UN Cybercrime Convention calls EU values into question, civil society warns

With the last negotiating session approaching next month, the private sector and civil society are increasingly questioning the compatibility of the UN Cybercrime Convention draft text with EU values and human rights standards.

The Cybercrime Convention, initiated by Russia and initially rejected by Western liberal democracies, will enter the final negotiating round in its concluding session scheduled for January to February 2024 in New York.

So far, the UN member states have only reached consensus on a few points, meaning that a final decision is likely to be reached by vote.

Human rights organisations are concerned that the Ad hoc Committee responsible for the negotiations on the draft text has not addressed the concerns of civil society that were already publicly known in April.

“We don’t believe the EU negotiating position is compatible with either European values or its interests,” Nick Ashton-Hart, senior director at APCO Worldwide and representative of the Digital Trade Network (DTN) and UK Delegate to the ITU meetings, told Euractiv.

The European Commission did not comment by the time of publication.

“Its current position enables every government worldwide to demand access to the personal information of citizens globally, including real-time surveillance, on any crime of any kind online or offline, with few safeguards and in permanent total secrecy,” Ashton-Hart added.

Since the draft text remains vague in its scope and wording refers to numerous content-related criminal offences, it does not protect human rights and the expression of opinion, civil society warned.

“The current draft, which could be adopted through a vote, or a series of votes, reads more like an authoritarian’s dream than an instrument to tackle online crime and protect victims,” Ian Tennant, head of Vienna Multilateral Representation at the Global Initiative Against Transnational Organized Crime, told Euractiv.

According to Tennant, it could result in government critics or dissidents being suppressed and government agencies spying on people who carry out legitimate activities supposedly protected under international human rights law – such as research, journalism, and advocacy.

West clashes with China, Russia over UN Cybercrime Convention

The United Nations Cybercrime Convention is becoming a battleground between the EU and other Western countries on the one hand, China, Russia and other authoritarian regimes on the other.

Current state of negotiations

The current version of the draft text, seen by Euractiv, indicates which paragraphs member states found consensus on. For example, states agreed to strengthen “international cooperation in preventing and combating cybercrime”, to capacity building, and to abstain from interfering in the domestic affairs of other countries.

“It’s disappointing that after several years and many drafting sessions, the Convention’s draft is still mired with fundamental problems – no less because it still doesn’t include a coherent definition of what does or does not constitute a cybercrime,” Barbora Bukovská, ARTICLE 19’s senior director of law and policy, told Euractiv.

So far, states also reached a consensus on most parts of the jurisdiction, including the applicability of criminal jurisdiction under domestic law, and confiscation, freezing, or seizure of assets by order of a court of a requesting foreign state.

Likewise, countries adopted the requirements for a request from a foreign nation to retain computer data and to disclose traffic data that relates to a criminal investigation. They agreed that the user should not be notified of such a request.

“It also proposes provisions that would allow for expansive and intrusive sharing of personal data between states, effectively legitimising cross-border surveillance,” Bukovská added.

Review mechanisms and subsidiary bodies for implementation were also accepted by all states.

Euractiv understands, that the EU is currently trying to replicate the 2001 Budapest Convention, a regional convention on cybercrime signed by many liberal democracies and EU member states.

Compared to the two-decade-old Convention, the version at the UN level lacks explanatory notes detailing human rights and due process obligations.

While states found consensus on review mechanisms and subsidiary bodies for implementation, experts do not consider the system as effective as established under the Budapest Convention.

“The document must be comprehensively revised. Otherwise, rather than addressing the problem of cybercrime, it will only endanger human rights,” Bukovská concluded.

However, as there is still disagreement on many parts of the draft text, it is likely that if no consensus can be reached, a final decision will require voting by UN member states. If a simple majority is reached, the draft text gets adopted.

EU institutions agree new rules for media sector

The main EU institutions found a political agreement on Friday (15 December) on the European Media Freedom Act, a new law meant to promote freedom and diversity in the media sector, though the deal comes with some controversial caveats.

Implications

While the UN Cybercrime Convention intends to facilitate cross-border cooperation as a response to the growing number of cybercrime incidents, the Russian initiative seems simple and less sensitive compared to the UN Convention against Transnational Organised Crime, which took almost double the amount of sessions.

Considering that the treaty was launched by a source country of cybercrime activity worldwide, “facilitating access to personal data by Russia – and other non-democratic states – would be handing Russia a major diplomatic victory. That seems directly contrary to EU foreign policy and human rights objectives,” Ashton-Hard explained.

The negotiations on cybercrime are considered as an intent by Russia to re-frame the international forum.

“This final negotiating session could result in the United Nations being quietly reshaped to counter the universal values on which it was founded, It is time for those delegations, including the EU and its member states, who subscribe to those values to ensure we do not get to that point,” Tennant concluded.

[Edited by Zoran Radosavljevic]

Read more with Euractiv

Adobe cancels €18bn Figma acquisition over antitrust concerns

US companies Adobe and Figma decided on Monday (18 December) to call off a €18 billion merger they had been foreseeing for 15 months following concerns from regulators in the EU, UK and US.