Canada signs UN Cybercrime Convention it boycotted nine months ago

Last week the Canadian government announced that Canada has signed the United Nations Convention against Cybercrime. Ministers Anita Anand, Gary Anandasangaree and Sean Fraser touted the treaty's child protection provisions and human rights safeguards, describing them as "among the strongest found in an international criminal justice treaty." Law professor Michael Geist argues the announcement, released in mid-July when few people were paying attention, left out most of the story: the convention functions less as a cybercrime treaty than as a sweeping cross-border surveillance and electronic evidence-sharing agreement. Geist writes that leading human rights groups and nearly two dozen Canadian organizations and experts had urged the government to reject the treaty, and that key allies have so far declined to sign it themselves.

The treaty began as a Russian initiative in 2017, intended to displace the Council of Europe's Budapest Convention, the longstanding cybercrime framework Russia refuses to join. When the UN General Assembly voted in 2019 to open negotiations, Canada joined the United States and the European Union in opposing the move, warning it was a vehicle for expanding state surveillance powers. Having lost that vote, Canada chose to negotiate from within rather than boycott, pushing for human rights safeguards, and the convention was adopted by consensus in December 2024.

Despite that effort, Canada was a no-show at the signing ceremony in Hanoi last October, alongside the United States, New Zealand, Japan, the Netherlands, Italy, Norway, Denmark and Finland. Signatories at the ceremony included Russia, China, Iran, North Korea, Belarus, Cuba, Venezuela and Saudi Arabia, as well as the United Kingdom, Australia, France, Germany and the European Union. Canada issued a statement saying the treaty's success "rests on states' commitment to full application of the human rights safeguards in the text." Nine months later, the government signed without explaining what had changed.

Geist notes that while the convention lists specific cybercrime offences, its procedural powers cover electronic evidence for any criminal offence, and its international cooperation obligations extend to any "serious crime," defined as an offence carrying four or more years' imprisonment under domestic law. Because some states impose such penalties for criticizing the government, journalism, blasphemy or same-sex relationships, the treaty can turn repressive domestic laws into triggers for cross-border evidence requests. The Electronic Frontier Foundation, Human Rights Watch and a coalition of digital rights groups have warned that the convention functions as a global surveillance pact: it requires states to build real-time interception and data collection capabilities while leaving safeguards such as prior judicial authorization to each country's own discretion, permitting gag orders on cooperation requests, and omitting a political offence exception.

In December 2024, nearly two dozen Canadian organizations and experts, including Amnesty International Canada, the Criminal Lawyers' Association, PEN Canada, OpenMedia, and Citizen Lab's Ron Deibert and Kate Robertson, sent a letter urging the government not to sign, warning the treaty would create a standing channel for transnational repression targeting diaspora communities in Canada and could subvert safeguards built into Canada's mutual legal assistance framework. Robertson separately warned the treaty is "poised to become a vehicle for complicity in the mercenary spyware trade," while over 120 security researchers cautioned that its offences threaten to criminalize good-faith security research. The government has not publicly addressed any of these concerns, and no public consultation preceded the signature.

Geist writes that it is not clear anything has actually changed since Canada declined to sign nine months ago. One theory ties the decision to Canada's lawful access agenda: ratifying the convention would require implementing legislation featuring the same expanded production orders and cross-border data sharing powers found in Bill C-22. He also notes Canada already has the Budapest Convention and bilateral treaties covering cooperation with the states it wants to work with, so the new convention's chief added value lies in cooperation with the very states, including Russia, China and Iran, that create its greatest risks. Signing by itself creates no binding obligations; those would follow only from ratification.

Key facts

Canada signed the UN Convention against Cybercrime in mid-July, nine months after skipping the October Hanoi signing ceremony that the US, New Zealand, Japan and five European countries also skipped.
The convention defines a 'serious crime' triggering cross-border cooperation as any offence carrying four or more years' imprisonment under domestic law, letting repressive countries' laws trigger evidence requests.
Nearly two dozen Canadian organizations and experts, including Amnesty International Canada and Citizen Lab's Ron Deibert and Kate Robertson, urged the government in December 2024 not to sign; over 120 security researchers separately warned the treaty could criminalize good-faith security research.
The Electronic Frontier Foundation, Human Rights Watch and other digital rights groups say the treaty functions as a global surveillance pact, requiring real-time interception powers while leaving judicial authorization to domestic discretion.
Signing creates no binding obligations by itself; ratification would require implementing legislation resembling Bill C-22's expanded production orders and cross-border data sharing powers, one theory for why Canada is moving now.

Why it matters

Canada's decision reverses a position it held since its 2019 opposition to opening negotiations and its no-show at the Hanoi ceremony in October, without any public explanation for the shift. Geist argues the treaty is not primarily about cybercrime: its procedural powers cover electronic evidence for any criminal offence, and its international cooperation duties trigger on any offence carrying four or more years' imprisonment in the requesting country. That threshold hands leverage to states that criminalize journalism, blasphemy or same-sex relationships. Canada was among the most active democracies pushing for human rights safeguards during negotiations, and the final text kept the authoritarian bloc's speech and content offences out before the convention was adopted by consensus in December 2024. But the underlying surveillance architecture, real-time interception and cross-border evidence sharing, remains, and signing puts Canada on a path toward adopting it.

Who it affects

Canadian diaspora communities are named directly: the December 2024 letter from nearly two dozen Canadian organizations and experts warned the treaty would open a standing channel for transnational repression targeting them. Over 120 security researchers say its offences threaten to criminalize good-faith security research. Civil society groups, including Amnesty International Canada, the Criminal Lawyers' Association, PEN Canada, OpenMedia and Citizen Lab's Ron Deibert and Kate Robertson, have been pressing the government since before the text was even adopted. More broadly, any state that ratifies the convention, including Russia, China, Iran, North Korea, Belarus, Cuba, Venezuela and Saudi Arabia, all present at the Hanoi ceremony, would gain a formal channel to request cooperation from Canada once Canada itself ratifies.

How to use it

Signing by itself binds Canada to nothing: Geist notes that only ratification creates binding obligations, and that step requires domestic implementing legislation. One likely vehicle is Canada's lawful access agenda: ratification would need production-order and data-sharing powers matching those already proposed in Bill C-22, so tracking that bill's progress is the practical way to see what the convention will actually require of Canadians. Canada already has the Budapest Convention and bilateral treaties covering cooperation with the states it wants to work with, so this convention's marginal effect falls mainly on cooperation with Russia, China and Iran.

How solid is it

The piece is written by Geist, drawing on the government's own mid-July announcement, the December 2024 letter from Canadian civil society groups, public warnings from the Electronic Frontier Foundation and Human Rights Watch, and Kate Robertson's separate statements on the spyware trade. Direct quotes are attributed to the government's own releases at both the ceremony snub and the eventual signing. The treaty's Russian origin, the 2019 UN vote and the December 2024 consensus adoption are presented as established history rather than the author's inference; the central claim, that nothing explains the nine-month reversal, rests on the government's own silence rather than a specific leaked document.

Risks and caveats

Signing creates no binding legal obligations for Canada; ratification does, and no timeline or process for that step is given in the source. The government has not explained what changed since its October no-show, and no public consultation preceded the July signature. The source gives no exact calendar date for the signing itself, only 'last week' and 'mid-July,' nor an exact year for the Hanoi ceremony beyond 'last October.' The 'among the strongest' description of the treaty's safeguards is not attributed to a specific minister by name in the source.

“poised to become a vehicle for complicity in the mercenary spyware trade”

— Kate Robertson, Citizen Lab