US Withholds Support for UN Global Cybercrime Treaty

The United States held back from signing what’s being described as the world’s first global cybercrime treaty, citing concerns echoed by human rights groups that authoritarian powers could exploit the agreement.

See Also: Why Cyberattackers Love ‘Living Off the Land’

A total of 72 countries formally signed the United Nations Convention against Cybercrime following a Saturday signing ceremony in Hanoi, Vietnam, bringing the treaty one step closer to taking effect. At least 40 member states must ratify it before it does. The convention includes provisions to criminalize the non-consensual sharing of intimate images and aims to improve cross‑border exchanges of electronic evidence and law‑enforcement cooperation.

The United Nations has declined to release an official list of signatories, though statements of support were released Sunday by China, Russia and Brazil, among others. The U.S. said late Tuesday night that it “continues to review” the convention. The decision follows months of warnings from technology groups and civil society organizations that signing onto the treaty could effectively hand authoritarian regimes a new tool to justify surveillance or repression (see: Russia, China Will Weaponize UN Cyber Treaty, FDD Warns).

“As we engage in treaty-related discussions, we will not sit back and watch China, Russia and others try to suppress freedom of expression or obtain data in a manner inconsistent with the obligations in the treaty,” the U.S. statement reads. “We will strongly condemn any efforts to misinterpret or seek to misuse the treaty as cover to unlawfully target U.S. citizens and businesses.”

Even without U.S. ratification, the treaty could carry implications for Washington. Signatory nations could cite it as a global standard to demand cooperation in prosecutions that undermine free expression and privacy. The agreement also marked a culmination of nearly a decade of Russian and Chinese efforts to replace an existing cybercrime treaty, the Budapest Convention, with a “digital sovereignty” model that legitimizes domestic surveillance under the banner of national security.

U.N. Secretary-General António Guterres described the convention as a “powerful, legally-binding instrument to strengthen our collective defenses against cybercrime” during a speech at the signing ceremony.

The Biden administration participated in cybercrime convention talks despite criticism from technology groups and cybersecurity firms at the time that it could be used to criminalize security research. The Cybersecurity Tech Accord, representing more than 150 global cybersecurity and technology firms, argued during the drafting process that the proposed treaty would enable cross‑border cyber repression and urged member states to reject it (see: Tech Orgs: UN Cybercrime Treaty Will Worsen Global Security).

Russia’s efforts to spearhead and create a new cybercrime treaty began after a surprise 2019 U.N. General Assembly vote which narrowly passed and laid the groundwork for the ad hoc committee tasked with drafting the convention.

The Budapest Convention remains in force but the new U.N. treaty may shift how cybercrime enforcement operates on the international stage. Some clauses in the new treaty include language that could allow countries to cooperate on cross-border investigations involving offenses that may not be crimes in the receiving state, raising red flags about reciprocity and legal overreach.