Governments Should Not Legitimize Transnational Surveillance and Repression Online
Written by the Wikimedia Foundation’s: Stan Adams, Lead Public Policy Specialist for North America; and, Zoe Philadelphia-Kossak, Legal Fellow
The United Nations Convention Against Cybercrime raises significant concerns for Wikimedia volunteer editors as well as the Wikimedia Foundation. The Convention would empower governments to collect a wide range of sensitive information, undermine internet security, and compel internet platforms to secretly facilitate surveillance of both their staff and their users to investigate an extremely broad spectrum of allegedly criminal activity. Critically, the treaty lacks effective human rights safeguards to prevent abuses of these sweeping government powers. While the Convention aims to combat cybercrime, the current text represents a real threat to privacy and freedom of expression alike — including that of volunteer editors and Foundation staff, who contribute to open and free knowledge from everywhere in the world. We urge UN Member States to oppose this treaty unless it is amended to both narrow its scope and strengthen its safeguards.
The Status of the UN Convention Against Cybercrime
The Convention originates from growing global concerns about the rise of cybercrime — i.e., intentional criminal activities like cyberattacks that target, exploit and/or use digital technologies, network, devices and/or data — and the need for international cooperation in order to counter it. In 2019, the UN General Assembly (UNGA) adopted a resolution, introduced by Russia — and supported by China, Syria, Iran, Belarus, and Venezuela, among others — to initiate discussions on a new global cybercrime convention. Countries such as Russia and Iran pushed for stronger government control and succeeded in broadening the scope of crimes that could be addressed under the Convention, while Western countries advocated for stronger privacy safeguards. In August 2024, the Ad Hoc Committee tasked to elaborate the Convention released a draft of the international treaty, marking a step towards finalizing it. This draft was submitted to the UNGA for final approval earlier this year.
Our Concerns about Data Surveillance and Inadequate Safeguards for Human Rights
The Convention raises concerns about how governments can regulate and prosecute online activities, access personally identifiable information, and define criminal behavior in the digital space. The Convention’s broad definition of cybercrime — essentially any crime punishable by at least four years in prison and that involves the use of a computer system — paired with states’ ability to define those crimes in national law would empower governments to reach across borders in order to investigate and prosecute computer security researchers, whistleblowers, journalists, and political dissidents and activists. The Convention would empower states to collect real-time traffic and content data, and also would enable the seizure and confiscation of crime-related assets, including property and money that are tied to the allegedly illegal activity.
Furthermore, although the Convention acknowledges human rights, it lacks a strong framework to effectively protect them. For instance, the Convention pushes for open-ended transborder cooperation with law enforcement, but does not require parties to implement a common set of procedural safeguards — things like independent judicial review and limits on the scope and duration of investigatory powers (.pdf file). Instead, the Convention allows individual states to determine what safeguards they will implement through domestic law, which could lead to significantly different levels of protections in different countries. Even if countries with historically-demonstrated respect for human rights are able to resist cooperating under this Convention with countries known for human rights abuses, the Convention nonetheless gives abusive regimes the facade of a UN treaty to cover their acts of transnational repression.
Human rights obligations and the norms that concern the legality, necessity, reasonableness, and legitimate purpose associated with deviating from those obligations are already interpreted differently in each country. Because of this, we are concerned that the Convention’s flexibly permissive approach to implementation could allow states to define the scope of cybercrimes broadly, while offering very limited safeguards against abuse. We also worry that the Convention could embolden — or be used to pressure — countries to adopt more extreme internet regulations, citing the need to combat cybercrime as a rationale for increasing government control over the internet and other information and communication technologies (ICTs).
Risks and Threats for Wikimedia Volunteer Editors and Foundation Staff
The UN Convention Against Cybercrime would increase risks and threats regarding privacy, freedom of expression, and government coercion for Wikimedia volunteer editors and the Foundation’s staff. Governments could use the Convention to justify reaching across borders to access information that could be used to identify volunteer editors. Although the Foundation strives to collect as little non-public information as possible — and denies the majority of government requests for user data based on our strong privacy principles — the Convention could expand the number of such requests and could encourage governments to enact new legislation. For example, “foreign agent” laws and those requiring in-country representatives alongside local data storage can be used to gain increased access to and leverage over employees of nonprofit organizations like the Foundation.
In addition, the Convention could empower governments to obtain encryption keys and/or to conduct real-time surveillance of private communications. Although this might not impact Wikipedia and other Wikimedia projects directly, it could affect many of the communications platforms used by volunteer editors and Foundation staff. Undermining the privacy and security of technologies like virtual private networks (VPNs) and encrypted messaging services increases the risk that volunteer editors and/or staff could be identified and face persecution from oppressive regimes. Academic research demonstrates the chilling effect that online surveillance creates for Wikipedia’s readers and volunteer editors — a substantial negative impact that we cited in our yearslong legal challenge to the US National Security Agency’s internet surveillance programs.
The quality, accuracy, and reliability of information on Wikimedia projects depends on volunteer editors being able to contribute well-sourced, verifiable information to the articles without fear of retaliation or persecution from those in power and/or with vast influence and resources who dislike their portrayal on Wikipedia. Volunteer editors already put themselves and their freedom at risk alongside journalists and political dissidents and activists who criticize governments and powerful organizations and individuals, and the Convention could extend those risks across borders and expand the scope of “cybercrimes” actionable under international law.
Conclusion
The UN Convention Against Cybercrime poses a threat to privacy and raises concerns about freedom of expression for Wikimedia volunteer editors and the Wikimedia Foundation by expanding the risks of retaliation against volunteer editors and staff.
We urge UN Member States to reject this international treaty in its current form and to ensure that all UN treaties fully protect human rights as recognized by international law online and offline.
The Foundation will continue to defend the rights and the privacy of Wikimedia volunteer editors, and also to protect the ability and rights of everyone, everywhere, to freely create, receive, and share reliable information online. We will continue to oppose and challenge treaties like the UN Convention Against Cybercrime when they threaten the free and open knowledge movement.
Join us in opposing this treaty by sharing this blog post and/or this open letter with national leaders and representatives.
The UN is expected to vote on the adoption of this treaty before the end of 2024. We will update you as the future of this treaty evolves.
