Loading story…
The United Nations Convention against Cybercrime has drawn broad international signatures but remains far from taking effect, with more than 70 states signing the treaty while only Qatar, Azerbaijan, and Vietnam had ratified it by mid-2026. Adopted by the UN General Assembly in late 2024 and opened for signature in Hanoi in 2025, the convention requires 40 ratifications to enter into force. Debate has shifted from adoption to implementation, with governments and civil society focusing on the treaty’s human rights safeguards, its broad application to "serious" offenses, and unresolved rules for participation in the future Conference of States Parties.
Canada’s unexpected decision to sign has intensified criticism from rights advocates, who warn the convention could operate as a cross-border surveillance and electronic evidence-sharing framework with significant extraterritorial reach. Critics say the treaty could expose journalists, whistleblowers, security researchers, and platform accountability researchers to greater risk, while potentially legitimizing the sharing of spyware-derived data through opaque cooperation channels. The United States has not signed and has indicated it is unlikely to do so until there is evidence that participating states are implementing the convention’s legal and human rights protections.
See the reporting duties and controls this puts on the clock.
7 events from the most recent confirmed update back to the earliest known activity.
The Canadian government announced earlier in July 2026 that it had signed the United Nations Convention against Cybercrime. The announcement prompted criticism from Citizen Lab senior research associate Kate Robertson.
A special treaty event in Abu Dhabi created another opportunity for states to sign or ratify the Convention. The event produced no reported surge in ratifications.
From January 26 to 30, 2026, the Ad Hoc Committee met to draft Rules of Procedure for the future Conference of States Parties. It failed to reach consensus on participation roles for civil society, the private sector, academia, and technical experts.
As of mid-2026, only Qatar, Azerbaijan, and Vietnam had ratified the Convention, far short of the 40 ratifications required for entry into force.
The Convention opened for signature at a ceremony in Hanoi, where 71 states and the European Union signed. Russia, China, Iran, and the European Union were among the signatories, while the United States did not sign.
The United Nations Convention against Cybercrime was adopted by consensus by the UN General Assembly. The United States joined the consensus for adoption but did not commit to signing afterward.
The Convention originated from a 2019 Russian push to create a UN-negotiated alternative to the Council of Europe’s Budapest Convention on Cybercrime.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
citizenlab.ca
Open sourcecybercenter.space
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A United Nations cybercrime treaty, set to be signed in Hanoi by dozens of countries, has drawn warnings from the Foundation for Defense of Democracies (FDD) about its potential to undermine human rights and cybersecurity research. The FDD advisory argues that Russia and China have shaped the treaty to export their model of digital authoritarianism, using vague provisions that could allow autocratic governments to criminalize journalism, activism, and security research under the guise of combating cybercrime. The treaty is described as a "Trojan horse for suppressing dissent," and could force democratic nations to assist in repressive measures, further fracturing the global internet. Despite strong opposition from a coalition of technology and private sector firms, Russia and China have advanced the treaty, which will come into effect after ratification by 40 states—a number unlikely to include the United States. The FDD warns that the treaty could erode protections for human rights and cybersecurity research, and serve as a platform for Russia and China to rally international support and diminish the influence of the United States and its allies in global cyber governance.
Jun 29, 2026
The United Nations has signed a new cybercrime treaty intended to strengthen international cooperation against cybercrime, but the agreement has sparked significant privacy concerns among experts and journalists. The treaty's broad language is seen as potentially enabling governments to expand surveillance capabilities, suppress dissent, and target journalists across borders, raising alarms about the erosion of civil liberties and press freedom. Panelists highlighted the risk that the treaty could be misused by authoritarian regimes to justify intrusive monitoring and clampdowns on legitimate activities under the guise of cybercrime prevention. In addition to the treaty discussion, recent incidents such as the privacy scandal at Baptist Hospital in Jay, Florida, where staff posted unauthorized photos of patients on social media, underscore the ongoing challenges in protecting sensitive information and enforcing privacy regulations like HIPAA. The panel also noted industry shifts, including Francisco Partners' acquisition of Jamf, which may impact the landscape of device management and security, particularly for organizations relying on Apple products.
Jul 12, 2026
Canada’s proposed lawful access bill, **Bill C-22**, drew opposition from Signal, Apple, Google, Meta, NordVPN, DuckDuckGo, Windscribe, and Tailscale, which warned that the measure could force providers to weaken encryption, retain user metadata for up to one year, and build technical capabilities for government access. Critics said the bill’s use of secret ministerial orders and limited judicial oversight could undermine privacy commitments, raise compliance costs, and create new security weaknesses that malicious actors could exploit. Canadian officials said the legislation is intended to modernize investigative powers and that amendments will clarify it is not meant to break encryption, but the government plans to preserve the one-year metadata retention requirement. Civil liberties groups and researchers including **Citizen Lab** and the **Canadian Civil Liberties Association** argued that the metadata retention and ministerial-order provisions should be removed entirely, warning that the proposal deepens the conflict between lawful access demands and the need to protect privacy, cybersecurity, and secure communications.
Jun 29, 2026