The signature of the UN Convention against Cybercrime in Hanoi and its safeguards

The United Nations Convention against Cybercrime opened for signature at the National Convention Center in Hanoi on Saturday 25 October. The UN Office of Legal Affairs reports that 71 States and the European Union signed over the two days, and it calls this one of the largest signing turnouts for a treaty deposited with the Secretary-General in the last decade[1]. António Guterres co-chaired the ceremony with the Vietnamese State President, Lương Cường, and described the text as "a powerful, legally binding instrument" against cybercrime[2]. The United Kingdom, China, Russia, Brazil and Nigeria signed[3]. The United States sent its ambassador to Viet Nam and did not sign. A State Department spokesperson said on 27 October that "the United States continues to review the treaty"[3].

The General Assembly adopted the Convention by resolution 79/243 on 24 December 2024, after five years of negotiation[12]. Russia first proposed a UN treaty on the subject in 2017 and drove the process[5]. Chapter II of the text requires parties to criminalise illegal access, illegal interception, interference with data and systems, computer-related fraud, online child sexual abuse material, grooming and the non-consensual dissemination of intimate images. Chapter IV gives law enforcement powers over stored data, traffic data and the interception of content. Chapter V organises extradition, mutual legal assistance and the sharing of electronic evidence[4]. Article 65 provides that the Convention enters into force on the ninetieth day after the fortieth instrument of ratification. It stays open for signature in New York until 31 December 2026[1].

What the Union signed, and as what

The Union signed as a party in its own right. The Council adopted on 13 October a decision authorising the Commission and the Member States to sign. The Council's release explains that the Union can sign and ratify only if at least one Member State does so, and that conclusion will need a further Council decision with the consent of the European Parliament[6]. In Hanoi, Olivier Onidi, Deputy Director-General for Migration and Home Affairs, signed on behalf of the Union, and the Czech Republic, Greece, Ireland and Belgium were among the Member States that signed on the first day[2]. Other Member States will sign later under their national procedures[7].

The Commission's statement of 27 October gives the reason for signing. The Budapest Convention of the Council of Europe has governed European cooperation on cybercrime since 2004, and 115 UN Member States are not parties to it. The Commission says that the new Convention "fills an important gap" because it allows cooperation with those states[8]. The Eurojust factsheet of July 2025 describes the UN text as largely inspired by Budapest, with cooperation on electronic evidence limited to serious crimes[4].

The Union attached a declaration. It says that the Union and its Member States will implement the text correctly and completely and will take part in the Conference of the States Parties. On rights, the declaration says the safeguards "prohibit the abuse of the Convention to suppress human rights" and allow a party to refuse a request made to prosecute a person for sex, race, language, religion, nationality, ethnic origin or political opinion. The Union calls these safeguards essential to mutual trust[7].

The safeguards debate

The text of the safeguards is not in dispute. Article 6 provides that implementation must be consistent with international human rights law and that nothing in the Convention permits the suppression of human rights, including freedom of expression. Article 24 provides that the powers of Chapter IV are subject to domestic safeguards, that these "shall incorporate the principle of proportionality", and that they include judicial or other independent review and limits on scope and duration. Article 40(22) allows a requested state to refuse mutual legal assistance where it has substantial grounds to believe that the request aims to punish a person for political opinions or other listed grounds[9].

The dispute concerns scope. Article 2(h) defines a serious crime as conduct punishable by a maximum of at least four years' imprisonment, and Article 35 extends cooperation on electronic evidence to any serious crime, whether or not it has a technological element[9]. On 24 October, nineteen organisations, including Human Rights Watch, Access Now, ARTICLE 19, the Electronic Frontier Foundation and Privacy International, published a joint statement. They argue that the treaty "obligates states to establish broad electronic surveillance powers", and that many states criminalise criticism of government and peaceful protest at that threshold. They add that the safeguards in Article 24 cover the procedural chapter alone and that no mechanism suspends a party that systematically violates rights. They asked states to refuse to sign, and asked those that sign to condition cooperation on dual criminality and to publish statistics on requests received[10]. Microsoft, Meta, Oracle and Cisco opposed the text on the ground that it endangers security researchers[11]. The venue added to the argument, since Human Rights Watch pointed to a crackdown on online dissent in Viet Nam[5].

We read both sides as correct about the text and divided about its use. Article 40(22) does not require refusal; it provides that nothing obliges a state to assist where it suspects a political purpose[9]. It is a permission to refuse, and a permission binds no one. Our generation will spend its working life inside the cooperation that Hanoi opens. The question for Europeans is how the Union turns a permission into a practice.

What we ask

The Council should write the refusal grounds of Article 40(22) into the Council decision on conclusion as a binding instruction to the Member States, so that the Parliament gives its consent to a known practice[6].

The Member States should enact, before ratification, a dual criminality requirement for every request under Article 35 that concerns a serious crime outside Chapter II, as the joint statement asks[10].

The Commission should publish each year the number of requests received under the Convention, the requesting states and the number refused, and it should ask Eurojust to collect the figures from the Member States[4].

The Union should use its seat at the Conference of the States Parties to propose a rule of procedure that admits civil society and security researchers, since the Union's own declaration asks for their continued involvement[7].