Ad Hoc Committee on Cybercrime

One of the central disagreements concerned whether the Convention should be narrowly focused on cyber-dependent crimes or extended to a broader range of cyber-enabled conduct. The final text adopts an offence-specific approach, primarily criminalising core cyber-dependent crimes and a limited set of cyber-enabled crimes, while excluding areas such as cyberterrorism, cyberespionage, internet governance, and crimes against humanity. Although it relied heavily on the Budapest Convention, the UN Convention went further, addressing issues such as state sovereignty and introducing provisions for technical assistance and international cooperation.

Negotiations revealed sharp disagreements over the breadth and precision of offence definitions. Some states advocated broader formulations to capture evolving forms of cyber-enabled crime, while others stressed legal certainty and the risk of over-criminalisation or misuse. The final provisions reflect a compromise through an offence-specific approach: the Convention does not define “cybercrime” as a general category but requires criminalisation of clearly defined conduct. States retain discretion in domestic implementation, provided that the underlying conduct is criminalised, even where legal categories or terminology differ across jurisdictions.

The negotiation of procedural powers centred on access to electronic evidence and the scope of international cooperation. The Convention limits mandatory cooperation to “serious crimes,” defined as offences punishable by a maximum deprivation of liberty of at least four years or more, introducing a proportionality threshold intended to prevent the routine use of cross-border investigative tools for minor offences. It provides for mutual legal assistance, the preservation of electronic evidence, and time-sensitive cooperation mechanisms, while avoiding automatic or direct cross-border access to data. All procedural measures are to be carried out through domestic law, and states retain the ability to refuse, condition, or postpone cooperation in accordance with their national legal frameworks.

The Convention also incorporates explicit safeguards. These include requirements that procedural powers be exercised in accordance with domestic law and applicable international obligations, as well as provisions allowing states to deny assistance on grounds related to sovereignty, public order, or other fundamental legal principles. In addition, Article 6 affirms that “nothing in this Convention shall be interpreted as permitting the suppression of human rights or fundamental freedoms,” and negotiators emphasised that international human rights law and due process standards apply across all cooperation and investigative measures under the treaty.

At the same time, the sufficiency of these safeguards remains contested. While states point to the combination of proportionality thresholds, domestic-law controls, refusal grounds, and explicit human rights language as evidence that the Convention establishes a robust safeguard framework, a number of civil society and industry actors have argued that these protections lack operational specificity and independent oversight mechanisms. Critics contend that reliance on domestic implementation and broad state discretion may, in practice, allow intrusive investigative measures or cross-border cooperation in jurisdictions with weaker legal safeguards. These divergent assessments highlight a core compromise in the final text: strengthening cooperation while leaving the depth and enforcement of safeguards largely to national legal systems.

States debated the role of dual criminality, particularly in extradition and mutual legal assistance. The Convention largely adheres to a dual criminality standard, requiring that the underlying conduct be criminal in both the requesting and requested states. However, it clarifies that dual criminality is deemed fulfilled regardless of whether offences are categorised differently or described using different terminology, provided the conduct itself is criminalised in both jurisdictions. This formulation was intended to facilitate cooperation despite differences in legal systems, though some states expressed concern about legal certainty.

Another key issue concerned the coexistence of the Convention with existing frameworks, including the Convention on Cybercrime (Budapest Convention), UNTOC and its Protocols, UNCAC, and the African Union Malabo Convention. The UN Convention draws heavily on concepts from the Budapest Convention but does not exclude the application of other instruments nor take precedence over them. Instead, it is intended to operate alongside existing treaties, with states applying established principles of treaty interpretation to manage overlapping obligations. Supporters view this as preserving legal continuity, while critics warn of fragmentation and complexity.

Developing countries consistently emphasised that effective implementation would require technical and financial support. The Convention includes provisions encouraging developed states to provide training, technical resources, and capacity-building assistance, framing support as a collaborative effort to enable all parties to meet their obligations. However, these commitments remain flexible rather than binding, leaving discretion over the level and form of assistance. While this flexibility facilitated consensus, some observers argue it weakens accountability and predictability in support delivery.

Protection of sovereignty was a central concern throughout the negotiations. The final text enables cross-border cooperation in cybercrime investigations but preserves considerable discretion for states in deciding whether and how to share data or provide assistance. States may refuse, condition, or delay cooperation in accordance with domestic law, reflecting a negotiated effort to reconcile enhanced cooperation with respect for sovereignty and non-intervention.