UN Convention Against
Cyber Crime

UN Convention against Cybercrime

It is the first global treaty under the United Nations specifically on cybercrime and cross-border electronic evidence.

Its full title is the United Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes.

Because the signing ceremony was held in Hanoi, it is often called the Hanoi Convention.

The start

Russia proposed a UN treaty in 2017. In December 2019 the General Assembly set up an Ad Hoc Committee (Resolution 74/247). Negotiations ran for several years and involved more than 150 states plus businesses, NGOs, and academics. The General Assembly adopted the text by consensus on 24 December 2024 (Resolution 79/243).

It opened for signature in Hanoi on 25–26 October 2025. It stays open for signature at UN Headquarters in New York until 31 December 2026. It enters into force 90 days after the 40th state deposits its instrument of ratification, acceptance, approval, or accession. Signature alone is not binding; ratification is.

By the Hanoi ceremony, roughly 70 states plus the European Union had signed, including Russia, China, the EU, and the United States. Later counts put signatures in the 70–80 range.

As of mid-2026 only a handful of states (including Vietnam, Qatar, and Azerbaijan) had ratified it, so it is not yet in force. India took part in the negotiations and shaped language on data-transfer sovereignty, but has not signed.

The UN Office on Drugs and Crime (UNODC) is the main secretariat body.

Brief Contents

It is both a criminal-law treaty and a cooperation treaty.

Criminal offences parties are expected to establish include:

• Cyber-dependent crimes: illegal access to a system, illegal interception, interference with data, interference with a system, and misuse of devices.

• Certain cyber-enabled crimes: computer-related fraud and forgery, online child sexual abuse and exploitation material, solicitation or grooming of a child, and non-consensual dissemination of intimate images. The last of these is new in a global treaty.

Procedural powers cover expedited preservation of data, production orders, search and seizure of stored data, and real-time collection of traffic data.

International cooperation includes mutual legal assistance, extradition, joint investigations, asset recovery, and a global 24/7 contact-point network. A major feature is a framework for collecting, preserving, and sharing electronic evidence not only for cybercrimes but for serious crimes more broadly. It also stresses technical assistance and capacity-building, especially for developing countries.

The text says implementation must respect state sovereignty and be consistent with international human rights obligations.

Budapest Convention

The main existing instrument is the 2001 Council of Europe Budapest Convention on Cybercrime, which many European, North American, and other states already use. It is not universal: Russia and China are not parties and long argued for a UN instrument instead. The UN convention overlaps with Budapest on core offences and investigative powers, but is meant to be global and goes further on capacity-building and on electronic evidence for serious crime generally. States can be parties to both.

Main criticisms

Human-rights groups, some academics, and technology companies argue that the investigative and evidence-sharing powers are broad while the safeguards are thin. Their concern is that “serious crime” cooperation could be used to obtain data on speech, journalism, protest, or other conduct that some states criminalise but international human rights law protects. Dual-criminality and human-rights conditions exist in the text, but critics say they are not strong enough to prevent abuse. Holding the signing ceremony in Vietnam also drew criticism because of that country’s record on online speech.

Supporters, including UNODC and many governments that signed, argue that cybercrime and online child exploitation are transnational, that many states have no common legal basis for cooperation, and that the treaty raises minimum standards and creates a practical channel for evidence and capacity-building.

The September 2026 BRICS New Delhi Declaration encouraged states to consider signing and ratifying it, in line with domestic law, so that it can enter into force. That endorsement does not itself bind any BRICS member.