Human Rights Groups Warn UN Cybercrime Treaty Must Avoid 'Chilling Effect'

Ahead of a United Nations session next week, nearly 130 academics and advocacy groups asserted that "it is vitally important to apply a human rights-based approach" to drafting a potential cybercrime treaty.

"A convention without such safeguards or that dilutes states' human rights obligations would place individuals at risk and make our digital presence even more insecure."

That message came in a letter to Faouzia Boumaiza Mebarki, chair of an ad hoc committee created by a 2019 U.N. General Assembly resolution to draft a "comprehensive international convention on countering the use of information and communications technologies for criminal purposes."

Though the committee has faced delays due to the Covid-19 pandemic, it held an organizational meeting in May 2021 and plans to kick off a session on Monday set to run through January 28.

Spearheaded by the Electronic Frontier Foundation and Human Rights Watch, the letter reiterates concerns raised during 2019 debates about whether to begin work on such a treaty, arguing that "countering cybercrime should not come at the expense of the fundamental rights and dignity of those whose lives this proposed convention will touch."

"Any proposed convention should incorporate clear and robust human rights safeguards," the letter declares. "A convention without such safeguards or that dilutes states' human rights obligations would place individuals at risk and make our digital presence even more insecure."

Specifically, the letter says, "the important work of combating cybercrime should be consistent with states' human rights obligations set forth in the Universal Declaration of Human Rights (UDHR), the International Covenant on Civil and Political Rights (ICCPR), and other international human rights instruments and standards."

"In other words, efforts to combat cybercrime should also protect, not undermine, human rights," the letter adds. "We remind states that the same rights that individuals have offline should also be protected online."

The scholars and groups highlighted that "vaguely worded cybercrime laws purporting to combat misinformation and online support for or glorification of terrorism and extremism, can be misused to imprison bloggers or block entire platforms in a given country."

"As such, they fail to comply with international freedom of expression standards," the letter says. "Such laws put journalists, activists, researchers, LGBTQ communities, and dissenters in danger, and can have a chilling effect on society more broadly."

"There is a real risk that, in an attempt to entice all states to sign a proposed U.N. cybercrime convention, bad human rights practices will be accommodated."

The signatories also noted that even more narrowly focused measures can be abused, pointing out that "laws criminalizing unauthorized access to computer networks or systems have been used to target digital security researchers, whistleblowers, activists, and journalists."

"Any potential convention should explicitly include a malicious intent standard, should not transform corporate or government computer use policies into criminal liability, should provide a clearly articulated and expansive public interest defense, and include clear provisions that allow security researchers to do their work without fear of prosecution," the letter states.

The treaty should also "ensure that any interference with the right to privacy complies with the principles of legality, necessity, and proportionality, including by requiring independent judicial authorization of surveillance measures," the letter continues, adding that states should be empowered to adopt additional safeguards and encouraged to enact strong privacy laws.

The scholars and groups asked the committee to "actively include civil society organizations in consultations--including those dealing with digital security and groups assisting vulnerable communities and individuals--which did not happen when this process began in 2019 or in the time since."

"There is a real risk that, in an attempt to entice all states to sign a proposed U.N. cybercrime convention, bad human rights practices will be accommodated, resulting in a race to the bottom," the letter warns. "Therefore, it is essential that any potential convention explicitly reinforces procedural safeguards to protect human rights and resists shortcuts around mutual assistance agreements."