The United Nations Convention against Cybercrime is the first international treaty aimed at combating criminal acts committed online and at supporting victims of those crimes. At the initial signing ceremony on Oct. 25, 2025, U.N. Secretary General António Guterres said the convention was “a promise that fundamental human rights such as privacy, dignity and safety must be protected both offline and online.”

Civil society groups around the world, however, argue that the convention could make it easier for authoritarian governments to share information about people engaging in regular online activities. Because of vague language in the document, critics contend that governments would have the ability to criminalize legitimate online expression or other activities. Legal gray areas also heighten concerns for the protection of whistleblowers, activists, journalists, researchers and others who could be targeted by governments known to restrict civil and political rights.

Nations have until Dec. 31, 2026, to sign the convention. It will enter into force after 40 signatory states become parties to it by ratifying it at home. As of October 2026, 95 nations had signed the treaty, but only three have become parties to it.

When the convention was being drafted, the Biden administration signaled its support but acknowledged the concerns about potential misuse. The U.S. has not signed the agreement. The Trump administration has said it will continue to consider the convention. The administration has focused on promoting the United States’ own capabilities of combating cybercrime and has expressed concern about emboldening countries such as Russia and China to suppress freedom of expression and violate treaty obligations.

We are political scientists who study human rights and digital repression. Human rights organizations globally are worried that authoritarian regimes could use the convention to attack researchers, journalists, human rights advocates and people who criticize governments. A day before the convention was signed, 19 nongovernmental organizations released a joint statement urging nations to not sign or ratify the treaty. Groups such as Human Rights Watch, Freedom House, Access Now, Article 19 and others have warned that the convention’s human rights safeguards are inefficient. Weak protections risk further increases in transnational repression and global surveillance.

Verifying compliance is unclear

Every country has its own domestic law enforcement system. And while there is no international government to enforce U.N. treaties, U.N. conventions are designed to help fill this gap. They rely on cooperation among countries that have ratified an agreement by incorporating legal features to promote compliance.

When governments go through the ratification process, they adopt policies at home that reflect a treaty’s contents. But domestic interpretations of international laws often vary, which can lead to patchy protection of human rights. U.N. conventions on human rights also establish treaty bodies. They provide ways for independent experts to monitor human rights violations across all ratifying countries and to encourage more governments to join various conventions. These and other experts also participate in a process called the Universal Periodic Review, in which countries examine the human rights records of other countries every 4.5 years and provide recommendations for improvement.

Although the U.N. cybercrime convention says that human rights must be respected, it is ultimately not a human rights treaty. It falls under the U.N. Office of Drugs and Crime. Because of this, there is no treaty body to monitor violations, making abuses that fall outside of regular law enforcement activities even more difficult to track. Some examples include monitoring social media accounts of NGOs or activists, remotely installing spyware onto journalists’ cellphones and other devices, and using AI technologies against protesters and marginalized groups.

The convention does say that ratifying countries will meet periodically to improve cooperation and review implementation, but there are no stated goals about monitoring cybercrime or compliance with the convention. Another issue, which is present in all international laws, is treaty reservations, which allow governments to effectively ratify treaties while opting out of certain parts of them. The three countries that have ratified the convention as of October 2026 — Vietnam, Qatar and Azerbaijan — did not stipulate any reservations.

Infringing on human rights

Monitoring how governments comply with the cybercrime convention is critical to ensuring that governments do not infringe on human rights. International NGOs, domestic civil society organizations, journalists and other human rights defenders often work to scrutinize and share information on government abuses. Some governments see such work as a threat, and they often repress them.

There has also been a steady rise in governments repressing people outside of their borders. Many governments are doing this through surveillance, monitoring social media, doxxing, creating AI deepfakes and even forcibly repatriating critics in exile and imprisoning them.

Because the cybercrime convention promotes information sharing among ratifying countries, human rights organizations are concerned that governments with bad human rights records might use shared information and cooperation to arrest human rights defenders or anybody accused of what the governments label as a serious crime. The convention does not limit the use of these powers to the set of core cybercrimes it has defined, nor does it set a standard for what it considers to be a serious crime.

Instead, it allows countries to determine for themselves what constitutes a serious crime under domestic law. In many countries, this includes activities protected under international law, such as criticism of the government, peaceful protest, same-sex relationships, investigative journalism and whistleblowing. This puts vulnerable groups at risk. For example, in countries where it is illegal to share LGBTQ+ content online, a government could activate the surveillance measures outlined in the convention to track and target community members at home and abroad under the guise of enforcing domestic law.

Secretary General Guterres said at the signing ceremony that “in cyberspace, nobody is safe until everybody is safe.” As countries consider ratifying the convention, we believe it would be wise to consider whether the agreement falls short of keeping people safe in cyberspace, and whether it might put human rights defenders, journalists, researchers and others in danger.

The authors do not work for, consult, own shares in or receive funding from any company or organization that would benefit from this article, and have disclosed no relevant affiliations beyond their academic appointment.