UN Cybercrime Convention Stalls at One Ratification as Implementation Deadlock Deepens

Overview

The United Nations Convention against Cybercrime, adopted by the General Assembly in December 2024 and opened for signature at a ceremony in Hanoi in October 2025, has reached its first significant governance milestone in the worst possible way: a deadlock. As of March 2026, 74 countries have signed the treaty, according to Wikipedia, but only Qatar has formally ratified it — a gap that reflects both the political fractures the convention exposed at its signing and the deeper dispute over who gets to shape its implementation.

The treaty needs 40 ratifications to enter into force. With one country across the threshold seven months after the Hanoi ceremony, the convention’s path to operational status is uncertain — and the January 2026 Vienna meeting that was supposed to launch the implementation process instead ended in deadlock, with no consensus on rules for the body that would govern the treaty once it does take effect.

What the Convention Does

The convention establishes a framework for criminalizing unauthorized computer access, data interference, and electronic fraud, and — more controversially — creates broad mechanisms for cross-border evidence sharing and law enforcement cooperation. Its reach extends well beyond what critics and supporters alike initially described as its core purpose.

The treaty defines “serious crimes” for cooperation purposes as offenses punishable by at least four years of imprisonment, determined by each nation’s domestic law, regardless of whether those offenses involve information systems, according to Just Security. That means the same cooperative surveillance powers designed to chase ransomware operators can theoretically be invoked for crimes involving “criticism of the government, peaceful protest, same-sex relationships, investigative journalism, and whistleblowing” — provided those activities carry a four-year sentence under a requesting state’s domestic law, as Human Rights Watch and 16 co-signatories warned in a joint statement timed to the Hanoi ceremony.

Lawfare described the convention as representing a “jurisdictional revolution” by endorsing passive personality jurisdiction — the principle that allows states to criminalize conduct by anyone, anywhere in the world, if the conduct harms their nationals — in a way that would “remove any meaningful limits on this type of criminal jurisdiction,” according to its analysis.

The dual criminality requirement — which would restrict cooperation to conduct illegal in both the requesting and requested state — is optional rather than mandatory under Article 40.8, according to Just Security. That optionality is “particularly concerning” for content-related offenses where legal standards vary sharply across jurisdictions.

The Hanoi Ceremony and Who Did Not Sign

64 states signed on the first day of the Hanoi ceremony, with five more joining by the second day, according to Tech Policy Press. Russia and China signed; so did France, the United Kingdom, Brazil, and South Africa. But the United States, Canada, New Zealand, Japan, India, and Israel all declined to sign, according to Just Security.

The Biden administration had voted for the convention at the General Assembly but declined to sign at Hanoi. The Trump administration, Just Security noted, is “distrustful of multilateralism” and “unlikely to ratify the treaty its delegation voted for at the U.N. General Assembly.”

The ceremony itself reflected what observers called a “starkly state-centric framing,” with delegations drawn primarily from justice and interior ministries rather than technology or digital policy portfolios, as Tech Policy Press reported from the event. Civil society access was heavily constrained: “Many secured Vietnamese visas only at the last minute, if at all,” and “programme instructions and guidance on accessing the venue were limited.” Only the Global Network Initiative attended as a digital rights organization. Private sector attendance was also limited, particularly from large technology companies, according to Tech Policy Press. The pattern of the signing ceremony — expert observers cut out, powerful states in — would preview the Vienna meeting three months later.

The January 2026 Deadlock

At the end of January 2026, the Ad Hoc Committee convened in Vienna to negotiate the rules of procedure for the Conference of States Parties — the body that will govern the convention once it enters into force. The meeting ended without consensus on the fundamental question of whether civil society, the private sector, academia, and international organizations would be allowed to participate in conference processes and technical working groups.

The split was stark, according to the Global Initiative Against Transnational Organized Crime: the EU, Western states, Japan, and Colombia backed broad access for non-state actors; Russia, the African Group — led by Egypt — Iran, and North Korea opposed it.

The committee chair, Eduardo Paes Saboia, was unsparing in his assessment: “The fight against cybercrime loses, cybercriminals are very happy with the result, they are cheering,” he said, according to the Global Initiative. He added: “What is the purpose of having a convention if we are going to work on this basis?”

Proposed compromises — including automatic acceptance of organizations accredited through the UN’s Economic and Social Council and streamlined application procedures for others — were all rejected without consensus. The next formal session is not scheduled until January 2027.

The UN’s own funding crisis added a further layer of dysfunction. Secretary-General António Guterres warned of “imminent financial collapse” in January 2026, and budget cuts meant Vietnam had to fund interpretation shortfalls for the Vienna meeting itself, according to the Global Initiative.

The Human Rights Architecture Problem

At the core of the opposition is a structural argument: the convention was designed to be a floor for cooperation, not a ceiling for rights protection, and states can interpret its safeguards downward.

A joint statement signed by Human Rights Watch, Access Now, the Electronic Frontier Foundation, Privacy International, Article 19, and 12 other organizations put the concern plainly: the convention “includes weak domestic human rights safeguards in its criminal procedural chapter, and fails to explicitly incorporate robust safeguards applicable to the whole treaty.” The same statement flagged that the convention “permits the excessive sharing of sensitive personal information for law enforcement cooperation, beyond the scope of specific criminal investigations.”

Article 6.2, the convention’s principal human rights clause, states that “nothing in this Convention shall be interpreted as permitting the suppression of human rights or fundamental freedoms” — but that clause “lacks enforceable measures needed to prevent abuse,” according to Just Security. The Electronic Frontier Foundation characterized the problem as the treaty giving states “leeway…to decide whether or not to require human rights safeguards,” according to Lawfare.

Article 28(4), for example, could compel technology employees to reveal security vulnerabilities and encryption keys, according to Global Partners Digital. Article 47 permits direct police-to-police cooperation that bypasses the mutual legal assistance procedures and safeguards that traditionally govern cross-border law enforcement data requests.

Critics also warn of covert surveillance provisions: Article 42.3.g allows surveillance operations without notifying the user, according to Just Security.

A civil society letter coordinated by Global Partners Digital, signed by organizations including Amnesty International, the Wikimedia Foundation, and European Digital Rights, specifically urged EU member states to withdraw support, arguing the convention conflicts with existing EU data protection frameworks including the GDPR.

What Comes Next

The convention remains open for signature at UN Headquarters in New York until December 31, 2026, according to Wikipedia. Azerbaijan and Vietnam are reported to have completed internal ratification procedures, which would bring the total to three — still far short of the 40 needed for the convention to enter force.

The Just Security analysis notes that 121 UN members have yet to accede, and that only 32 of the current signatories are also parties to the Budapest Convention on Cybercrime, the existing multilateral instrument that the new treaty was partly designed to supersede. How many of those 32 — mostly European democracies — choose to ratify a convention they signed alongside Russia, China, and Iran will be a defining question for the treaty’s political character.

With the next implementation session not scheduled until January 2027, the convention is in an extended holding pattern. The structural debate over observer participation — essentially a proxy for whether the treaty’s governance will be transparent or opaque — is unresolved and shows no sign of moving. And with the US declining to sign, the Budapest Convention, which covers many of the same jurisdictions but with stronger human rights guardrails, retains its relevance as the operative framework for transatlantic cybercrime cooperation.

What We Don’t Know

• Whether the EU, which signed the convention, will ultimately ratify it, particularly given ongoing civil society pressure and GDPR compatibility concerns
• Whether the January 2027 implementation meeting will resolve the deadlock over civil society participation, or whether the same alignment — EU and West against Russia and the African Group — will produce another stalemate
• What formal reservations, if any, democratic signatories will attach to their ratifications — a mechanism that human rights groups have urged as a minimum safeguard
• Whether any US administration will ultimately sign and ratify the convention, or whether the Budapest Convention will remain the operative US framework indefinitely
• How quickly Azerbaijan and Vietnam will formally deposit their ratification instruments, and whether any larger states will follow in the near term