UN anti-cybercrime treaty could make journalism a crime

In August, a little-known United Nations committee of 15 countries, formed at Russia’s urging, gathered in New York City to finish drafting the text of the first U.N. treaty on cybercrime. The treaty ostensibly strengthens the fight against ransomware schemes, data theft, cyber terrorism, and the like.

But in its current form, the treaty would also enable authoritarians around the globe to criminalize journalism.

That draft treaty, the “United Nations Convention against Cybercrime,” is now up for consideration and potential ratification by the General Assembly by the end of 2024. Critics argue that the vagueness of the treaty’s language, along with its deference to national laws — even laws that conflict with international human rights standards — creates a new vector for transnational repression, the growing practice of authoritarian states targeting their critics overseas.

The convention would have little consequence for people living in countries that uphold freedom of expression. But for independent journalists living in weak democracies and repressive environments, and even for those journalists working from political exile, the ratification of this treaty could prove devastating, especially with global press freedom already battered by over a decade of backsliding.

Press freedom groups such as the Committee to Project Journalists and the International Press Institute began sounding the alarm about the cybercrime convention over two years ago. Many civil society and human rights groups filed similar complaints. The U.N. Ad Hoc Committee in charge of shaping the treaty, however, failed to respond to the chorus of concerns, leaving the majority of problematic provisions in place. Following the release of the final text, an advisory committee to the intergovernmental Freedom Online Coalition released a statement saying that the treaty “represents a tectonic shift towards the digital authoritarian vision of power and control on the Internet.”

Indeed, Russia drafted the resolution calling for the treaty’s creation, drawing endorsements from fellow authoritarian states like Belarus, China, Nicaragua and Venezuela.

Unfortunately, this is not an isolated incident. The cybercrime convention is another example of how autocratic governments are finding new ways to curtail whatever bastions of freedom might remain on the internet and across borders for independent journalists and dissidents. Consider how suspected kleptocrats have engaged in “lawsuit tourism” to find the most friendly jurisdictions in which to file vexatious defamation suits against investigative journalists. Or how high-end commercial spyware like Pegasus, once only available to the world’s richest states, is now being found on journalists’ phones around the world.

The convention has been criticized for defining “cybercrime” too broadly, and for its deference to national laws, even where those might criminalize freedom of expression. Egypt provides a perfect illustration of the risk this poses.

The Egyptian government requires news sites to apply for a license, a practice which in itself constitutes a violation of international standards. Independent news organizations such as Mada Masr and Al-Manassa dutifully submitted their applications and annual renewals for licensing but never received a response from the government.

This licensing limbo provides an easy justification for harassment. In recent years, staff from both papers have been arrested, hauled in for interrogation and had their equipment seized after being charged with running a website without a license. Such a charge might not be so grave, except that under Egypt’s 2018 Anti-Cybercrime Bill, operating a website without a license also becomes a cybercrime merely because it involved the use of the internet, raising the seriousness of the offense.

“Egypt takes a lot of pride in a cybercrime law, but little is being said about how it’s being implemented,” Mada Masr’s editor-in-chief, Lina Attalah, said in a conversation earlier this year. “There is an international standard towards implementing such laws. But not enough on safeguards and how these laws can be applied to not become tools for repression.”

Critics also point to how the convention enables extradition-style data requests, including provisions to provide law enforcement agencies expanded access to information held by digital service providers such as the cloud systems upon which international investigative journalism networks depend.

When pro-democracy activist Andrei Pivovarov was released from a Russian prison in August as part of the U.S.-Russia prisoner swap, he claimed that his arrest three years prior was based on information handed to Russia by the Serbian authorities. The convention will make such cases more common by creating “a permission structure for smaller or less democratic countries (for instance Serbia or Thailand) to comply when Chinese or Russian authorities press them to ‘follow international law’ and assist their efforts,” according Jason Pielemeier, executive director of Global Network Initiative.

The draft cybercrime convention can still be rejected if fewer than 40 states are willing to ratify on the floor of the U.N. It could, albeit with great effort, still be amended to provide meaningful safeguards against cybercrime without criminalizing journalism. But for either of those outcomes, the convention would have to receive a great deal more attention.

Journalists, who are among those with the most to lose, can help by asking their governments to declare their stance on the draft treaty.

Nick Benequista is the senior director of the Center for International Media Assistance at the National Endowment for Democracy.