This week, the UN Ad Hoc Committee on Cybercrime began its work with its first session in New York. The Committee is mandated to develop a comprehensive international treaty on countering the use of information and communications technologies for criminal purposes. The treaty was first proposed by Russia, with considerable resistance at the time by the United States, members of the European Union, and other states, as well as objections from civil society.
Many activities that often fall under the banner of cybercrime pose significant threats to people's lives and livelihoods, and have significant implications for human rights. At the same time, efforts to counter cybercrime often undermine rights, both by criminalizing online expression and conduct that is protected under international human rights standards, and by authorizing the use of intrusive tools to investigate crimes without proper safeguards.
Since there is no common understanding of what constitutes cybercrime or how to address it, there is a significant risk that negotiating a global treaty will result in a race to bottom. The treaty could also end up reinforcing approaches that undermine or sacrifice rights.
Human Rights Watch has been working with a broad group of human rights and digital rights organizations and experts to raise human rights concerns in the treaty development process. Below is our oral statement of the first session of the Ad Hoc Committee.
Human Rights Watch welcomes the opportunity to participate in the first session of the Ad Hoc Committee.
To begin with, I would like to make Human Rights Watch’s position clear: countering cybercrime should not come at the expense of the fundamental rights and dignity of those whose lives this proposed treaty will touch. We are not convinced a global cybercrime treaty is necessary and urge States to oppose any proposed treaty that risks eroding human rights protections and their obligations under international rights law.
Cybercrime poses a real threat to people’s human rights and livelihoods and efforts to address it need to protect, not undermine, rights. Governments have obligations under international human rights law to protect people from harm resulting from criminal activity carried out through the internet. For example, part of governments’ obligation to protect women’s human rights includes combating gender-based violence online, such as the nonconsensual distribution of intimate images online.
But government responses to cybercrime can be ineffective or disproportionate, and can undermine rights. For over a decade, Human Rights Watch has reported on risks to freedom of expression and privacy posed by national legislation and international cooperation to address cybercrime.
In recent years, the UN General Assembly and human rights mechanisms have expressed concern that cybercrime legislation is being misused to target human rights defenders and facilitate human rights abuses. There is no consensus on how to tackle cybercrime at the global level or a common understanding or definition of what constitutes cybercrime. A global treaty to counter cybercrime risks creating a race to bottom, reinforcing approaches that undermine or sacrifice rights.
This is why 134 human rights organizations and experts from 56 countries sent a letter to this Committee in December 2021 calling for member states to ensure that any proposed convention on cybercrime incorporates clear and robust human rights safeguards and that the Committee’s work includes meaningful civil society participation.[1]
Human Rights Watch would like to highlight three key points from the joint letter.
First, member states should keep the scope of any proposed treaty narrow. Vaguely worded cybercrime laws purporting to combat “fake news” or glorification of terrorism and extremism online, can be misused to imprison bloggers or block entire platforms in a given country. Just because a crime might involve technology does not mean it needs to be included in the proposed convention. Member states should ensure that the provisions of any potential cybercrime treaty neither apply nor could be interpreted to apply to improperly restrict conduct protected under international human rights standards.
Second, any potential convention should detail robust procedural and human rights safeguards that govern criminal investigations pursued under such a convention. Police around the world are using an increasingly intrusive set of investigative tools to access digital evidence. Frequently, their investigations cross borders without proper safeguards and bypass the protections in mutual legal assistance treaties. Any potential convention should ensure that any interference with the right to privacy complies with the principles of legality, necessity, and proportionality, including by requiring independent judicial authorization of surveillance measures that intrude on privacy.
Substantive safeguards are needed because even laws that focus more narrowly on cyber-dependent crimes are used to undermine rights, targeting digital security researchers, whistleblowers, activists, and journalists. For these reasons, any future treaty should explicitly include a malicious intent standard and should provide a clearly articulated and expansive public interest defense, as well as include clear provisions that allow security researchers to do their work without fear of prosecution.
Thirdly and finally, trust is an essential component for increasing rights respecting international cooperation to counter cybercrime. Building trust requires transparency and participation of civil society, including groups with digital security expertise and who work with vulnerable communities and individuals. We welcome the fact that all NGOs that applied to participate in the Ad Hoc Committee were able to register. We encourage the Ad Hoc Committee to take up the recommendations in the joint letter for meaningful civil society participation, including by providing more advance notice of meetings like this one.
Thank you, Madame Chair.
[1] Letter to the United Nations to Include Human Rights Safeguards in Proposed Cybercrime Treaty, https://www.hrw.org/news/2022/01/13/letter-un-ad-hoc-committee-cybercrime