Canada must not sign draft UN Cybersecurity Convention

Draft convention exposes vulnerable Canadian communities to foreign state harassment and abuse

December 12, 2024 – Twenty leading organizations and experts are calling on the Canadian government to reject a United Nations treaty they say will undermine human rights on a global scale and imperil Canadian diaspora communities facing growing threats of transnational repression and foreign interference. Despite its name, the UN draft Convention on Cybercrime will also have the effect of undermining cybersecurity.

The convention, which is scheduled for consideration by the United Nations General Assembly next Tuesday, December 17, creates a powerful global policing tool through which any country will be able to request surveillance of Canadians in the absence of sufficient safeguards against abuse. 

Governments around the world are attacking vulnerable diaspora communities, including through abuse of international cooperation tools. In Canada, foreign states have proven increasingly willing to monitor, harass, threaten and even murder political dissidents. 

Canada’s existing framework for handling cross-border requests is not up to the task of restraining inevitable attempts to abuse this powerful new tool. Indeed, the draft Cybercrime Convention will undermine several existing safeguards, increasing the threat of severe repercussions for Canadians.

“Canada is already failing to protect our most vulnerable communities against transnational threats, and this treaty will further tie the government’s hands,” said Matt Hatfield, Executive Director at OpenMedia. “The draft Cybercrime Convention will become a trojan horse for future state abuse, limiting Canada’s ability to defend already beleaguered diaspora communities.”

The draft Convention’s negative impact on cybersecurity could also have far-reaching implications. 

Instead of focusing on developing the deep expertise needed to address cybercrime on a global scale, the draft convention’s exceedingly broad scope requires cooperation on “any serious crime”, diluting already over-loaded cross-border investigative resources. 

The proposed treaty encodes a number of common cybercrime offences, which further undermine cybersecurity by failing to incorporate clear safeguards for security researchers, who have faced legal threats and prosecution for legitimate, good faith efforts to expose security vulnerabilities. 

The same cybercrime provisions have also been used to threaten and prosecute whistleblowers and, as a result of this draft Convention, will be subject to a global extradition requirement.

“This treaty threatens to chill external cybersecurity research on a global scale at a time when independent scrutiny of security systems is increasingly vital”, said Kate Robertson, Senior Research Associate at the Citizen Lab. “It is irresponsible to adopt a powerful instrument of this nature without first ensuring sufficient safeguards are in place to ensure it will not be abused.”

The failure to incorporate effective human rights safeguards is indicative of a broader division that shaped negotiations of the draft Convention at the United Nations, and has drawn criticism from a broad array of stakeholders including human rights groups, the Office of the UN High Commissioner for Human Rights, members of the United States Senate, large tech companies and industry initiatives, and over 120 of the world’s leading cybersecurity researchers.

Many countries openly opposed a role for international human rights standards in this treaty and a last minute attempt to remove what few safeguards the draft convention retains was supported by 23 states, with 26 abstentions. 

“With some of the worst perpetrators of transnational repression opposing its inclusion of even nominal human rights safeguards, this treaty is ripe for abuse”, said Hatfield. “Canada should reject the draft Cybercrime Convention and, when it is considered by the United Nations General Assembly next week, make clear that it will not sign this instrument until it has ensured adequate safeguards are in place to prevent its misuse.”