UN Convention against Cybercrime: Ad Hoc Committee plans 1st negotiation session to draft additional protocol | #cybercrime | #infosec

The United Nations Ad Hoc Committee on Cybercrime that has elaborate the the United Nations Convention against Cybercrime, a comprehensive international convention on countering the use of information and communications technologies for criminal purposes, is preparing to negotiate its first additional protocol, as mandated by UN General Assembly resolution 79/243.

The first formal negotiation session is scheduled for 18–29 January 2027 in Vienna, with a second session planned for 2028. The process follows the adoption of the Convention by the UN General Assembly in December 2024 and reflects the compromise that enabled its adoption by consensus: states agreed to continue negotiations on a supplementary instrument that could address additional criminal offences.

The UN Convention has established a global framework for international cooperation against cybercrime and for obtaining and sharing electronic evidence in criminal investigations and proceedings. Its provisions are intended to facilitate cooperation between states, including where existing bilateral or regional arrangements do not provide a sufficient legal basis.

The protocol negotiations will take place as countries begin considering the Convention’s implementation and ratification. The supplementary protocol is expected to consider additional criminal offences, but its eventual scope and content have not yet been determined. The central challenge will be to determine which additional forms of conduct should be covered by this international criminal-law instrument and how precisely those offences should be defined.

Cybercrime investigations increasingly intersect with fraud, organised crime, trafficking and other offences committed through or facilitated by digital systems. Yet extending criminalisation to a wider range of conduct raises questions about legal certainty, the relationship between cyber-dependent and cyber-enabled crimes, and differences between national criminal-law systems.

Broad or ambiguous definitions could create risks for freedom of expression, privacy and other fundamental rights, particularly where offences relate to online content or politically sensitive activity. The protocol’s legitimacy will therefore depend not only on whether it improves cooperation, but also on whether its provisions are sufficiently precise, proportionate and consistent with international human-rights obligations.

In September 2026, Russia advocated expanding the Convention’s criminalisation scope to cover certain offences involving the use of information and communications technologies for terrorist or extremist purposes and trafficking in drugs, weapons and people. Such proposals illustrate the wider questions that may arise during the negotiations, although they should not be treated as agreed negotiating outcomes.

International cooperation will be another critical issue. The relationship between United Nations Convention against Cybercrime and the Convention on Cybercrime of the Council of Europe, commonly known as the Budapest Convention, will be particularly relevant to discussions about the coherence of international cooperation frameworks. A supplementary protocol could help states address gaps in cross-border investigations, but its practical value will depend on the degree of agreement reached, the compatibility of its provisions with existing instruments (including Budapest Convention on Cybercrime), and the ability of national authorities to implement them.

States will also need to consider how new obligations interact with domestic procedural safeguards, data-protection rules and requirements governing access to electronic evidence. The negotiation process is therefore both a legal exercise and a test of whether states can reconcile different approaches to criminal justice, sovereignty and fundamental rights.

Why does it matter?

The negotiations provide an opportunity to follow the evolution of global cybercrime governance beyond the adoption of the Convention itself. The additional protocol could influence how states define offences involving digital technologies and how their authorities cooperate across borders. Its development will also expose enduring tensions between effective law enforcement and the protection of human rights, as well as between the ambition to establish common international rules and the diversity of national legal systems.

The key question is whether the protocol can strengthen cooperation against transnational crime without producing overly broad criminal offences or weakening safeguards for individuals. Its eventual impact will depend on the text negotiated, the states that accept it, and how its provisions are implemented in practice.