We, the undersigned organizations, remain deeply concerned that the UN Convention Against Cybercrime (UNCC) will facilitate human rights abuses across borders. As some states head to Hanoi for the UNCC signing ceremony from October 25-26, we urge them to refrain from signing and ratifying the treaty and to use the occasion to highlight the importance of safeguarding human rights when implementing this Convention.
The Convention, the first global treaty of its kind, extends far beyond addressing cybercrime - malicious attacks on computer networks, systems, and data. It obligates states to establish broad electronic surveillance powers to investigate and cooperate on a wide range of crimes, including those that don't involve information and communication systems. It does so without adequate human rights safeguards.
The Convention will obligate governments to collect electronic evidence and share it with foreign authorities for any "serious crime," defined as an offense punishable by at least four years of imprisonment under domestic law. Many governments criminalize activities protected by international human rights law and impose sentences that would make them "serious offenses" under this framework, such as criticism of the government, peaceful protest, same-sex relationships, investigative journalism, and whistleblowing.
Additionally, because the Convention fails to incorporate language sufficient to protect security researchers, whistleblowers, activists, and journalists from excessive criminalization, it could be used to crack down on protected activities that advance rights and keep everyone secure online.
The Convention includes weak domestic human rights safeguards in its criminal procedural chapter, and fails to explicitly incorporate robust safeguards applicable to the whole treaty to ensure that cybercrime efforts provide adequate protection for human rights and are in accordance with the principles of legality, non-discrimination, legitimate purpose, necessity, and proportionality.
It creates legal regimes to monitor, store, and allow cross-border sharing of information in a manner that would undermine trust in secure communications and infringe on human rights. The Convention also permits the excessive sharing of sensitive personal information for law enforcement cooperation, beyond the scope of specific criminal investigations and without specific data protection and adequate human rights safeguards.
The Convention's flaws cannot easily be mitigated because it lacks a mechanism for suspending states that systematically fail to respect human rights or rule of law. It could also provide a vehicle for such states to assert jurisdiction over multi-national companies with users in their territory.
Finally, the Convention also poses risks to some of the people it aims to protect. For example, the Convention could be misused to criminalize the consensual conduct of children of similar ages in consensual relationships. Because it fails to effectively mainstream gender throughout the text, it also risks contributing to violations of the rights of women and LGBT people.
The signing ceremony in Hanoi is taking place against the backdrop of an intensified crackdown by the Vietnamese government on dissent to punish people simply for raising concerns or complaints about government policies or local officials, including online.
States should refuse to sign or ratify the Convention. States that have already committed to signing should adopt concrete human rights safeguards and demonstrate how these enable them to implement the Convention's terms in a manner that fully respects human rights.
Rights-respecting states that are considering signing the UNCC despite the significant threat it poses to human rights should withhold their support unless and until they can guarantee that certain conditions are in place, namely that they and other signatories will implement the treaty with meaningful safeguards and other legal protections that will prevent human rights abuses in practice.
Prior to signing the treaty, states should commit to:
- Consulting extensively with relevant stakeholders to inform their decision. Civil society engagement throughout the UNCC negotiations were critical to ensuring that the rights implications of the treaty were made visible to negotiating parties. If the treaty is to enter into force and be implemented in a manner that minimizes its threat to human rights, deepened engagement with civil society, national human rights institutions, data protection authorities, private companies, and others will be required. We note that hosting the signing ceremony for this Convention in Hanoi has already undermined stakeholder engagement in light of the hosting government's record for repression of critical voices.
- Ensuring their national frameworks meet the baseline requirements set out in international human rights standards, as outlined in the Necessary & Proportionate Principles and Convention 108+. With this treaty in place, it will be more important than ever to ensure national privacy frameworks meet international human rights standards. In many jurisdictions, the treaty could upend the operation of safeguards in national frameworks for cooperation requests from foreign jurisdictions. Many of these frameworks rely on bilateral arrangements for imposing safeguards, while the UNCC will create an independent vehicle for cooperation between all states. Abuse of international cooperation mechanisms is already a problem, and states will need to update and expand safeguards against transnational repression before the UNCC expands the potential for these activities. Many states will therefore need to amend their national frameworks for cooperation to mitigate the human rights harms that would otherwise result from adoption of this Convention.
States participating in the signing ceremony should clarify how they intend to work towards rights-respecting implementation, including how they intend to:
- Adjust or clarify domestic frameworks, as necessary, and take formal reservations to the treaty so that they comply with international human rights law, in particular as it relates to the principles of legality, necessity and proportionality, independent judicial authorization, and independent oversight.
- Condition any international cooperation on the existence of dual criminality by adopting measures in national law and/or the use of reservations or declarations under the Convention, as necessary.
- Leverage what human rights safeguards exist in the treaty, i.e. exercise right of refusal to comply with mutual legal assistance requests that are likely to result in human rights violations.
- Exercise transparency into implementation of the treaty, including, at minimum, statistical reporting of requests received, and whether these were approved, approved in part or refused.
- Ensure that rules of procedure surrounding the treaty's implementation provide a robust role for relevant stakeholders.
- Include compliance with international human rights standards as a prerequisite for funding or supporting other capacity building under the treaty, whether in the UN system or in bilateral or plurilateral settings.
Finally, all delegations should use their voices in Hanoi to speak out about digital repression by the Vietnamese government. They should also name other governments that routinely engage in digital repression, including those that have been driving forces behind the convention. Delegations should publicly call for civil society participants to have space to safely participate.
Signatories:
Access Now
Association for Progressive Communications (APC)
Derechos Digitales
Access Now
ARTICLE 19
Derechos Digitales
Electronic Frontier Foundation
epicenter.works - for digital rights
Fundación Karisma
Global Partners Digital
Human Rights Watch
IFEX
International Press Institute
KICKTANet
OpenMedia
Privacy International
Red en Defensa de los Derechos Digitales (R3D)
Tecnología, Investigación y Comunidad (TEDIC)
