United Nations Convention against Cybercrime

A Global Accord on Cybercrime: Progress, Pitfalls, and Prospects

On October 28, 2025, 72 nations signed the United Nations Convention against Cybercrime in Hanoi, marking a watershed moment in the global fight against online criminality. With cybercrime costs projected to reach $10.5 trillion annually by this year, the numbers alone underscore the urgency of this treaty. But is this landmark agreement structured to bridge the enforcement gaps or merely to create another layer of multilateral bureaucracy? The answer lies in the fine print—and the broader geopolitics of cybersecurity policy.

The Institutional Architecture of the Treaty

At its core, the UN Cybercrime Convention aspires to build a unified global response to an increasingly fragmented and borderless problem. Adopted in 2024 after five years of often contentious negotiations, its provisions are compelling. It does what only a handful of instruments have done before: provides a legally binding framework to criminalise a wide swath of cyber-dependent and cyber-enabled activities, from hacking and ransomware to child exploitation. Upon receiving 40 ratifications, the treaty will enter into force after 90 days, kicking off the formation of the Conference of the States Parties. This body, supported by the United Nations Office on Drugs and Crime (UNODC), is tasked with ensuring periodic evaluation and the scaling up of international cooperation mechanisms.

Significantly, the treaty mandates a 24/7 cooperation network among States, aimed at expediting the sharing of electronic evidence across borders. For countries without robust cybercrime laws—or adequate investigative capacities—this technical assistance could be transformative. It also criminalises the non-consensual dissemination of intimate images, a long-overdue recognition of the unique harms inflicted on victims of online abuse. No previous treaty, not even the Budapest Convention, included such targeted protections for women and girls.

The Policy Depth: What the Treaty Addresses—and What It Doesn’t

On paper, the new treaty promises much. By criminalising cyber-dependent crimes like unauthorised data access and interference, and cyber-enabled crimes such as online fraud and child exploitation, its scope appears exhaustive. Yet gaps remain in its operationalisation and conceptual clarity.

Consider the emphasis on real-time cooperation. While laudable, the actual enforcement hinges heavily on the willingness of individual states to share critical data. Countries already struggle to comply with such obligations under smaller frameworks like the Budapest Convention, where requests for mutual legal assistance often languish in bureaucratic inertia. Can developing nations facing resource constraints realistically fulfill the proactive obligations the new treaty demands?

The financing question remains equally critical. Unlike treaties that come with earmarked funding channels—for instance, the Green Climate Fund under the Paris Agreement—this convention does not specify a budgetary mechanism to assist poorer nations in building cybercrime-fighting infrastructure. Will the UNODC's secretariat mobilise adequate resources to deliver the promised capacity-building measures, or will this treaty replicate the North-South tensions seen in other global frameworks?

Furthermore, while the treaty criminalises evolved forms of harm, such as non-consensual dissemination of intimate images, it misses a critical dimension: defining the guardrails for state surveillance linked to enforcement. With surveillance abuses rampant across many authoritarian regimes, the fear of calls for "cooperation" being misused to stifle dissent remains potent.

The US, China and the Geopolitics of Cyber Treaties

The new convention also invites uncomfortable questions about geopolitical alignment. Unlike the widely endorsed Budapest Convention on Cybercrime, which operates under the auspices of the Council of Europe, this UN treaty emerges at a time when longstanding power blocs are splintering. Notably, the absence of the United States among initial signatories is a critical fault line. The US-backed Budapest framework remains closer to the liberal democratic ethos, emphasising individual rights alongside policing cybercrimes.

China, for its part, has signed the new treaty, likely seeing an opportunity to shape the global normative consensus around internet governance in the direction of its techno-authoritarian model. As the only major country with explicit provisions to enforce online sovereignty, Beijing’s participation signals a diplomatic shift but also raises concerns. Will countries adopting China’s restrictive model of dealing with digital dissent exploit the convention's provisions under the guise of prosecuting "cybercrime"? The lack of clear, enforceable safeguards may allow political misuse of the treaty’s cooperation mechanisms.

Structural Weaknesses: Centre-Stage Budgetary and Coordination Gaps

The promise of a universal agreement is inherently attractive, but its operationalisation illuminates significant structural tensions. First is the enduring gap between technical aspiration and capacity realities. While wealthy nations with sophisticated digital infrastructures may immediately adapt to the treaty, countries in the Global South—those it purports to empower—may lack the necessary technical capabilities. This is particularly true for sub-Saharan African nations and small island states, where law enforcement initiatives against cybercrime remain rudimentary.

Closer to home, India too faces unique challenges. Despite its IT prowess, the Ministry of Home Affairs continues to grapple with severe staff shortages in its Indian Cyber Crime Coordination Centre (I4C). The creation of yet another global framework could compound rather than ease these administrative burdens. Moreover, negotiating the treaty’s interface with national capacities remains critical. Legal conflicts with India’s Information Technology Act, 2000—particularly around jurisdiction-specific interpretations—are inevitable.

Ironically, the treaty risks deepening inequities in a sphere already marked by uneven playing fields. Without binding commitments for resource transfers or special dispensations for infrastructure deficits, wealthier states might benefit more from the 24/7 cooperation network, entrenching the digital divide further. The absence of mandatory reporting mechanisms to track progress among member nations exacerbates this governance gap.

What Can Be Learnt from Australia?

One country that has managed to strike a balance between tough enforcement and safeguarding privacy is Australia. Its eSafety Commissioner’s Office has pioneered real-time mechanisms to tackle cyber-enabled harm like intimate image abuse through rapid takedown orders. Crucially, victim-centred protections are integrated across its cyber laws, ensuring accountability without overreach. Unlike the one-size-fits-all solutions emerging under the UN framework, Australia’s modular approach tailored to distinct digital harms could provide useful lessons. However, replicating such models will require political will and significant investments that many signatory countries currently lack.

The Metrics of Success: Where the Focus Should Be

For this treaty to succeed, the focus should go beyond paper commitments. Real success would entail measurable reductions in transnational crimes like ransomware attacks and online exploitation, particularly when reported by low-income nations. Much depends on the conference of state parties, which must not devolve into yet another underfunded, politically divided forum. Transparency mechanisms and cross-border accountability protocols need to emerge early.

Ultimately, what goes underreported in the global coverage of cybercrime is the unequal capacity of states to fight it. If the treaty merely entrenches existing asymmetries, then it will have failed its most important stakeholders—citizens of vulnerable nations—and not just their governments.

Practice Questions for UPSC

Prelims Practice Questions

Frequently Asked Questions