Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes
This Convention shall enter into force on the ninetieth day after the date of deposit of the fortieth instrument of ratification, acceptance, approval or accession.
Signatories
74
The United Nations Convention against Cybercrime, also known as the Hanoi Convention, is a treaty to facilitate international cooperation in the enforcement of cybercrime laws. It was proposed by Russia in 2017 and adopted by the General Assembly in December 2024 amid resistance from human rights organizations. NGOs, academics, technology companies, and policy experts have criticized the convention for expanding the surveillance and data collection capacities of repressive governments without human rights safeguards.[1] Complaints focus on its vague definition of cybercrime, which can include any crime committed using technology, as well as the way it defers to individual countries, including those with a record of human rights abuses, to determine how to protect human rights.
The signing ceremony was held in Hanoi, Vietnam in October 2025.[2] As of January 2026 there are 74 signatories, and it has not yet been ratified by any member state.
As internet-enabled devices have proliferated, the transnational nature of cybercrime has posed challenges to national police and security agencies. Countries differ widely in how they investigate, enforce, and legislate against cybercrime.[3] In the early 2000s, the Council of Europe established the first international treaty to address internet and computer crime, the Budapest Convention, effectively harmonizing national laws, improving investigative techniques, and increasing cooperation among nations. It went into force in July 2004, and has been ratified by 81 states, including several from outside of Europe, as of 2025.[4]
The UN cybercrime convention was first proposed in 2017 by Russia, which had long objected to the Budapest Convention, viewing it as a threat to its internet sovereignty and control.[5][1][6] In 2019, Russia introduced it to the General Assembly, which passed it as Resolution 74/247, with 88 votes in favor, 58 against, and 34 abstaining.[7][8][9] The vote took place amid opposition by the European Union, United States, and allies who were satisfied with the Budapest Convention and viewed Russia's proposal as an effort to shore up its censorship and surveillance capacities with obligatory international cooperation.[10][6][7]
The resolution created what became the Ad Hoc Committee to Elaborate a Comprehensive International Convention on Countering the Use of Information and Communications Technologies for Criminal Purposes, starting the drafting and negotiation process.[11] The committee met several times between 2021 and 2024, with support from the United Nations Office on Drugs and Crime, producing and approving a draft General Assembly resolution in August 2024.[12] During the negotiation process, Iran repeatedly requested votes to remove the language "nothing in this Convention shall be interpreted as permitting suppression of human rights or fundamental freedoms", the removal of which was then supported by Russia, India, Sudan, Venezuela, Syria, North Korea, Libya, and 16 other states, but ultimately failed.[1] Class-based human rights protections were weakened during negotiations until a group of member states declared they would not support any additional changes.[13]
The resolution was adopted by the General Assembly in December 2024. The full title is United Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes.[14]
The signing ceremony and high-level conference was held in October 2025 in Hanoi, Vietnam. It is the first treaty to be signed in Vietnam and the first to be named after a Vietnamese location.[15] According to Reuters, the choice to host it in Vietnam was controversial given human rights concerns expressed over the convention and Vietnam's record on human rights issues.[16] The convention will be in force after 40 member states consent to be bound by it through ratification, accession, approval, or adoption.[17] As of January 2026, there are 74 signatories, which indicates an intent to ratify, but not yet any ratifications.[18]
Content
A conference during the signing ceremony in Hanoi.
The convention sets forth an international framework for cooperation in the prevention of cybercrime and enforcement of cybercrime laws. It aims to ensure that cybercrime can be prosecuted wherever it occurs, recognizing that it is frequently transnational. If ratified and implemented, it would require participating nations to criminalize certain forms of cybercrime, like illegal access to an information system, data interference, and the use of computer systems for fraud or child exploitation. The convention effectively establishes a broad set of investigative powers and cooperation procedures that cater to electronic evidence, like expedited preservation or disclosure of data, orders to produce data, search and seizure of data, real-time collection of internet traffic, and confiscation of ill-gotten proceeds. It would require around-the-clock points of contact for rapid cooperation. It creates frameworks for other forms of law enforcement associated with cybercrime, including extradition. The convention text addresses a range of details associated with such cooperation, like personal legal liability, statues of limitations, and jurisdictional rules. Alongside these provisions, the convention discusses the need to respect state sovereignty and international human rights law, but it relies on existing instruments rather than establish new or expanded standards specific to cybercrime. The implementation of human rights safeguards are left to individual countries to legislate.[14][19][20][21]
National positions
Russia introduced the resolution in 2017 and has been involved throughout the process. In an article for Just Security, Alexander Seger addresses the question of why "the single biggest source of cybercrime" would pursue a cybercrime treaty, concluding that it was due not to a desire to cooperate to stop cybercrime but to institute a system of "international information security" whereby governments can exert control of information without foreign interference.[9] Though Russia did sign the treaty, according to Seger it did not get the tool it wanted, which is more like the Budapest Convention and has more human rights safeguards than it sought.[9] Arun Sukumar and Arindrajit Basu likewise described the process as a way for China and Russia to replace the "liberal cyber order" with a model of "cyber sovereignty", solidifying state control over citizens, reorienting data access to be about crime and not human rights, and limiting the ability of companies or NGOs to set standards for access, encryption, and privacy.[22]
According to Joan Barata in Tech Policy Press, following its introduction it was "particularly promoted by countries willing to build a system alien to the protections granted by most relevant international human rights instruments, including Belarus, China, Iran, Sudan, Venezuela, Nicaragua, North Korea or Cuba".[5]
The Biden Administration in the United States ultimately voted in favor of the resolution, in some part to remain part of the conversation over its implementation,[23] amid objections to US-based human rights organizations and lawmakers who argued that it would make it easier for the US's foreign adversaries to surveil their citizens and access data generated inside US borders.[24][25] The US declined to sign, and it is unclear whether it will support ratification.[25][26]
As of January 2026, the following 74 participants have signed the treaty: Algeria, Angola, Australia, Austria, Azerbaijan, Belarus, Belgium, Brazil, Brunei Darussalam, Burkina Faso, Cambodia, Chile, China, Costa Rica, Côte d'Ivoire, Cuba, Czech Republic, Democratic People's Republic of Korea, Democratic Republic of the Congo, Djibouti, Dominican Republic, Ecuador, Egypt, European Union, Fiji, France, Ghana, Greece, Guinea-Bissau, Iran (Islamic Republic of), Ireland, Jamaica, Kazakhstan, Lao People's Democratic Republic, Libya, Luxembourg, Malaysia, Maldives, Mali, Mauritius, Morocco, Mozambique, Namibia, Nauru, Nicaragua, Nigeria, Palau, Papua New Guinea, Peru, Philippines, Poland, Portugal, Qatar, Russian Federation, Rwanda, Saudi Arabia, Slovakia, Slovenia, South Africa, Spain, Sri Lanka, State of Palestine, Sweden, Thailand, Togo, Türkiye, Uganda, United Kingdom of Great Britain and Northern Ireland, United Republic of Tanzania, Uruguay, Uzbekistan, Venezuela (Bolivarian Republic of), Vietnam, and Zimbabwe.[18]
Human rights objections
The potential for such a treaty to facilitate human rights abuses was recognized by the UN from the earliest discussions of the convention, when Russia proposed it in 2017.[10] Throughout the drafting process, several NGOs, cybersecurity companies, journalists, the International Chamber of Congress, academics, and the UN High Commissioner for Human Rights raised objections focusing on two central aspects of the convention: the vagueness and flexibility of the crimes it aimed to address, and the way it leaves human rights protections up to the individual member states.[19][1][27]
Other objections concern the obligations of member states. For example, the convention requires states to have laws that compel internet services to collect certain data, and does not require that requests for such data be transparent. There are limited cases when member states may deny a request for data, although there is a provision to do so if a state believes a request is due to "sex, race, language, religion, nationality, ethnic origin, or political opinions".[13] The latter statement was weakened during negotiations, and challenged by Iran and Russia until the end of negotiations.[13] The International Chamber of Commerce and Microsoft argued the convention was itself a threat to cybersecurity and national security, concerned that it provided grounds to force hackers and other skilled or knowledgeable parties to subvert security systems in ways that would expose infrastructure to attack and allow leaking of sensitive and classified data.[13]
Vaguely defined crimes
The convention names four types of crimes in particular, which human rights advocates argue are framed too broadly, applicable to any crime committed using an information or communications technology. Many of the crimes it would apply to have only a thin connection to the kind of serious cybercrime, like ransomware and child exploitation, that motivated the convention.[19][27][13] As a result, the convention expands the reach of existing surveillance regimes and the enforcement of controversial, ambiguous laws which countries use to criminalize a range of forms of speech, expression, and dissent, like Jordan's law against "character assassination via social media" or the United Arab Emirates' "condoning sins".[28] In a Lawfare article, Eli Scher-Zagier said the treaty "endorses a state criminalizing conduct by anyone, anywhere, so long as the conduct harms one of its nationals".[29] The Atlantic Council offered an example of someone displaying a rainbow flag online, which is illegal in Russia. Under the proposed convention, because the crime took place online, it falls within the definition of cybercrime and other countries may be expected to share data to assist in such investigations.[13] The Cybersecurity Tech Accord, which represents a large number of technology companies (Microsoft, Meta, Oracle, Cisco, Salesforce, et al.), calls the convention a "surveillance treaty" and argued, along with the Electronic Frontier Foundation (EFF), that it could jeopardize cybersecurity research by failing to distinguish ethical from malicious methods.[30][31]
Human rights protections are only suggestions
Several organizations highlight the way the convention's language about human rights protections are largely suggestions left to the discretion of member states, including those with a record of human rights abuses.[19][28] According to Freedom House, which maintains the Freedom in the World index, Russia and the treaty's cosponsors are all categorized as "Not Free".[32] Whereas the Budapest convention of the early 2000s included a wide range of concrete protections due to its context in the European human rights system, the UN convention is both broader in scope and lacking in safeguards.[5]
The digital rights organization Access Now issued a statement that the convention "pays lip service to human rights while lacking any actual safeguards", instead "embolden[ing] authoritarian regimes ... to justify digital repression, at home and abroad, with a veneer of legitimacy".[28] According to Nick Benequista of the National Endowment for Democracy, the consequences of ratifying the convention are harmful primarily for people who live in countries without robust protections for free expression, where independent journalists – even in exile, from other countries – could be more easily suppressed or jailed.[33] Similarly, the EFF argued that without protections built into the convention, it simply provides an expansive spying and surveillance system "to enable transnational repression".[19]
This page is based on this Wikipedia article Text is available under the CC BY-SA 4.0 license; additional terms may apply. Images, videos and audio are available under their respective licenses.
