Last week, the government announced that Canada has signed the United Nations Convention against Cybercrime, with Ministers Anita Anand, Gary Anandasangaree and Sean Fraser touting the treaty’s child protection provisions and human rights safeguards, which were described as “among the strongest found in an international criminal justice treaty.” The announcement, released in mid-July with few paying attention, left out much of the story. The reality is that the convention is not primarily a cybercrime treaty at all, but rather a sweeping cross-border surveillance and electronic evidence-sharing agreement that Canada originally opposed, that leading human rights groups and twenty Canadian organizations and experts urged the government to reject, and that key allies have thus far declined to sign. While signing the convention does not create binding obligations (that requires ratification), the decision to sign a treaty that the government declined to sign at the official ceremony less than a year ago raises troubling questions. This post seeks to answer three of them: what is this treaty, what are the risks, and what, if anything, changed in the last nine months?

The treaty began as a Russian initiative in 2017, designed to displace the Council of Europe’s Budapest Convention, the longstanding cybercrime framework that Russia refuses to join. When the UN General Assembly voted in 2019 to launch negotiations, Canada joined the United States and European Union in opposing the resolution, warning that the process was a vehicle for expanding state surveillance powers. Having lost that vote, the democracies faced an uncomfortable choice: boycott the negotiations and let Russia, China, and Iran write the rules, or engage from within and try to limit the damage. They chose engagement with Canada among the most active delegations pressing for human rights safeguards. The strategy succeeded in keeping the authoritarian bloc’s wish list of speech and content crimes out of the final text before the convention was adopted by consensus in December 2024.

Yet despite limiting the damage, Canada was a no-show at the signing ceremony in Hanoi last October, joined by the U.S., New Zealand, Japan, the Netherlands, Italy, Norway, Denmark, and Finland. Signatories included Russia, China, Iran, North Korea, Belarus, Cuba, Venezuela, and Saudi Arabia, as well as the United Kingdom, Australia, France, Germany, and the European Union. Canada issued a statement that emphasized the treaty’s success “rests on states’ commitment to full application of the human rights safeguards in the text.” Nine months later, the government signed without explaining what had changed.

Canada’s previous concern with the treaty is well placed. While it enumerates a list of cybercrime offences, its procedural powers apply to electronic evidence of any criminal offence, and its international cooperation obligations extend to any “serious crime,” defined as any offence punishable by four or more years’ imprisonment under domestic law. Since some states impose such penalties for criticism of the government, journalism, blasphemy, or same-sex relationships, the treaty effectively converts repressive domestic laws into triggers for cross-border evidence gathering. Further, the Electronic Frontier Foundation, Human Rights Watch and a coalition of leading digital rights groups have all warned that the convention functions as a global surveillance pact since it requires states to establish real-time interception and data collection powers while leaving out safeguards such as prior judicial authorization to the discretion of domestic law, permitting gag orders on cooperation requests, and omitting a political offence exception.

In December 2024, nearly two dozen Canadian organizations and experts, including Amnesty International Canada, the Criminal Lawyers’ Association, PEN Canada, OpenMedia, and the Citizen Lab’s Ron Deibert and Kate Robertson, issued a detailed letter urging the government not to sign. The letter warned that the treaty would create a standing channel for transnational repression targeting diaspora communities in Canada and explained how the convention could subvert the safeguards built into Canada’s mutual legal assistance framework. Robertson has separately warned that the treaty is poised to become a vehicle for complicity in the mercenary spyware trade, while over 120 security researchers cautioned that its offences threaten to criminalize good-faith security research. Despite the concerns, the government has said nothing, with no public consultation preceding the signature and none of the letter’s concerns addressed in the announcement.

So what changed and why sign now? It is not clear that anything has changed and the concerns that animated Canada’s decision to not sign nine months ago are still there. One theory is that this is linked to lawful access. Indeed, the treaty and the lawful access agenda are mutually reinforcing, since ratification will require implementing legislation featuring precisely the expanded production orders and cross-border data sharing powers found in Bill C-22. Lawful access was already a source of concern, and this only makes it worse. Canada already has the Budapest Convention and bilateral treaties covering cooperation with the countries it wants to work with, meaning the new convention’s marginal value lies chiefly in cooperation with the very states, including Russia, China, and Iran, that create its greatest risks. The entire decision, including signing in the middle of the summer when few are paying attention, is deeply troubling and requires far more than a sunny press release that avoids the hard questions the treaty raises.