Signed but Not in Force: The UN Cybercrime Convention One Year after Hanoi

The United Nations Convention against Cybercrime, the first global treaty on the subject, opened for signature in Hanoi on 25 October 2025. One year on, it has 96 signatories but only three parties, against the 40 needed for entry into force. Talks on the rules for its future Conference of the States Parties ended without consensus in January 2026, and a mandated negotiation on a supplementary protocol is due to begin in January 2027 amid open disagreement about whether one is needed. This paper sets out what the treaty does, how far ratification has progressed and the issues that will shape its first years.

Key points

• The General Assembly adopted the Convention on 24 December 2024 in resolution 79/243; it enters into force 90 days after the 40th instrument of ratification, acceptance, approval or accession [1].
• As at 31 October 2026 the depositary recorded 96 signatories and three parties: Qatar, Azerbaijan and Viet Nam [2].
• Seventy-one States and the European Union signed at the Hanoi ceremony; a further 14 signatures are dated September 2026, the largest monthly total since then [2; 3].
• The Ad Hoc Committee failed to reach consensus on draft rules of procedure for the future Conference of the States Parties in January 2026 [4].
• A first session to negotiate a supplementary protocol is scheduled for 18–29 January 2027; the United States and the European Union have questioned whether a protocol is needed, while Russia has tabled a draft with 16 further categories of offence [5; 6; 7; 8].

1. The treaty and its purpose

The Convention is the product of an ad hoc committee process the General Assembly launched in 2019 [1].

The treaty does three main things. First, it requires each State Party to criminalise a set of offences, including illegal access to and interception of systems and data, interference with data and systems, online child sexual abuse material, grooming and the non-consensual dissemination of intimate images [1].

Second, it requires States Parties to create procedural powers such as expedited preservation of stored data, production orders, search and seizure, and real-time collection and interception of data [1]. These powers apply not only to the Convention's own offences but also to other crimes committed by means of an information and communications technology system and to "the collection of evidence in electronic form of any criminal offence" (Article 23) [1].

Third, it creates a framework for international cooperation, including the sharing of electronic evidence of "any serious crime" (Article 35), defined as conduct punishable by a maximum deprivation of liberty of at least four years, and a 24/7 network of national contact points (Article 41) [1].

Safeguards are set out in two places. Article 6 requires implementation to be consistent with international human rights law and states that nothing in the Convention permits the suppression of human rights or fundamental freedoms. Article 24 requires the procedural powers to be subject to conditions and safeguards under domestic law, incorporating the principle of proportionality and, "as appropriate", judicial or other independent review [1].

2. The evidence

Signature. The Convention opened for signature at a ceremony in Hanoi on 25–26 October 2025, where, according to the UN Office of Legal Affairs, 71 States and the European Union signed. The depositary's status table, as at 31 October 2026, lists 96 signatories [2]. Between the ceremony and the end of August 2026, nine more signatures were deposited; 14 are dated September 2026 and one, Montenegro, October 2026 [2]. Signature remains open at UN Headquarters until 31 December 2026; states that have not signed by then can still join by accession [1].

Ratification. Only three states have become parties: Qatar (4 February 2026), Azerbaijan (15 April 2026) and Viet Nam (17 April 2026) [2]. Azerbaijan made reservations and a declaration on ratification [2]. No ratification has been deposited since April 2026 [2]. Under Article 65, a European Union instrument would not count as additional to those of its member States [1].

Who has signed. The signatories include China, the Russian Federation, France, the United Kingdom and Saudi Arabia, as well as Brazil, India and South Africa [2]. Several large economies do not appear on the depositary list as at 31 October 2026, including the United States, Japan, Italy and Mexico [2]. In a September 2026 submission, the European Union stated that it and 16 of its 27 member States had signed [6].

Rules for the future conference. Resolution 79/243 asked the Ad Hoc Committee to prepare draft rules of procedure for the Conference of the States Parties [1]. At its session of 26–30 January 2026, attended by 122 Member States, views remained divided on several draft rules, including those on the scope of the rules and on observers (draft rules 2 and 15 to 17). After ten meetings, "no consensus was reached" on the Chair's text, and the Chair noted "the failure to reach consensus" [4]. The annexed Chair's proposal would have the Conference meet at least every two years [4].

A protocol before entry into force. The same resolution mandated two ten-day sessions to negotiate a supplementary protocol "addressing, inter alia, additional criminal offences" [1]. The first is scheduled for 18–29 January 2027 [5]. Written submissions show a divide over the threshold question:

• The United States "rejects the premise" of the Chair's request for inputs on a protocol's scope, calling the exercise "premature and fundamentally flawed" and stating that there is "no identified gap or demonstrated need" [7].
• The European Union and its member States say that "the appropriateness of a protocol … has not been demonstrated" and call for a needs assessment and gap analysis first; they also share the Chair's view that consensus on the rules of procedure should come first [6].
• The Russian Federation has circulated a full draft protocol whose articles 4 to 19 would add offences relating to terrorism, extremism, organising mass disorders, the "rehabilitation of Nazism", arms trafficking, critical information infrastructure and the use of artificial intelligence, among others [8].

Under Article 62, any protocol requires at least 60 States Parties before the Conference can consider it for adoption, and a two-thirds majority vote as a last resort if consensus fails [1].

Human rights criticism. A coalition of organisations including Human Rights Watch urged states before the Hanoi ceremony to "refrain from signing and ratifying" the treaty. It argued that the obligation to share evidence for any serious crime could reach conduct protected by human rights law, and that the procedural safeguards are weak [9]. Human Rights Watch later argued that the best way to prevent harm would be for states not to ratify, but urged those that do to make reservations, to condition cooperation on dual criminality, to avoid cooperation likely to facilitate abuses and to publish statistics on requests received and refused [10]. The Secretary-General, by contrast, has called the treaty "a clear pathway for investigators and prosecutors", and UNODC says it aims to improve cooperation while safeguarding fundamental human rights [3].

3. Analysis

The following assessments are Meridian analysis based on the evidence above.

First, signature has outpaced commitment. Ninety-six signatories show broad political support, but three ratifications in twelve months, and none since April [2], suggest that the domestic legislative work the treaty demands, including new procedural powers and safeguards, is the real bottleneck.

Second, the 31 December 2026 signature deadline does not change the arithmetic. States that miss it can still accede [1]; reaching 40 parties depends on parliaments, not ceremonies.

Third, the institutional order is inverted. The Committee has not agreed the rules for a conference that does not yet exist [4], while the protocol talks are fixed for January 2027 [5]. The Russian draft shows how far some states would extend the treaty's criminal scope [8]. A protocol that widens the list of offences could deepen the human rights concerns raised by critics [9; 10].

Fourth, implementation choices will decide the treaty's character. Because Article 24 leaves safeguards largely to domestic law [1], how the first parties legislate, and whether they publish data on requests [10], will shape whether the treaty is seen as a cooperation tool or a risk to rights.

4. Assessment

• Entry into force before the end of 2027 would require 37 further instruments by early October 2027; on the pace so far, that looks unlikely, although a cluster of ratifications could change the outlook [1; 2].
• The January 2027 session is the next major test: whether it opens text-based protocol negotiations or a needs assessment will show which coalition has the upper hand [5; 6; 7; 8].
• Indicators to watch: late signatures before 31 December 2026; ratifications by major signatories; progress on the rules of procedure; and implementing laws with explicit human rights safeguards.

References

1. United Nations General Assembly, Resolution 79/243, "United Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes", A/RES/79/243, 24 December 2024. https://docs.un.org/en/A/RES/79/243 (accessed 1 November 2026).
2. United Nations Treaty Collection, Chapter XVIII.16, status of the United Nations Convention against Cybercrime, as at 31 October 2026. https://treaties.un.org/pages/ViewDetails.aspx?chapter=18&clang=_en&mtdsg_no=XVIII-16&src=TREATY (accessed 1 November 2026).
3. United Nations Office of Legal Affairs, "The United Nations Convention against Cybercrime opens for signature in Hanoi"; and UNODC, "Seventy-two nations sign first UN treaty to fight cybercrime, in milestone for digital cooperation" (originally published by UN News), October 2025. https://www.un.org/ola/en/news/united-nations-convention-against-cybercrime-opens-signature-hanoi and https://www.unodc.org/unodc/en/frontpage/2025/October/seventy-two-nations-sign-first-un-treaty-to-fight-cybercrime--in-milestone-for-digital-cooperation.html (accessed 1 November 2026).
4. Ad Hoc Committee, "Report … on its session to prepare the draft text of the rules of procedure for the Conference of the States Parties to the United Nations Convention against Cybercrime", A/AC.291/31, 13 February 2026. https://docs.un.org/en/A/AC.291/31 (accessed 1 November 2026).
5. UNODC, "First session to negotiate a draft protocol supplementary to the United Nations Convention against Cybercrime", Vienna, 18–29 January 2027. https://www.unodc.org/unodc/en/cybercrime/ad_hoc_committee/protocol/1st-session.html (accessed 1 November 2026).
6. European Union and its Member States, "Preliminary contribution … on a possible draft protocol supplementary to the United Nations Convention against Cybercrime", status 18 September 2026. https://www.unodc.org/documents/Cybercrime/AdHocCommittee/Protocol/1st_session/EU_17092026.pdf (accessed 1 November 2026).
7. United States of America, written input on a draft protocol supplementary to the United Nations Convention against Cybercrime, 18 May 2026. https://www.unodc.org/documents/Cybercrime/AdHocCommittee/Protocol/1st_session/1st_inputs/USA_2026.0518.pdf (accessed 1 November 2026).
8. Russian Federation, draft Supplementary Protocol to the United Nations Convention against Cybercrime (unofficial translation, draft of 22 May 2026), submitted 24 June 2026. https://www.unodc.org/documents/Cybercrime/AdHocCommittee/Protocol/1st_session/Russian_Federation_ENG_24_June_2026.pdf (accessed 1 November 2026).
9. Human Rights Watch and others, "Joint Statement on the Signing of the UN Convention on Cybercrime", 24 October 2025. https://www.hrw.org/news/2025/10/24/joint-statement-on-the-signing-of-the-un-convention-on-cybercrime (accessed 1 November 2026).
10. Human Rights Watch, "Next Steps for Mitigating Harm in the UN Cybercrime Convention", 4 November 2025. https://www.hrw.org/news/2025/11/04/next-steps-for-mitigating-harm-in-the-un-cybercrime-convention (accessed 1 November 2026).