In the lead up to the concluding session of the Ad Hoc Committee negotiating an international convention on cybercrime, ARTICLE 19 remains gravely concerned about the continued incompatibility of the draft text of the Convention with international standards on freedom of expression. We regret that the Ad Hoc Committee has done close to nothing to meaningfully address the plethora of our concerns, as well as the concerns raised by numerous states and stakeholders during the most recent session. The key problems of the draft text include fundamental vagueness on the scope of the Convention, numerous content-based offences, and underlying conflict of the Convention’s plain text with human rights standards. We urge the states not to conclude this Convention and make sure the draft is comprehensively revised.
ARTICLE 19 has closely monitored the drafting process of the proposed Comprehensive International Convention on Countering the Use of Information and Communications Technologies for Criminal Purposes (the Convention). We provided legal analysis on several drafts, most recently the joint analysis with Human Rights Watch on the Consolidated Draft used as the basis for the negotiations of the Sixth Session in New York in August 2023. In anticipation of the Ad Hoc Committee’s final session, to take place from 29 January to 9 February 2024 in New York, a new Draft Text has been released.
ARTICLE 19’s key concern with the recent draft include the following issues. We also note that this comment does not seek to provide an in-depth legal analysis on every provision, many of which are simply repeated from the prior Consolidated Draft, or are currently undergoing ongoing informal negotiations.
The Draft Text takes a step backward from basic human rights protections
Article 5 of the prior draft required states to ensure that implementation of the Convention is ‘in accordance’ with their international human rights obligations. ARTICLE 19 is concerned that the current draft only requires that implementation is ‘consistent with’ rights obligations. This softened language is significant, as it no longer requires compliance with human rights norms. Further, the Preamble of the Convention still fails to mention international human rights standards as the framework for the whole Convention. Moreover, paragraph 3 of the Preamble still includes cyber-enabled offences ‘related to terrorism, trafficking in persons, smuggling of migrants, illicit manufacturing of and trafficking in firearms,’ which, as highlighted in more detail below, in our view have no place in this treaty. For instance, the reference to terrorism alone is particularly concerning, as there is no universally agreed upon definition of terrorism under international law.
Additionally, Article 21, which provides for parameters of prosecution, adjudication, and due process, only applies to offences established ‘in accordance’ with the Convention, meaning its scope beyond the offences explicitly named is unclear. It also only requires that due process protections are ‘consistent with’ international human rights obligations. This makes no mention of the presumption of innocence or principles of legality, strict necessity and proportionality. Finally, Article 24 of the current draft, which provides for conditions and safeguards, only applies to the procedural measures adopted under Chapter IV rather than the whole Convention. It fails to incorporate the principles of necessity and legality and the need for prior judicial authorisation.
The Draft Text retains all its numerous contentious content-based offences
ARTICLE 19 has criticised the previous draft text for containing unnecessary content-related references that may infringe freedom of expression online. Several of these offences were subject to considerable debate in the Sixth Session as they criminalise conduct never before seen in an international treaty. Some of these offences are cyber-enabled rather than cyber-dependent, meaning they do not even clearly fall under the scope of a cybercrime treaty. ARTICLE 19 recalls that criminal laws prohibiting dissemination of content are, by definition, restriction on freedom of expression, and therefore must be analysed according to the tripartite test of restrictions enumerated under Article 19(3) of the International Covenant on Civil and Political Rights (ICCPR). The provisions in question under the Draft Text include:
- The Draft Convention infringes on the rights of survivors of online gender-based violence (Article 15): While the trend of non-consensual sharing of images is problematic, addressing it in an international criminal instrument raises serious and complex issues in balancing freedom of expression and privacy rights, and is likely to backfire against the very vulnerable groups the provision is purported to protect. Article 15 does not appropriately mitigate the risk of criminalising survivors, particularly where the perpetrator is an authority figure, nor does it centre the lack of freely-given consent or exempt conduct that is a matter of public interest, or for a legitimate purpose related to the administration of justice.
- The Draft Convention unduly restricts the rights of children and risks banning books (Articles 13 and 14). As drafted, Articles 13 and 14, which purport to curb the dissemination of child exploitation materials, go well beyond international standards on the matter and risk infringing on children’s rights and criminalising content that may have scientific, educational, artistic, or literary value. Particularly in states where gender expression is repressed, these articles may also restrict the legitimate experience and expression of gender and sexuality of children, including adolescents. Finally, Article 13 is written so broadly that it would appear to ban books including classic works of fiction taught in universities; indeed, Article 13(2)(b) defines ‘material’ to include not only ‘images’ but also ‘written material’. ARTICLE 19 recalls that an informal report covering these articles, following the recent Sixth Session, reveals little consensus as to basic definitions and scope, noting a number of key provisions where ‘attempts to reduce the gap [between states] did not yield any fruit’ and several where ‘delegations could not agree’.
The underlying scope of the Draft Convention remains unclear
The Draft Convention continues to lack a coherent articulation of what does or does not constitute a cybercrime, which is astonishing this late into the drafting process. From the Sixth Session, an informal meeting was convened to present two proposals on the Convention’s scope. As a result of the meeting, the co-chairs of the working group noted that States disagreed on ‘several live issues,’ including whether Article 17 served as ‘morphing it into a general crimes convention’ or whether it ‘would apply to the full suit of procedural powers and international cooperation’. The proposed solutions, nonetheless, both adopt an expansive scope in contravention of the numerous States that have taken pause at the ambiguous scope and the obligations it would impose on them.
- The first proposal is to merge Article 17 into Article 35 within the section on procedural measures, which would explicitly apply procedural powers to any new offences passed in accordance with the Convention that carry ‘a penalty of three years or more’.
- The second proposal seeks to require the criminalisation of any offence under a United Nations convention or protocol.
We note that both these proposals are significantly problematic and do little to nothing to mitigate the underlying problem with Article 17. Allowing procedural powers to flow merely from the severity of penalty has no basis in the actual substance of an offence, and rewards expansive police, surveillance, and extradition powers to States that merely impose disproportionate penalties. Additionally, United Nations conventions include a number of obligations and frameworks, such as that surrounding hate speech, which would be undermined or lead to conflicts if suddenly required to be bluntly criminalized. In this respect, the purported ‘limitation’ to United Nations instruments is tone-deaf to the practical complexities of such instruments, threatening to undermine them and create unnecessary confusion. The full implications of Article 17 and these proposals still cannot be understood because as currently drafted, it could also apply to future treaties including where those future treaties deliberately avoid applying their provisions to online environments.
The Draft Convention is unresponsive to fundamental concerns regarding its broad cross-border surveillance and police powers
The bulk of the Convention’s proposed provisions allow for expansive and highly intrusive sharing of personal data, which among other fatal problems, threatens to chill the use of tools that promote freedom of expression online. For instance, the Draft Text in Article 40 still authorizes proactive information disclosures without any consideration for the safeguards of sending or recipient states. Article 47 continues to contemplate generalized information sharing beyond the scope of particularized investigations. These are not constrained by any explicit data protection safeguards. Provisions such as these, and others which ARTICLE 19 has previously analyzed, are more problematic given the aforementioned lack of human rights or due process safeguards, including prior judicial authorization requirements.
ARTICLE 19 finds it astonishing that after several years and several drafting sessions, such fundamental issues with the Convention remain. ARTICLE 19 urges States to reconsider the necessity of rushing an inherently flawed and overbroad instrument this late in the process. We will continue to work closely with partners in civil society and relevant stakeholders as we follow the outputs of the negotiations and drafting process.