Cybersecurity Policy Report, U.S. Should Vote for UN Cyber Crime Treaty, Lead Negotiator Says, (Oct 4, 2024)
The lead U.S. negotiator for the United Nations’ cyber crime treaty supports the U.S. voting for the treaty despite lingering concerns that autocratic nations might misuse the treaty in ways that could undermine personal privacy, civil rights, or the ability of cybersecurity practitioners to do their jobs.
The U.N.’s Ad Hoc Committee to Elaborate a Comprehensive International Convention on Countering the Use of Information and Communications Technologies for Criminal Purposes reached consensus in August on treaty language (CPR, Aug. 12).
Deborah McCarthy, the State Department’s lead negotiator for the treaty, said the final product was imperfect but better than it might have been if the U.S. hadn’t stood firm with its allies against proposals supported by Russia and China.
“We got an agreement that’s pretty narrow and a [suitable] list of cyber crimes—mostly cyber-dependent, some cyber-enabled—particularly child sexual abuse material and the exploitation of children online, which I think is a big win. And we got an agreement that has enhanced human rights protections,” Ms. McCarthy said today during an event hosted by the Center for Strategic and International Studies.
She noted that the U.N. process was started by Russia and other nations unhappy with an existing cyber crime treaty, the Budapest Convention. The U.S. was against starting the U.N. process, but it took charge of the negotiations, Ms. McCarthy indicated.
“We took over the conductor slot of the train. We added safety valves to the engine. We were strategic in adding components to the engine, and we got a lot of cars attached to the train,” she said.
“The original draft put forward by Russia and China was very, very different” from the final product, she said, and when the talks ended Russia complained that the “U.S. undercut us at every corner.”
Now the treaty will be considered by the U.N. General Assembly’s Social, Humanitarian, and Cultural Committee, which begins meeting next week. The cyber crime treaty needs 40 committee votes to become official, after which individual nations will decide whether to adopt it.
The best path forward for the U.S. is to vote for the treaty in committee and follow up by expressing any concerns it has and seeking to add additional protocols to strengthen the treaty’s protections of privacy and human rights, Ms. McCarthy said.
“The train has left the station, and the train will go without us,” she said. “If we’re not on it ... the Russians and Chinese are going to take the protocol mechanism and try to mold the system, which they were unable to do this time, into their own image, so to speak, and we won’t be there.”
“There would be a huge disappointment” among smaller countries that could benefit from U.S. involvement “if all of a sudden the U.S. were to say we’re not part of this,” she added.
She suggested the treaty was not as bad as some privacy and civil rights advocates claim. “There’s some myths as to what was put in the instrument, and there’s some very legitimate concerns. One of the myths is that somehow we’ve negotiated a global surveillance treaty. There’s absolutely no provision that permits mass collection or sharing of data.”
The U.S. had hoped to add language protecting certain cybersecurity practices, such as network penetration testing, in which “white hat” hackers try to bypass network security controls, she said.
But of all the nations in the world, only Belgium actually has a law that exempts penetration testing from computer hacking laws, Ms. McCarthy explained.
“How could we impose in a treaty a law that doesn’t exist?” she asked. Penetration testing can be protected in the treaty through the addition of post-approval protocols, she suggested.
Another panelist at the CSIS event, Chris Painter, former cybersecurity coordinator at the State Department, agreed with Ms. McCarthy that the U.S. should vote to advance the treaty.
Voting against it would be a “dangerous tactic” and would allow Russia and China to steer the process toward their preferred outcomes, Mr. Painter said.
Russia wanted the treaty to cover “content crimes” and “every crime you can imagine, including crimes we wouldn’t consider crimes, like criticizing the state,” he noted.
“That was successfully defeated,” he said. “It’s clear that the Russians did not get what they wanted in this treaty. The Chinese didn’t get what they wanted. The Syrians, Cubans, Nicaraguans—name who you want in that club—did not get what they wanted.
“Russia is not giving up on this. They didn’t get what they wanted. But they want to get all that stuff in through the back door. They want to get this through an additional protocol,” he said, and the U.S. should remain engaged to assert its values.
But a different view was expressed by Jason Pielemeier, executive director at the Global Network Initiative, which, according to its website, advocates for “responsible company decision-making to promote and advance freedom of expression and privacy rights across the technology ecosystem.”
“My ultimate view and the view that my members take is that we should pump the brakes on this train,” Mr. Pielemeier said, meaning that the U.S. should abstain from voting one way or the other on the treaty.
“Abstaining doesn’t destroy diplomatic capital, but it sends a big signal that this is not something that we think everybody should automatically adopt without thinking it through,” he advised.
“The big issue now is what to do with this treaty. It’s much better than what was originally proposed and certainly avoided some of the pitfalls—some of the really problematic provisions that countries like Iran, Russia, and China advocated for,” he said.
“But it is a flawed treaty, and I think everyone would probably acknowledge that. There are risks involved with the U.N. blessing a cyber crime treaty that has very broad provisions whose safeguards are not as strong as they could be,” he added.
Mr. Pielemeier warned that autocratic states could pressure smaller nations and tech companies to provide electronic evidence to prosecute questionable cases involving civil rights advocates or journalists, citing the U.N. treaty as a legal justification.
“To be able to cite to language in a U.N. treaty makes it harder for companies to push back, makes it harder for civil society to push back against those misuses,” he said.
MainStory: TopStory InternationalLegislation FederalLegislation DataSecurity DataPrivacy