UN Cybercrime Pact to Be Signed in Hanoi Raises Hopes and Deep Concerns
The Cybersecurity Tech Accord — an industry coalition representing Meta, Microsoft and dozens of other firms — has called the final text a “surveillance treaty.”
People visit the stands of local and foreign companies operating in the field of cyber security taking part in the 14th edition of the International Gulf Information Security Exhibition and Conference (GISEC Global 2025), held at the Dubai Trade Center in Dubai, United Arab Emirates on May 6, 2025. Photo by Anadolu Images.
A
landmark U.N. cybercrime convention that supporters say will strengthen global tools to fight online criminal networks, but critics warn could turbocharge transnational surveillance and political repression is due to be signed in Hanoi this weekend, amid intensifying scrutiny over both its broad scope and its choice of host country.
The treaty — the first comprehensive international instrument on cybercrime negotiated at the United Nations — is intended to help governments cooperate faster on investigations spanning borders. It would enter into force once ratified by 40 states; threshold negotiators expect to be reached in 2026.
U.N. officials have touted the agreement as a “historic step” in closing gaps that currently enable cross-border hackers, ransomware gangs and online criminal operations to evade prosecution by exploiting slow judicial processes and jurisdictional loopholes. The U.N. estimates cybercrime costs the global economy trillions of dollars each year.
But human rights organizations, major technology companies and digital security researchers say the pact contains language so broadly defined that it risks being used not only against cybercriminals — but against journalists, whistleblowers, civil society groups and even ethical security researchers.
Fears of extraterritorial surveillance
The Cybersecurity Tech Accord — an industry coalition representing Meta, Microsoft and dozens of other firms — has called the final text a “surveillance treaty,” saying vague provisions on “content-related crimes” could enable intrusive cross-border cooperation requests that bypass meaningful judicial safeguards.
Some of the most contentious clauses relate to data-sharing. Once in force, signatory governments could request user data or subscriber information directly from foreign authorities. Tech firms warn this could allow governments to target critics abroad under pretexts of “cyber sabotage” or “digital disinformation.”
“Instead of limiting state abuse, this could institutionalize it,” said Raman Jit Singh Chima of Access Now. “The risk is that countries with repressive track records can demand data in ways that threaten activists, journalists and political opponents.”
The U.N. Office on Drugs and Crime (UNODC), which led negotiations, insists human rights safeguards are built into the text. It says states will retain the right to refuse cooperation requests if they conflict with international law. “There are explicit human rights protections in the convention,” UNODC said in a statement.
Vietnam’s role draws scrutiny
Diplomats and rights advocates say the optics of holding the signing ceremony in Vietnam have amplified concerns rather than eased them. Hanoi has one of Asia’s most restrictive environments for online speech. At least 40 people have been arrested this year alone for posting criticism of the government or the Communist Party on social media, according to Human Rights Watch.
The U.S. State Department’s 2025 human rights report cited “significant restrictions on online freedom of expression” in Vietnam, including pervasive state monitoring and criminal penalties for comments judged to “distort history” or threaten “national harmony.”
“Hosting the treaty in Hanoi sends a troubling signal about who will set the tone for enforcement,” Chima said. “It implicitly validates the idea that cyber governance and repression belong in the same space.”
Vietnamese officials counter that the country faces a surge in cyberattacks against strategic infrastructure and sees the pact as a tool for deterrence. “International cooperation is urgently needed,” said Le Xuan Minh, head of cybersecurity at the Ministry of Public Security.
Ethical hackers fear collateral damage
Another sticking point for civil society is uncertainty around whether “white hat” security research — penetration testing, vulnerability disclosure and code auditing — will be shielded. Without strong language distinguishing “good-faith hacking” from malicious exploits, research groups say governments could retaliate against those who uncover state-linked security flaws.
“Governments unhappy with disclosures could weaponize this treaty,” said a senior policy expert at a major Western tech firm. “That’s not hypothetical — it has happened before under narrower laws.”
The UNODC maintains the pact “encourages” states to permit legitimate research, but analysts point out the wording is non-binding.
While the final list of signatories is expected to be released only at the ceremony, the European Union and Canada have signaled their intention to join, saying last-minute language improvements secured at negotiations were sufficient to justify signature.
Whether the United States signs remains uncertain. The U.S. State Department declined to comment on attendance, reflecting internal divisions between national security officials, who favour faster digital evidence-sharing, and privacy advocates who fear expanded state reach.
China and Russia have strongly backed the convention, having pushed early drafts that prioritized “information stability” — language rights groups interpreted as code for controlling political dissent online. Some diplomats say the final text is more balanced than originally proposed but still wide enough to empower abuse.
Supporters: a necessary start
For supporters, especially countries facing fast-rising ransomware and financial cybercrime, the pact fills a gap left by the 2001 Budapest Convention — which some major non-Western states refused to join. They argue global criminal cartels, state-linked hacking groups and cyber-extortion rings move faster than existing cooperation channels allow.
“We have entered a world where cyberspace can paralyze hospitals, banks and transport networks overnight,” one Southeast Asian diplomat said. “This treaty is overdue.”
Even after signing, each country must pass domestic legislation to implement the treaty before ratification. That process will spur further political debate — especially in democracies where civil liberties groups intend to lobby for narrower definitions of digital crime.
Analysts expect the convention’s ultimate impact to depend less on its final text than on which governments attempt to exercise it — and how aggressively they do so.
The ceremony in Hanoi is scheduled for Saturday and will be attended by U.N. Secretary-General António Guterres.
(Source: Reuters)
