Despite massive protests: UN Cybercrime Convention adopted unanimously

The controversial United Nations convention on combating cybercrime has been finalized. The UN ad hoc committee set up unanimously approved the draft convention in New York on Thursday after around three years of negotiations. The initiative was launched byRussia and China in 2017.Clauses on cross-border access to personal data, for example in cloud services (e-evidence), extradition procedures, mutual legal assistance and the liability of service providers were contested right up to the end. An unusual alliance of civil rights activists and large technology companies complained during the week that the scope of application was far too broad. The result was a "surveillance treaty" that could be used for repressive purposes.

According to the final draft, acceding states must criminalize, for example, intended unauthorized access to or unlawful interference with an information and communication system. This also applies to processes that damage, delete, deteriorate, change or suppress electronic data. Furthermore, "obtaining, manufacturing, selling, procuring for use, importing, distributing or otherwise making available" so-called hacking tools is to become punishable. This refers, for example, to devices including programs that were "developed or adapted primarily for the purpose of committing" one of the crimes covered, as well as passwords, access data, an electronic signature or similar data that can be used to access a system.

The mere possession of a hacking tool or access criterion intending to using it to commit one of the offences is to be criminalized under Article 11. In Germany, the hacking paragraphs repeatedly lead to bizarre decisions in this area,for example when judges consider the use of plain text passwords to be a criminal offense. It would also be a punishable offense to hold up or disseminate real or simulated images of child sexual abuse, to stalk children via communication systems (cyber-grooming) or to share non-consensual intimate images (revenge porn). Exceptions can only apply to nude photos that children have taken of themselves. According to the agreement, serious offenses are punishable by at least four years in prison. It must be possible to hold legal persons accountable for their involvement.

Help with real-time monitoring is mandatory

The police are to be allowed to use a wide range of surveillance tools to apprehend offenders. For example, powers are provided for the real-time recording of connection and location data, their "accelerated storage and partial disclosure", including other electronic data such as content or user IDs such as IP addresses and the interception of communication content. Part of the mutual legal assistance provisions is the requirement that participating states can order "the immediate preservation of electronic data" stored on a system located in the territory of the other contracting state. Mutual assistance is also required, for example, "in the real-time collection of traffic data" and the interception of content.

In mid-July, 22 civil society organizations appealed to the EU to remedy the numerous remaining shortcomings in the project. They warned against legitimizing "abusive practices by governments" to spy on citizens and online censorship. Over the course of the week, institutions such as Human Rights Watch and Privacy International reiterated their concerns, which were essentially shared by the UN High Commissioner for Human Rights, Volker Türk. Participants in the Cybersecurity Tech Accord, to which over 100 tech companies such as Microsoft and Meta belong, regretted the adoption on Thursday. Wherever the convention is implemented, damage "to the digital environment in general and human rights in particular" is to be expected. Russia and Iran complained that the treaty was now "oversaturated with human rights guarantees". The convention now goes to the UN General Assembly, where its adoption is considered a formality. It will enter into force as soon as it has been ratified by 40 member states.

(vbr)