UN Cybercrime Treaty Faces Long Odds to US Passage

The incoming Trump administration is unlikely to push the U.S. Senate to back a controversial United Nations cybercrime treaty criticized by tech firms and privacy advocates, holds an emerging domestic consensus.

See Also: Advancing Cyber Resiliency With Proactive Data Risk Reduction

The U.N. General Assembly adopted the cybercrime convention on Christmas Eve after five years of negotiations and criticism from human rights, cybersecurity and tech groups over scope and lack of protections for researchers, whistleblowers, activists and journalists. Security researchers have warned the treaty could criminalize children for sharing selfies, jeopardize journalists and their sources, and prosecute researchers, arguing instead for stronger enforcement of existing treaties such as the U.N. Convention Against Transnational Organized Crime and Budapest Convention on Cybercrime – which already has more than 70 parties (see: Tech Orgs: UN Cybercrime Treaty Will Worsen Global Security).

A supermajority of the U.S. Senate must ratify the treaty to make it U.S. law, a step experts say is unlikely, given opposition from lawmakers who criticize its language and warn of conflicts with existing cybercrime agreements. The private sector also remains alarmed after member nations effectively ignored calls from over 150 cybersecurity companies to strengthen protections for researchers and penetration testers, limit government access to personal data and to focus the treaty on actual instances of cybercrime.

“I don’t expect the incoming administration will try to influence the Senate to support this,” said Rex Booth, former chief of cyber threat analysis for CISA and CISO of security firm SailPoint. Following the final draft’s publication, Booth told Information Security Media Group that there are “lingering concerns regarding privacy and abuse of the treaty as a means of repression,” adding “I think this has little chance of passing the Senate.”

Russia first proposed negotiations for a U.N. cybercrime treaty in 2017, and the General Assembly approved talks in December 2019 despite U.S. opposition. Experts view Russia’s push as part of a strategy to dominate cyberspace and influence global cybersecurity and internet governance.

Human Rights Watch and over 100 international groups published a statement last year urging the treaty’s rejection. But the U.N. celebrated the passage of the convention in December, with UN General Assembly President Philémon Yang saying the treaty provides member states with “the tools and means to strengthen international cooperation in preventing and combating cybercrime and protecting people and their rights online.”

Ratifying the cybercrime treaty in the Senate “is a high bar,” said Rob Lee, chief of research at SANS Institute, adding that “the challenge will be balancing national security with concerns about sovereignty and civil liberties – key points that could make or break Senate support.”

“The U.N. treaty has to complement, not conflict with, the Budapest Convention,” said Lee. “If we end up with competing frameworks, it could weaken the global fight against cybercrime – a risk we can’t afford.”

Martin Jartelius, group CISO at Outpost24, warned that vague provisions in the treaty could create uncertainty until implemented in national legislation. The treaty sets “the foundation for wider cooperation with more countries, but the Budapest Convention is already in place and provides a platform for the involved countries,” Jartelius said. “They may not have to be mutually existing, but they are not directly contradictory.”

Several Democratic senators have spoken against the cybercrime convention in recent months, urging the Biden administration in a letter to prevent the treaty from being used to justify censorship, spying and human rights abuses by authoritarian regimes such as Russia and China.

“We fear the Convention will legitimize efforts by authoritarian countries like Russia and China to censor and surveil internet users, furthering repression and human rights abuses around the world,” the senators wrote in October 2024. “More must be done to keep the Convention from being used to justify such actions.”