The United Nations Convention against Cybercrime is the first global treaty addressing cyber-enabled and cyber-dependent crime under UN auspices. It was negotiated by an Ad Hoc Committee established by General Assembly resolution 74/247 (2019), an initiative championed by Russia and co-sponsored by a group including China, Belarus, Cuba, Nicaragua, and several other states. After multiple negotiating sessions in New York and Vienna between 2022 and 2024, the Committee finalized a draft text in August 2024, and the General Assembly adopted the Convention by consensus on 24 December 2024. It is scheduled to open for signature at a ceremony in Hanoi, Vietnam, giving rise to its informal name, the "Hanoi Convention."
The treaty obliges states parties to criminalize a set of offences, including illegal access to information systems, illegal interception, interference with data or systems, misuse of devices, computer-related forgery and fraud, and online child sexual abuse material. It also establishes frameworks for international cooperation, including expedited preservation of stored electronic data, mutual legal assistance, extradition, and a 24/7 contact network modeled on existing cybercrime cooperation regimes.
The Convention has been highly controversial. Industry groups (including Microsoft and the Cybersecurity Tech Accord), human rights organizations (Human Rights Watch, Electronic Frontier Foundation, Access Now), and the UN High Commissioner for Human Rights raised concerns that its broad scope, expansive cross-border data-access provisions, and vague references to "serious crimes" punishable by four years or more could enable transnational surveillance, target security researchers and journalists, and weaken encryption. Supporters, including the Russian Federation and many developing-country delegations, argued it fills gaps left by the Council of Europe's Budapest Convention (2001), which not all states have joined.
The Convention will enter into force 90 days after the 40th instrument of ratification is deposited.
Example
In December 2024, the UN General Assembly adopted the Convention against Cybercrime by consensus, despite objections from tech firms and human rights groups warning of surveillance risks.
Frequently asked questions
The Budapest Convention (2001), under the Council of Europe, has roughly 70 parties and is seen as Western-led. The UN treaty is global in scope, was driven by Russia, and contains broader cross-border data-access provisions that critics say have weaker human rights safeguards.
Keep learning