Late last year, the United Kingdom, France, China, Iran, Saudi Arabia and dozens more nations signed the United Nations Convention Against Cybercrime, a treaty ostensibly intended to improve global cooperation to fight crimes taking place over computer systems. Canada joined them this summer. The United States remains a notable exception and says it is still reviewing the treaty.
Three nations have since ratified it, and the treaty will enter into force 90 days after 40 states do so. As FIRE has long warned, the treaty opens the door to greater violations of free expression online — and new cybercrime bills popping up around the world show why.
What does the cybercrime treaty say?
The treaty purports to improve international cooperation in addressing crimes taking place using computer systems — but cooperation is not limited to specific online criminal acts like fraud or phishing. Instead, the treaty pushes nations to share personal data that other nations request about individuals accused of committing “serious” crimes.
But there’s an important question here. What constitutes a “serious” crime? The treaty does little to define it other than clarifying that it’s a crime carrying at least a four-year prison sentence as a punishment. For billions of people around the world, speech is a crime that warrants a long prison term.
The treaty also would command nations to adopt legislation and measures “as may be necessary to oblige a service provider to keep confidential” the execution of government searches for user data. Even more concerning, a nation seeking data from other countries can request that the user under surveillance not be notified and “may require that the requested State Party keep confidential the fact and substance of the request.”
As I wrote previously about the treaty:
The likely outcome here is obvious: The treaty will streamline unfree countries’ involvement with other unfree countries’ repression and pressure freer ones into helping, too. And it can all take place confidentially, without the knowledge of the public or even those being targeted . . .
And as though existing national laws punishing political expression aren’t enough, the treaty could even incentivize governments to enact harsher penalties on expressive acts. After all, if you’d like other nations to assist you in punishing your critics on the internet, you’ll want to ensure their expression qualifies for inclusion under the treaty’s definition of “serious crimes.”
How is ‘cybercrime’ legislation evolving?
A review of cybercrime legislation that has emerged in the wake of the treaty suggests that the free speech problems surrounding online “crime” and the UN treaty are just beginning. Take three bills, one of which has been passed by the Malaysian Parliament, under review by legislators this year in countries which signed on to the treaty. When reading the below, keep in mind that the UN treaty defines “serious” crime as that which is punishable by four or more years in prison.
First, Malaysia’s Cybercrimes Bill 2026. Article 19 criticized a number of the bill’s problems, including a lack of procedural safeguards for privacy and other issues, and some provisions that directly target content. The bill criminalizes content “generated or manipulated” by computer systems and “resembling an existing person, object, place, entity or event that falsely appears to a person to be authentic or truthful” with the intent to violate any other existing laws. This new offense is punishable by up to seven years in prison and, as Article 19 points out, runs the risk of targeting “satire, artistic works, journalism, or comments critical of the government.” The group also warns that the bill’s section on “intimate” imagery is written so broadly as to essentially punish any pornographic imagery made or transmitted using computer systems with up to five years in prison.
Next, let’s look at Namibia’s Cybercrime Bill 2026, the draft of which is still being finalized. In its current form, the bill threatens the vague offense of “cyberbullying” with 10 years’ imprisonment. “Failure to moderate undesirable content” — which includes material that “promotes racism” or is “inaccurate” and intended to “mislead the public” — is punishable with up to five years. Use of computer systems to publish pornography deemed “lascivious or obscene” can net up to 15 years.
Universities’ double failure on antisemitism and free speech
Max Friedman is a rising third-year law student at the University of Memphis. This is the second entry in a series on antisemitism and speech-restrictive policies. See also the first entry about a play about Jewish lesbians.
And then there’s China’s Draft Law on Cybercrime Prevention and Control, which was published for comment earlier this year but is not yet enacted. Readers are unlikely to be surprised that it seeks to further entrench China’s authoritarianism online. Read Human Rights Watch’s analysis for a full breakdown, but here’s just a glimpse: The bill targets so-called offenses like “disrupting online order,” harming “national security” and “public interest,” “disrupting the real-name management system,” and “disseminating false information.”
While South Sudan and Iraq have not yet signed the treaty, they may yet in the future — and they, too, just unveiled troubling new cybercrime laws.
South Sudan’s newly enacted Cybercrimes and Computer Misuse Act, 2026 punishes publication of “false or misleading” information that damages a person’s reputation with up to five years in prison, and a similar sentence can be doled out to administrators or intermediaries who don’t take “reasonable steps to restrict or remove access to unlawful content.” And Iraq is reviewing a cybercrime bill that would, among other things, dole out harsh punishments to those who publish what authorities deem “misinformation.”
What does this mean for the future of online expression?
There are, no doubt, serious transnational crimes taking place on the internet that require international cooperation. And there are ways we can improve cross-border collaboration to fight actual crime. But this treaty risks emboldening states that already seek to crush out online dissent, giving them more tools to do so, and enlisting freer states in this campaign.
And, perhaps most concerningly, this treaty may exacerbate what is already a uniquely dangerous era for free speech online. Every day it seems nations are pursuing new limitations on people’s ability to express themselves online, passing privacy-threatening age-gating restrictions, and seeking to gut government critics’ ability to speak anonymously. It’s more urgent than ever that democratic nations seek to reverse this corrosive trend rather than deepen it.
In general, I think your take is correct: this is a treaty that allows for authoritarians to increase their power over individuals, including by potentially limiting speech.
But that doesn't mean there isn't genuine demand for this treaty. 79 States voted in favor of Resolution 74/247, which started the drafting process, and the UNGA adopted the convention itself through consensus.
The challenge is how can international cyber crime be curtailed in a rights-respecting manner? Unfortunately, rights-respecting countries couldn't come up with an answer fast enough, and now we have this convention.
While it's not yet in force, it has dozens of signatories, including from non-authoritarian countries. Almost certainly this will come into force, and a new tool that could be used to restrict individual rights will come with it.
Some countries take a restrictive view of free expression and may criminalize speech in ways that would not be permissible in the United States. A country might define crimes in its domestic law that impinge on free speech as understood in rights-respecting legal systems. But that approach has no legal basis in the Convention, and the Convention does not require other countries to cooperate in enforcing laws that violate free-expression rights. Therefore, it is mistaken to claim that the Convention’s cooperation tools for “serious crime” invite domestic laws that criminalize free speech or enable abusive international cooperation requests.
A similar, broader serious-crime provision already exists in the United Nations Convention against Transnational Organized Crime (UNTOC). Countries have years of experience handling evidence requests under UNTOC across a wide range of lawful and legitimate criminal investigations. Unlike UNTOC, the Cybercrime Convention’s serious-crime provision is limited to obtaining and sharing properly predicated electronic evidence. Today, electronic evidence is often generated by criminal conduct that is not fairly described as “cybercrime,” and that evidence may be located anywhere in the world. Without a mechanism for requesting international assistance to obtain electronic evidence, the Convention would be significantly weakened as a practical treaty for investigators and prosecutors.
Importantly, nothing in the Convention requires a country to provide cooperation where the conduct under investigation is not a crime under its own law; the request fails necessity or proportionality standards; or the request does not satisfy applicable human rights protections. The Convention also preserves legal safeguards—including dual criminality checks, human-rights refusals, and public policy exceptions—that rights-respecting countries can use to reject foreign investigations that violate civil liberties, including free speech.