Russia asked the UN for a treaty against ‘extremism,’ ‘subversion,’ and ‘discrediting the authorities.’ Instead, it got one that covers hacking and fraud.

By the end of 2026, a major new international treaty will be submitted to the State Duma for ratification: the United Nations Convention against Cybercrime. Russia does not agree with every provision in the document — even though Russia was the one that initiated it. So the convention will be ratified with reservations. How substantial those reservations will be, we don’t yet know.

It creates a single framework for international cooperation against crime on the internet. The treaty gives investigators in one country a legal way to obtain help from their counterparts abroad with:

To make sure evidence can be collected and preserved, every state that ratifies the convention must develop the capacity to intercept internet traffic in real time itself and store it for at least 90 days. Or hand that job to someone else — internet service providers, for example.

It does sound a lot like it.

But the new convention does not oblige countries to intercept and store every citizen’s internet traffic. They only have to be able to help their foreign counterparts with individual requests — such as setting up surveillance of a particular user.

They were. Back in 2001, the Convention on Cybercrime — also known as the Council of Europe’s Budapest Convention — was adopted. Formally it’s a regional treaty, but 82 countries around the world have joined it. Besides European countries, they include the United States, Canada, Israel, Brazil, Nigeria, the Philippines, and many others.

Russia took part in the preparation of the Budapest Convention but became the only Council of Europe member that never signed it. Alexander Seger, the former executive secretary of the Council of Europe’s committee on the Budapest Convention, has maintained that formally this happened because of a misreading of one of the treaty’s articles. Russia’s representatives concluded that it infringed on the country’s sovereignty.

In the end, Russia drew up a convention of its own to replace that one — and proposed it as the basis for a global UN convention.

Yes. The document was first announced 10 years ago, in July 2016, at an international forum for the heads of security and intelligence agencies. It was held in St. Petersburg under the auspices of the FSB. Here is how the Russian security service described the event:

Note the name of that draft. Russia itself would later object to exactly this wording.

Cybercrime is a fairly narrow term, one that limits the document’s reach to going after hackers. Russia’s goal from the start was different: to cover as many crimes as possible that had any connection at all to the internet. The scope of the original 2017 draft, for instance, extended even to administrative offenses.

In the 2019 General Assembly vote, the countries that voted against the resolution were mainly Western ones — European Union member states, the United States, Canada, Britain, and Japan. Russia was backed by countries in Africa and Asia, among them Iran, China, North Korea, and Syria.

Human rights organizations came out sharply against the convention: Human Rights Watch, Amnesty International, Access Now, the Electronic Frontier Foundation, and others. Their experts warned explicitly of the risk that dissidents, journalists, and independent security researchers would be targeted. The organizations called for narrowing the convention’s scope and, conversely, expanding the human rights protections in it. Or, failing that, for rejecting the “Russian” document outright.

Not quite. Western countries joined the drafting process — and managed to shape the final text. The parties had to work out compromises on a number of points, including the title, which ended up in two parts and rather unwieldy:

Russia objected to the final title and said it would issue a separate statement to that effect when it ratifies the convention.

Hard to say for certain.

On one hand, the exchange of digital evidence covers any “serious” crime — one that carries a maximum sentence of at least four years in prison. Which means that if both countries treat an act as a “serious” crime, an investigator can ask colleagues abroad to intercept a suspect’s traffic. You could call that a diplomatic win for Moscow.

On the other hand, the final list of “cybercrimes” shrank considerably. Compared with the Russian draft of 2021, the following were struck from the convention:

Under the final version of the document, countries will not be able to obtain the seizure or confiscation of proceeds from these acts. Given that Russia and some other countries often use accusations of “extremism,” “terrorism,” or “subversive activity” as a pretext for going after political opponents, they did not gain a new tool for pressuring “enemies of the regime.”

No. The final version of the text, for example, still mentions the protection of human rights. Iran, with support from Russia, Syria, and several other states, tried to scrub those mentions from two articles of the convention, but both times more than 100 countries voted against doing so.

The same countries — Iran, Russia, Syria, and a couple of dozen others — tried to strip out the mechanism that lets a state refuse to cooperate, if a request is being used for political persecution, for instance. That amendment failed as well, and an important provision survived in Article 40:

No. Which is why it plans to attach reservations when it ratifies.

What’s more, Russia managed to secure a rather unusual decision. The UN General Assembly has already ordered preparatory work to begin on a draft protocol “supplementing the Convention and addressing, inter alia, additional criminal offenses, as appropriate.”

And countries will start discussing that protocol before the convention has even entered into force. The first of two 10-day sessions will be held in January 2027 in Vienna, the second in 2028 in New York.

Russia may try to use this gambit again to widen the list of criminalized acts to include any offense that can be committed with ICT. Justifying and promoting “terrorism” and “extremism” (backing the Anti-Corruption Foundation, say), public calls for sanctions [against Russia] or against particular officials, spreading “fakes,” and “discrediting” the army and the authorities, for example.

Three months after 40 states ratify the text.

For now, it’s hard to predict when that will happen. Nearly 10 months have gone by since the official ceremony in Hanoi that opened the convention for signature. In that time, the convention has drawn 81 signatures but only three instruments of ratification — from Azerbaijan, Vietnam, and Qatar.