UN: The Draft Cybercrime Convention remains deeply flawed after seven negotiating sessions
ARTICLE 19 remains deeply concerned about the latest draft of the UN Cybercrime Convention,
produced by the UN Ad Hoc Committee following the concluding session of the negotiations in New
York through February 2024. Even after seven sessions of negotiations, there is still no consensus on
the basic scope of the Convention or its safeguards against misuse. We believe that the key problemsof the draft text and Chair’s proposals are fundamental vagueness of the Convention’s scope, numerous
content-based offences, and underlying conflict of the Convention’s plain text with human rights
standards.
ARTICLE 19 believes the failure of the process to sufficiently provide for human rights safeguards—
which is still a point of deep contention—is fatal for the Convention’s future as an instrument that canbe trusted to ultimately comply with international freedom of expression standards. We urge the Statesnegotiating the Convention to reject the Draft and to oppose calls to extend the Committee’s mandate.
ARTICLE 19 continues to closely monitor the drafting process of the proposed Comprehensive
International Convention on Countering the Use of Information and Communications Technologies for
Criminal Purposes (the Convention). In January 2024, ARTICLE 19 joined a coalition of civil society
organisations and experts to call on state delegations to reject the Convention unless the instrument isnarrowed in its focus and provisions undermining human rights are eliminated. We provided legal analysis
on several drafts, including the Draft Text in the lead-up of the Committee’s final session, as well as a joint
analysis with Human Rights Watch on the Consolidated Draft used as the basis for previous negotiations.
The Convention is now in limbo as it faces broad opposition from both civil society and industry. The
Committee decided to suspend the session, dependent on a proposal to the UN General Assembly andavailable resources. The Committee might reconvene if its mandate is extended by the General Assembly
resolution and provision of funding to further negotiations. Also, at the end of the final session, the Chair
issued a proposal on the hotly debated provisions (Articles 3, 5, 17, 24, and 35). The continued proposals
on these provisions are striking, as they are foundational provisions on the scope of criminalization andinternational cooperation, as well as basic human rights safeguards. Without any meaningful consensus
on these provisions, it is still unclear what the Treaty seeks to achieve.
ARTICLE 19 briefly comments on the most recent Draft Text, issued in the final days of the Concluding
Session, coupled with the Chair’s proposals on key provisions. We also note that this comment does notseek to provide an in-depth legal analysis on every provision, many of which are simply repeated from theprior Consolidated Draft.

Failure to sufficiently incorporate broadly-supported human rights protections or due process
safeguards
Expressing concern over the vague scope of the Convention and seeking to interpret and apply the
instrument responsibly, Canada proposed a new Article 3.3 on behalf of a coalition of 66 States (including
Australia, the United Kingdom and United States) as well as the European Union, in order to codify andclarify human rights protections. That provision would have stated that:1Nothing in this Convention shall be interpreted as permitting or facilitating repression of
expression, conscience, opinion, belief, peaceful assembly or association; or permitting or
facilitating discrimination or persecution based on individual characteristics.

However, the proponents also made clear that it is “not a human rights provision” and that it does not
replace the need for strong safeguards elsewhere in the Convention.
ARTICLE 19 finds it disappointing that the current Draft Text and proposal by the Chair fails to meaningfully
include this widely supported proposal. Instead, the Chair’s proposal merely adds an Article 59(3) thatstates the following:
Nothing in this Convention shall be interpreted as permitting or facilitating unlawful restrictions
on human rights and fundamental freedoms, in accordance with applicable international humanrights conventions.

While ARTICLE 19 finds including this provision to be a positive step, we believe it comes too little too late.
The vagueness of “applicable” conventions and the failure to identify the fundamental freedoms most at
risk under the Convention make the addition of 59(3) insufficient to address the human rights concerns
raised by the 66-State coalition and the EU.
ARTICLE 19 has noted throughout the rounds of negotiations that the proposed Convention raises graverisks for freedom of expression and threatens to be abused by States with a history of using cybercrimelaws specifically to persecute or engage in discrimination against vulnerable groups on the basis of theirexpression, beliefs, religion, or identity. Canada’s proposal would specifically name expression,
conscience, opinion, belief, peaceful assembly or association, as well as discrimination and persecution,as particularly relevant issues under the Convention. This more closely tracks explicit existing obligationsof States under the International Covenant on Civil and Political Rights (ICCPR).
We also find the current state of human rights protections elsewhere in the Convention to be significantly
weaker. Article 5 of the Convention, which is still subject to dispute, is proposed by the Chair to only
require that implementation is “consistent with” rights obligations. This softened language does not
explicitly require compliance with human rights norms.
Due process safeguards such as judicial review, effective remedies, and international oversight are also
nowhere required no matter how far-reaching, perpetual, or severe the underlying law enforcement
powers or actions. The problematic safeguards provision is codified in Article 24, which governs Chapter
IV on procedural measures and law enforcement, and includes the following language:
1.

Each State Party shall ensure that the establishment, implementation and application of thepowers and procedures provided for in this Chapter are subject to conditions and safeguards
provided for under its domestic law, which shall provide for the protection of human rights, inaccordance with its obligations under international human rights law, and which shall incorporate
the principle of proportionality.

2.

In accordance with and pursuant to the domestic law of each State Party, such conditions andsafeguards shall, as appropriate in view of the nature of the procedure or powers concerned,
include, inter alia, judicial or other independent review, the right to an effective remedy, grounds
justifying application, and limitation of the scope and duration of such power or procedure.

2

Article 24(1), as proposed by the Chair, does mention international human rights law, but uses the pliablelanguage of “in accordance”. Domestic law “shall provide for the protection of human rights,” but there
is no further elaboration of what this means. The following provisions in Article 24(2) fail to identify
meaningful due process safeguards, instead providing a loophole to escape them. Judicial review andeffective remedy shall be included only as “appropriate in view of the nature of the procedure or powers
concerned.” In other words, judicial review is not generally required or set forth for any of the named
procedural powers in Chapter IV on procedural measures and law enforcement, no matter their intensity
or scope. This determination of what is “appropriate” is also not subject to any meaningful oversight. The
lack of oversight is explicitly contemplated and stated by the Chair in the proposal’s explanatory notes(“This paragraph does not imply any international supervision.”).
Finally, Article 21, which provides for parameters of prosecution, adjudication, and due process, only
applies to offences established “in accordance” with the Convention, meaning that its scope beyond theoffences explicitly named is unclear. It also only requires that due process protections are “consistent
with” international human rights obligations. This makes no mention of the presumption of innocence or
principles of legality and strict necessity and proportionality.

Lack of clarity over data sharing, surveillance powers, and due process and human rights safeguards
ARTICLE 19 is concerned that the Draft Convention, after seven sessions, still lacks a coherent articulationof what does or does not constitute a cybercrime. This is still subject to a pending proposal by the Chair;
the previously contentious Article 17 defining the scope of offences beyond those named in theConvention is now replaced by Article 60 bis, which provides the following:1.

In giving effect to other applicable United Nations conventions and protocols to which they are a
Party, States Parties shall ensure that criminal offences established in accordance with such
conventions and protocols are also considered criminal offences under domestic law whencommitted through the use of an information and communications technology system.

2.

Nothing in this article shall be interpreted as establishing offences under this Convention.

We note that this proposal remains problematic as it introduces a plethora of cyber-enabled, rather thancyber-dependent offences, and question why it is even necessary. If a State already criminalizes conduct
under its domestic law, then it is unclear why a State would be explicitly required to separately specify
that the conduct is also a crime if committed using an information and communications technology
system. Additionally, if offences established in such a manner do not fall “under” the Convention, then it
appears to follow that the due process and human rights safeguards would not apply to offences required
to be established pursuant to Article 60 bis.
It is also unclear whether a future offence required under Article 60bis(1) could be used as a basis for data
sharing and surveillance, notwithstanding the language in sub-article 2 that Article 60 bis does not‘establish’ offences under the Convention. The Draft Text constantly applies the phrase “offences
established in accordance with this Convention” to define the scope of its broad extraterritorial
procedural powers. The language of “accordance” also appears in Article 3(a) which defines the basic
scope of offences of the entire treaty. Despite the disclaimer in Article 60bis(2), the plain language of the
Article as a whole could still be read that its offences are created in “accordance” with the Convention
because they are required under the previous part, and thereby trigger all the data sharing andsurveillance provisions. The distinction between “in accordance with” and “under” is subtle, but is an3

important inconsistency of language that is deeply problematic in such a foundational article. It introduces
unnecessary ambiguity that further undermines the clarity of the Convention’s scope.
As before, ARTICLE 19 continues to observe that United Nations conventions include a number ofobligations and frameworks, such as that surrounding hate speech, which would be undermined or leadto conflicts if suddenly required to be bluntly criminalized. The full implications of Article 60 bis and these
proposals still cannot be understood because as currently drafted, it could also apply to future treaties
including where those future treaties deliberately avoid applying their provisions to online environments.

Threat to force international data preservation and sharing for a potentially limitless number ofoffenses without proportionality principles
The Chair’s proposal for Article 35, covering general principles of international cooperation, provides in
1(c) the following:
The collecting, obtaining, preserving and sharing of evidence in electronic form of any serious
crime, including serious crimes established in accordance with other applicable United Nations
conventions and protocols in force at the time of adoption of this Convention.

ARTICLE 19 notes that the language of “serious crime” has been subject to dispute throughout the drafting
process, and is currently defined in Article 2(1)(h) of the Draft Text to mean any offence punishable byfour or more years’ imprisonment. This blunt classification is a dangerous oversight, as it measures
seriousness not by any objective determination, but only by the severity of a State’s criminal penalties. Alla State has to do to trigger the serious crimes provision (and therefore any preservation, sharing, andsurveillance provisions), is simply create a domestic offence with a heightened penalty. This is particularly
concerning as a “serious crime” is featured throughout the Draft Text as a predicate for heightened
procedural powers. Accordingly, there is no accompanying right for targets of these powers to challenge
the proportionality of a provision classified as a “serious crime.”

Numerous contentious content-based offences
ARTICLE 19 notes that the Draft Text and the Chair’s proposal have done little to address criticism ofprevious draft texts for containing unnecessary content-related provisions that may infringe freedom of
expression online. Some of these offences are cyber-enabled rather than cyber-dependent, meaning they
do not even clearly fall under the scope of a cybercrime treaty.
We recall that criminal laws prohibiting dissemination of content are, by definition, restrictions on
freedom of expression, and therefore must be analyzed according to the tripartite test of restrictions
enumerated under Article 19(3) of the ICCPR. The provisions in question under the Draft Text include:

The Draft Convention infringes on the rights of survivors of online gender-based violence (Article
15): While the trend of non-consensual sharing of images is problematic, addressing it in aninternational criminal instrument raises serious and complex issues in balancing freedom of
expression and privacy rights, and is likely to backfire against the very vulnerable groups the provision
is purported to protect. Article 15 does not appropriately mitigate the risk of criminalizing survivors
particularly where the perpetrator is an authority figure, nor does it center the lack of freely given
consent, or exempt conduct that is a matter of public interest or for a legitimate purpose related tothe administration of justice.
4

The Draft Convention unduly restricts the rights of children and risks banning books (Articles 13
and 14). As drafted, Articles 13 and 14, which purport to curb the dissemination of child exploitationmaterials, go well beyond international standards on the matter and risk infringing on children’s
rights and criminalizing content that may have scientific, educational, artistic, or literary value.
Particularly in states where gender expression is repressed, these articles may also restrict thelegitimate experience and expression of gender and sexuality of children, including adolescents.
Finally, Article 13 is written so broadly that it would appear to ban books including classic works offiction taught in universities; indeed, Article 13(2)(b) defines “material” to include not only “images”
but also “written material.” ARTICLE 19 recalls that an informal report covering these articles,
following the Sixth Session of negotiations, revealed little consensus as to basic definitions and scope,
noting a number of key provisions where “attempts to reduce the gap [between States] did not yieldany fruit” and several where “delegations could not agree.”

Broad cross-border surveillance and police powers
ARTICLE 19 has repeatedly highlighted that the bulk of the Convention’s proposed provisions allow for
expansive and highly intrusive sharing of personal data, which among other fatal problems, threaten tochill the use of tools that promote freedom of expression online. For instance, the Draft Text in Article 40
still authorizes proactive information disclosures without any consideration for the safeguards of sendingor recipient states. Article 47 continues to contemplate generalized information sharing beyond the scopeof particularized investigations. These are not constrained by any explicit data protection safeguards.
Provisions such as these, and others which ARTICLE 19 has previously analyzed, are more problematicgiven the aforementioned lack of human rights or due process safeguards, including prior judicial
authorization requirements.

Conclusions
Since the beginning of the process of negotiating this new international treaty, ARTICLE 19 has argued
that it was questionable whether an international convention on cybercrime was needed. We repeatedly
pointed to the danger that such a convention would be subject to abuse, perpetuating many of therepeated and existing problems we have seen in many ‘cybercrime’ laws around the world.
Therefore, we are disappointed that after several years and the totality of the Committee’s drafting
sessions, such fundamental issues with the Convention remain and the Chair is still issuing proposals on
the most foundational articles. We believe that fundamental flaws in the text do not warrant General
Assembly approval for further time and resources spent on a deeply flawed process. We urge States toreconsider the value and necessity of continuing to invest in a process that has had more than enoughopportunities to achieve consensus and failed. There is yet no clarity as to what the Convention seeks toachieve.
ARTICLE 19 will continue to work closely with partners in civil society and relevant stakeholders as wefollow the outputs of the negotiations and drafting process should it continue.

5