US still backs UN cyber pact, but final approval awaits human rights safeguards

The United States will continue remaining in consensus with a forthcoming United Nations cybercrime treaty, but it won’t formally greenlight the convention until it sees adequate implementation of human rights controls by other countries endorsing it, senior administration officials said Sunday.

The pact has been in the works for years and has the potential to rethink how countries prosecute cybercriminals. But the treaty has become a lightning rod for debate among Western officials and human rights groups because it may empower foreign adversaries to abuse cross-border intelligence, cyber and surveillance policies for domestic repression.

The U.S. recently determined that it’s best to stick with the pact, arguing it has the potential to make improvements in international law enforcement cooperation against criminal hackers and help stop the spread of non-consensual intimate images, including child sexual abuse material, or CSAM.

A senior administration official, speaking on the condition of anonymity under White House press guidelines, said that U.S. support for the treaty is more likely to promote a rights-respecting approach to its implementation, but, ultimately, the U.S. is unlikely to formally ratify the treaty unless it sees other involved nations implementing human rights safeguards.

“The U.S. is planning additional engagements with stakeholders to determine how best to collaborate during the years of implementation of the convention to try to mitigate the risks and address identified examples of misuse of the convention,” the senior official said. 

Upcoming negotiations, including a call on Wednesday with the Commerce Department and human rights stakeholders, will provide an opportunity to reinforce human rights safeguards and implement measures to reduce the risk of misuse, the official added.

For months, law enforcement and national security officials have been debating whether the treaty should get U.S. approval, amid concerns the convention lays out broad definitions of cybercrime and surveillance without strong protections for individual users in their home nations. Some lawmakers, for instance, have argued that U.S. participation lends credibility to technology and surveillance policies promoted by authoritarian regimes like Russia or Iran.

At the heart of the pact is a commitment to cross-border data sharing to help prosecute cybercriminals. There would be immediate law enforcement and national security benefits, a second senior administration official said.

The convention would significantly broaden the scope of cooperation for prosecuting cyber crimes by creating a unified legal basis for all member countries, said the official. That means if both the United States and another country are part of the convention, they would have compatible laws allowing them to pursue criminal hackers more effectively. 

With enough countries joining, this expanded reach could include nations like Singapore, Egypt and Indonesia, extending the nexus of international cybercrime enforcement across a wider range of regions, the official said.

That network would enhance capabilities to go after people accused of creating and disseminating CSAM. It would also give the U.S. “grounds to criticize other nations’ conduct on a human rights basis” if they’re found to be misusing spyware, added the official. 

As for foreign adversaries, the U.S. and allies have their own assurances that they will still behave as expected. Nation-state adversaries — namely Russia, China, North Korea and Iran — are among the greatest purveyors of cybercrime activity, the Cybersecurity and Infrastructure Security Agency says.

“There are some countries, like Russia, that proceed with their authoritarian models, and we don’t think much will change,” said the first senior administration official. “They will operate the way they operate, whether this treaty is in place or not.”