drafting of a protocol to the treaty to ad­dress “additional criminal offenses as appropriate.”

As a result, when governments pass domestic laws that criminalise any activity that uses the Internet in any way to plan, commit, or carry out a crime, they can point to this treaty’s title and potentially its protocol to justify the enforcement of repressive laws.

In addition to the treaty’s broad definition of cybercrime, it essen­tially requires governments to sur­veil people and turn over their data to foreign law enforcement upon request if the requesting govern­ment claims they’ve committed any “serious crime” under national law, defined as a crime with a sentence of four years or more, Hassan said.

This would include behavior that is protected under international human rights law but that some countries abusively criminalise, like same-sex conduct, criticising one’s government, investigative report­ing, participating in a protest, or being a whistleblower.

In the last year, a Saudi court sentenced a man to death and a second man to 20 years in prison, both for their peaceful expression online, in an escalation of the country’s ever-worsening crack­down on freedom of expression and other basic rights.

This treaty would compel other governments to assist in and be­come complicit in the prosecution of such “crimes.”

Moreover, the lack of human rights safeguards, says Hassan, “is disturbing and should worry us all.”