A United Nations committee has approved the final draft of a treaty to combat transnational cybercriminal organizations. However, opponents warn that the treaty contains few human rights safeguards and could be used by repressive governments to persecute journalists, cybersecurity researchers and protesters.

If adopted by the UN General Assembly, the UN Convention against Cybercrime would require every country that has signed the treaty to criminalize “unlawfully accessing … an information or communications technology (ICT) system” or intercepting data or communications. In addition, the treaty would require signatories to have a mechanism to retain stored data and some components of traffic data, the draft said.

The treaty, which was adopted on Aug. 8, requires a wide range of companies — financial services, travel, technology and telecommunications — to not only support national law enforcement but also assist with requests from treaty signatories, said Nick Ashton-Hart, head of the Cybersecurity Tech Accord delegation to the negotiations.

“Unfortunately, the adopted draft does not address any of the issues that we have raised, or that other parts of the private sector or civil society have raised,” he said. “Security researchers and penetration testers — as well as investigative journalists, whistleblowers and others — are at risk of criminal prosecution because of the poor and vague wording in the chapter on criminalization.”

The UN Convention against Cybercrime is not the first treaty to address the needs of countries that want to work together to combat cybercrime. The Council of Europe Convention on Cybercrime, often the Budapest Treatyhas provided a framework for cooperation since 2001. Most European countries, as well as the United States, Japan and Brazil, are among the more than 75 signatories.

UN Convention on Cybercrime to be Adopted

The UN treaty also has supporters. Russia proposed the UN-based Cybercrime Convention in 2017And Vietnam is an outspoken supporter — but both countries are not part of the Budapest Treaty. There is no way to edit the text of the treaty, which will be adopted by the General Assembly in the next session, which begins in September, Ashton-Hart says.

He said it was unlikely that the US or Europe would adopt the treaty’s legal requirements.

“Because the convention allows all cooperation to be in perpetual secrecy and has no oversight mechanism, it invites abusive requests for cooperation that can be used to undermine secure systems that billions of people and millions of businesses rely on every day,” he said. “Without[cooperation]from the US and the EU, there is little point in anyone else joining. They can join the Budapest Convention, which works today, and get what they need instead.”

To emphasise the situation, the section “Article 24: Conditions and guarantees” has been left blank in the latest version of the Treaty.

The US State Department stressed that while the fight against cybercrime is extremely important, the UN treaty without protections could be used by governments to curtail freedom of expression and target journalists and protesters.

“The United States will continue to strongly condemn and combat the ongoing human rights violations we see around the world by governments that abuse cybercrime laws and other cyber-related statutes and tools to target human rights defenders, journalists, dissidents, and others,” said State Department spokesman Matthew Miller. said in a statement.

Broad powers for repressive governments

The US and tech companies aren’t the only opponents of the language in the UN Convention against Cybercrime. The Freedom Online Coalition (FOC) — a group of 40 countries that support human rights — opposed the current draft of the UN Convention against Cybercrime, arguing that it could be used by repressive governments to undermine human rights. The FOC, formed in 2011, includes the US, Australia, the UK, European Union member states and other countries such as Mexico, Tunisia and Japan.

The UN Convention against Cybercrime is crucial to improving cooperation between countries to combat and prevent cybercrime and to enable the collection of electronic evidence, but more safeguards must be included, The FOC said in a statement on July 26.

“To ensure broad and effective cooperation in this treaty, concrete safeguards are needed and human rights protections must be built into the treaty framework,” the group said. “Among these provisions, we specifically emphasize that the treaty cannot be used domestically or transnationally to facilitate the suppression of conduct protected by international human rights law.”

The UN Convention against Cybercrime goes to the General Assembly, where it can be adopted by a ‘yes’ vote of 40 members.