This is Part V in EFF’s ongoing series about the proposed UN Cybercrime Convention. Read Part I for a quick snapshot of the ins and outs of the zero draft; Part II for a deep dive on Chapter IV dealing with domestic surveillance powers; Part III for a deep dive on Chapter V regarding international cooperation: the historical context, the zero draft's approach, scope of cooperation, and protection of personal data, and Part IV, which deals with the criminalization of security research.
In the heart of New York City, a watershed moment for protecting users against unfettered government surveillance is unfolding at the sixth session of negotiations to formulate the UN Cybercrime Convention. Delegates from Member States have convened at UN Headquarters for talks this week and next that will shape the digital and fair trial rights of billions. EFF and our allies will be actively engaged throughout the talks, participating in lobbying efforts and delivering presentations. Despite repeated civil society objections, the zero draft of the Convention is looking less like a cybercrime treaty and more like an expansive global surveillance pact.
Over the next 10 days, more than 145 representatives of Member States of the United Nations will invest 60 hours in deliberations, aiming for consensus on most provisions. Focused parallel meetings, coined “informals,” will tackle the most contentious issues. These meetings are often closed to civil society and other multi-stakeholders, sidestepping important input from human and digital rights defenders about crucial interpretations of the draft treaty text. The outcome of these discussions could potentially shape the most controversial treaty powers and definitions, underscoring the urgency for multi-stakeholder observation. It is critical that states allow external observers to participate in these informals over the next two weeks.
The following articles in the zero draft, released in June, are the focus of our main concerns about Chapter V, which deals with cross border surveillance and the extent to which Member States must assist each other and collaborate in surveillance on each other's behalf. We will also deal with other articles (24 and 17) in the proposed treaty as they are relevant to the international cooperation on surveillance chapter.
Article 24: Conditions and safeguards should be consistently applied throughout the international cooperation chapter. An earlier draft recognized the importance of conditions and safeguards across both criminal procedural measures and international cooperation chapters. While Article 24, which requires human rights safeguards such as respect for the principle of proportionality and the need for judicial review, could be bolstered, it's an important provision. But the zero draft curiously restricts the scope of Article 24 to just criminal procedural measures, meaning that international cooperation is not subject to its important conditions and safeguards at all. Article 36, which deals with protection of personal data, imposes some additional restrictions on the processing of personal data, but does not include these central requirements.
This is particularly problematic when States’ existing domestic laws and practices are inconsistent with international human rights law, as is too often the case. Given the sensitivity of international cooperation for surveillance and the looming risks of human rights abuses, this lack of safeguards is perplexing. It's rather ironic: States are bound to uphold Article 24 at home, yet there's hesitancy to ensure the same minimum level of protections in international collaborations. Surely, for full cooperation among Member States, robust minimum safeguards in the cross border spying chapter should be non-negotiable.
Article 2: Definitions matter. States must prioritize clarity in their definitions. The zero draft of the convention uses broad terms for the kinds of information States can disclose or field requests for on each other's behalf. Though Article 2 “Definitions” elaborate on some categories like “traffic data,” “content,” “subscriber information,” and “personal data,” it is silent on key terms such as “data” and “information"—potentially paving the way for misuse of sensitive data or indiscriminate access to massive databases (see Article 19’s analysis).[1] Without explicit clarification, there's room for interpretation that these terms might include personal data, and lead to using sensitive personal data without safeguards.
For the sake of clarity and to preclude post-treaty disputes, it's imperative the draft convention stop using broad language when referring to “data” or “information” in its provisions. It needs unambiguous definitions for the key terms it uses, and should ensure that it does not authorize any processing of personal data masked as “information” or “data” without adequate safeguards.
Interestingly, while “personal data” has a clear definition in Article 2, the international policy arena still grapples with the categorization and protection levels for inferences drawn from personal data. The ambiguity looms: could "data'' or "information" potentially cover inferences arising from biometric sources, traffic data patterns, or even direct content from communications held in large databases? As such, what is the level of protection of such data?
These intricate nuances haven't made their way to the plenary discussions. And it’s not clear whether such pivotal dialogues will take place behind closed doors and sidestep public scrutiny or simply be pushed and understood by a few States, leaving others in the blind. The onus is on the drafters to inject clarity into these definitions. Whether by error or design, bringing these terms into the public discourse for a comprehensive definition is not only timely but also a matter of urgency.
Articles 35: Still no clear consensus over the scope of the international cooperation chapter. The zero draft appears primarily focused on cybercrimes outlined in Articles 6-16. Yet, Article 35 broadens the scope of international cooperation to encompass electronic evidence relating to any current or future serious crime. To ensure this Convention remains focused on investigations of cybercrimes and does not become a vehicle for investigating any and all offenses, Article 35 should be limited to global cooperation on offenses set out in Articles 6-16.
Article 35: Mandatory dual criminality must be the rule for cross-border cooperation. Article 35 treats the principle of dual criminality—where an offense must be a crime in both cooperating nations before investigative cooperation is required—as optional. This principle is vital to safeguard freedoms and ensure countries are not compelled to carry out intrusive investigations of activities that are not even crimes in their jurisdiction. The zero draft should make dual criminality mandatory to uphold international human rights standards.
Article 35: Authorizing bulk cross-border surveillance? Because Article 35 is not limited to “specific” investigations or proceedings, it also opens the door to indiscriminate or bulk information sharing for data-mining purposes. Limiting Article 35 to “specific” investigations[2] would ensure that police powers are used only in individual cases concerning particular suspects rather than authorizing generalized information sharing.
Article 36(1): Protection of personal data. Article 36(1) of the zero draft details conditions for international data transfers. Its current wording is ambiguous, suggesting compliance with "applicable international law." This should be explicitly refined to "international human rights law" to emphasize the importance of human rights-based data protection standards. Protection of personal data is a human right and it is sometimes wrongly addressed more permissively in trade law. In addition, together with Privacy International, we called for this article to be further amended to ensure that the principles of lawful and fair processing, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability be included. Such data protection principles should be aligned with existing international human rights standards.
Article 40(1): Narrow the scope of mutual legal assistance (MLA). Article 40(1) of the zero draft clearly encompasses core cyber crimes defined in Articles 6-16 of the treaty. However, it extends beyond that to all serious crimes—defined as one punishable by a maximum deprivation of liberty of at least four years.While Article 40(1) calls on State Parties to afford one another “the widest measure of assistance,” it's imperative that the extent of this cooperation not include mandated cooperation with investigations of draconian domestic provisions
Articles 40(3) and (4): Overarching power in MLA. Article 40(3) permits States to engage in a series of intrusive surveillance actions for one another, including real-time traffic data collection, content data interception, and actions related to “data” in a computer system, which includes searching, seizing, and disclosure. Even if information is defined to exclude, say, personal data, requests for mutual legal assistance under Article 40(3)(h) may encompass purposes such as providing information, "evidentiary items," (which is at least as intrusive as "information" no matter how you define the latter).
Moreover, Article 40(4) allows a State's competent authority to proactively share information linked to criminal matters without an initial request if it's perceived beneficial for another state's criminal processes. Such “information” (which is still undefined) likely includes personal data and could encompass outputs from wiretaps, device scans, or even indirect investigative leads. Nothing in the provision limits the scope or specifies targets for the information shared. The breadth of what can be shared, merely on the grounds of its potential utility to another country's law enforcement, demands stringent guidelines and checks to ensure the power isn't abused or misused.
Article 40(6) and (7): Why the MLA principles could be appealing for some States. While Article 40(6) respects existing MLAT treaty obligations, States can opt for this draft treaty over an existing one per Article 40(7). This is concerning, as the provisions of this Convention provide fewer safeguards than many MLAs. Where States have explicitly chosen not to enter into MLA treaties with each other, Article 40(7) imposes the mechanisms set out in this convention, effectively forcing these states to cooperate.
Article 40(8): Dual criminality in MLA should be mandatory. While Article 40(8) grants states the ability to decline assistance based on the absence of dual criminality, it simultaneously offers unchecked discretionary power for States to provide assistance, even if the activity in question isn't criminal within their own jurisdiction. This latitude not only undermines the dual criminality tenet but also risks States succumbing to external pressures, potentially assisting in investigations that conflict with their own legal and ethical standards. To ensure genuine international cooperation, the article should unequivocally mandate dual criminality and reduce subjective discretion in the provision of assistance.
Article 40(21): Grounds for refusal of MLAs should be strengthened. Article 40(21) of the treaty prudently allows states to decline MLA under specific circumstances: if the request does not conform to the article's guidelines, if there's a potential compromise to the requested state's sovereignty, security, public order, or other primary interests, if domestic prohibitions hinder the execution of the requested action for similar offenses, or if accepting the request goes against the state's MLA principles. While these provisions are a step in the right direction, we strongly advocate for Article 40 to further empower states with the discretion to refuse assistance in cases involving "a political offense or an offense connected with a political offense." Additionally, refusal should be mandatory where executing the request might adversely affect "the protection of human rights or fundamental freedoms.
Article 41: Overreach and ambiguity of the expanded scope of the 24*7 network. Article 41's 24/7 network, aimed at providing “immediate assistance” of core cybercrimes outlined in Articles 6 to 16, casts too wide a net by also allowing collection of evidence for any serious crime. This expansive scope raises concerns about States’ adherence to the dual criminality principle. Moreover, by broadly allowing for the collection and sharing of electronic evidence across a wide range of offenses, Article 41 bypasses the safeguards and procedures specified in Article 24 and the safeguards in Article 40, general MLA principles.
This could lead to situations where the central authority's designated oversight and control are compromised or completely bypassed. Where central authorities are relied upon to process expedited requests, this could overburden State Parties' resources, heightening the risk of misuse. Finally, for the treaty’s efficacy and the confidence of State Parties, it's essential to refine the article’s scope by delineating the duties of the designated contact more clearly to limit it to providing technical advice, assisting in identifying potential offenses, facilitating swift responses to ongoing crimes, and bolstering encryption and authentication measures to ward off potential threats. The 24/7 network should not deal with the collection, preservation, or sharing of evidence, or any personal data, since such exchange should be in accordance with Article 40 and be subject to the safeguards in Articles 24.
Articles 45-46: Remove collection of traffic data and interception of content in MLA. We called for the deletion of Articles 45 and 46, on real-time traffic data and interception of content. These are some of the most intrusive surveillance powers and it’s especially troubling to make them available to a foreign government on demand without mandating equally extensive robust safeguards. We’ve called for similar powers to be removed from the domestic spying chapter (Articles 29 and 30) unless significant safeguards are applied (including prior judicial authorization, specificity, time limits, and proportionality, including particularly, transparency, oversight and an effective redress). We similarly think these powers should not be made available in response to foreign government requests without comparably strong safeguards.
Article 47: Lawless law enforcement cooperation. Article 47(1) ostensibly emphasizes close cooperation among State Parties, with the intention of enhancing law enforcement actions against the offenses specified within the treaty. By casting too wide a net, it allows cooperation on “offenses covered by this Convention” (which includes the infamous Article 17), and bypasses the need to apply the conditions and safeguards under Article 23(1) and 24. Limiting Article 47(1) so that it applies only to cooperation on offenses set out in the Convention and ensuring critical safeguards and limitations apply is a crucial condition for any law enforcement cooperation.
Article 47(1)(b)(f): Delete articles that bypass safeguards embedded in the MLA. Together with Privacy International, we’ve called for the deletion of Articles 47(1)(b) and (f), aiming to prevent State Parties from sharing personal data in ways that bypass thHoe safeguards embedded in the MLA. States should not leverage the treaty to authorize or require personal information sharing outside the bounds of the existing MLA, the safeguards established MLA vetting mechanism: The central authority. Such safeguards should not be removed without providing comparable protections and limitations.
Safeguards removal invites misuse of the MLA framework for transnational repression. Moreover, Article 24 does not apply to the international cooperation chapter, and the current wording of Article 36 does not specify any minimum data protection principles, therefore the protection afforded to sharing of personal data under this article is insufficient. Moreover, the data in question has the potential to reveal the location of an asylum seeker or political dissidents, inviting misuse of the criminal MLA framework.
Article 47(1)(c): Delete artificial intelligence, inferences, databases—fuzzy terms have far-reaching implications. Article 47(1)(c) outlines the requirement for State Parties to engage in close cooperation, specifically focusing on the provision of "necessary items or data for analytical or investigative purposes'' when deemed suitable. Notably, as explained for Chapter 4, this provision lacks precision, as again, it isn't linked to specific investigations or law enforcement proceedings. Additionally, nothing in this provision excludes the sharing of "personal data," including biometric data, "traffic data," or other categories like location data, which could potentially lead to sharing intrusive data without a specific assistance request.
Moreover, the provision's complete lack of scope limitation or target specification can serve as an authorization for cross-border law enforcement sharing of massive biometric databases or artificial intelligence training datasets, as our ally Article 19 pointed out. The potential serious human rights implications of such unchecked data-sharing are enormous. Biometric data, facial recognition and voice recognition systems have been used in various countries to identify, surveil, and persecute protesters, minorities, migrants, human rights defenders, journalists, and opposition leaders. The convention should not be the opportunity to escalate these dangerous patterns beyond borders. 47(1)(c) therefore raises similar concerns to Article 40(4), granting a State the ability to share "information relating to criminal matters" without necessitating a formal request.
Conclusion: Broadly scoped, ambiguous, and nonspecific international cooperation measures with few conditions and safeguards are simply a recipe for disaster that can put basic privacy and free expression rights at risk. As it stands, the treaty’s international cooperation chapter, or as we called it, the “international spying or cross border spying Chapter,” sorely lacks the robust safeguards and personal data protections needed to fill bg holes in the text that can easily be exploited when governments want to go after journalists, human rights defenders, and dissidents.
[1] See Evidence, personal data, “data stored by means of a computer system” [40(3)(d)], “information” [40(3)(h), 47], “expert evaluations” [40(3)(h)], “information relating to criminal matters” [40(4)], “government records, documents, or information” [40(30)(b)].
[2] Budapest Convention, explanatory report, para 182: "As the powers and procedures in this Section are for the purpose of specific criminal investigations or proceedings (Article 14), production orders are to be used in individual cases concerning, usually, particular subscribers. For example, on the basis of the provision of a particular name mentioned in the production order, a particular associated telephone number or e-mail address may be requested. On the basis of a particular telephone number or e-mail address, the name and address of the subscriber concerned may be ordered. The provision does not authorize Parties to issue a legal order to disclose indiscriminate amounts of the service provider’s subscriber information about groups of subscribers e.g. for the purpose of data-mining."
