AlSur's Open Letter on the International Convention on Cybercrime

August, 2024

AlSur and its member organizations urge Latin American States not to adopt or ratify the first UN Convention on cybercrime because it contravenes their international human rights obligations.

We express deep concern about the text of the International Convention on Cybercrime recently approved last August 8. Over the course of two and a half years, we have dedicated our time and expertise during the Convention drafting process to ensure that the draft respects existing human rights norms, the standards of the Inter-American human rights system and the principles of the UN Charter and the rule of law. However, the approved text represents a step backwards to these human rights standards.

Based on our experience defending human rights and digital rights in the Latin American region, we have provided evidence that national and regional cybercrime laws are being used to unfairly persecute journalists and security researchers, repress critical opinions, and endanger human rights defenders. Throughout this process, we have insisted that the fight against cybercrime must not be to the detriment of human rights, gender equality and the dignity of the people who will be affected by this Convention. Unfortunately, the approved text legitimizes mass surveillance and enables criminalization at the national and international level. We strongly believe that the entry into force of this treaty will significantly increase the risk of human rights abuses and violations.

We identified that this treaty generates the following risks to human rights:

Breadth of scope  

The aforementioned main objective of creating this treaty was to combat cybercrime. However, its legal scope goes beyond strictly cyber-related crimes. The Convention and the surveillance powers it enables apply to any crime committed through information technologies, as well as to any serious crime, defined as those with penalties of more than 4 years. This treaty is a blank check for States to monitor citizens and share their personal information internationally.

Invasive surveillance powers

The proposed Convention creates a legal framework that allows surveillance, storage, and cross-border exchange of information. The text allows for the secret interception of real-time traffic data without notifying the persons affected by these measures.

It also empowers states to require any person to disclose sensitive information on individuals or critical systems. In addition, it authorizes excessive information sharing for law enforcement cooperation, beyond specific criminal investigations, without establishing clear and explicit data protection and human rights safeguards.

These measures would undermine confidence in secure communications and violate international human rights standards, including prior judicial authorization requirements and the principles of legality, necessity and proportionality.

Insufficient protections and safeguards

The proposed Convention lacks sufficient safeguards to ensure the protection of human rights. Although the current text states that States must implement this treaty in accordance with international human rights law, the safeguards to ensure compliance with the obligations in the text are scant and insufficient.

It is alarming that the provisions related to maximum safeguards do not include the principles of legality and necessity. Similarly, the wording of the text opens the door to these safeguards not being applicable to international cooperation issues. This compromises the ability to ensure that measures against cybercrime respect the principles of legality, necessity and proportionality, and provide adequate protection for human rights.

Lack of effective gender mainstreaming  

The proposed Convention does not effectively integrate the gender perspective, which is key to avoid its use to the detriment of human rights with differentiated affectations based on gender. Although mentioned in the preamble, this perspective is not applied transversally to all articles, but has been excluded from critical aspects such as human rights, safeguards and data protection. The only references to gender are limited to victim assistance and preventive measures, which is insufficient.

The text of the Convention carries significant risks, with broad monitoring powers that could disproportionately affect individuals on the basis of gender. States must ensure that the convention is consistent with their human rights and gender equality obligations, or risk falling short of their international commitments.

Lack of effective gender mainstreaming  

The proposed Convention does not effectively integrate the gender perspective, which is key to avoid its use to the detriment of human rights with differentiated affectations based on gender. Although mentioned in the preamble, this perspective is not applied transversally to all articles, but has been excluded from critical aspects such as human rights, safeguards and data protection. The only references to gender are limited to victim assistance and preventive measures, which is insufficient.

The text of the Convention carries significant risks, with broad monitoring powers that could disproportionately affect individuals on the basis of gender. States must ensure that the convention is consistent with their human rights and gender equality obligations, or risk falling short of their international commitments.

Serious setback for the Inter-American system

The Convention represents a major setback to the Inter-American human rights system's framework for the protection of privacy and freedom of expression. The recent decision of the Inter-American Court of Human Rights in the case of CAJAR v. Colombian State underscores the importance of protecting the right to defend human rights and safeguarding data protection, even in state intelligence contexts. The ruling recognizes that individuals have the right to control their personal data in public records and establishes the obligation of prior judicial authorization for surveillance activities. It also highlights the need for special protection for journalists and lawyers, safeguarding their communications and sources.

This precedent and the Inter-American jurisprudence are particularly relevant for Latin American states, a region historically affected by state repression against activists, journalists, human rights defenders and researchers. In Latin America, the defense of democracy and the rule of law has become dangerous due to state mechanisms of criminalization and surveillance. These instruments hinder the exercise of civil rights and have been used to silence critical voices.

Currently, there is a worrying absence of legal instruments with a differential approach to gender and human rights that limit the arbitrary use of surveillance technologies. Instead of restricting the judicial persecution of dissident voices, recent legislation has facilitated their unjustified use. Several Latin American organizations have denounced before the CIDH [1] cases of judicial persecution of journalists, activists, women and LGBTQIA+ persons, as well as the improper use of spyware and tools such as Osint in investigations.

States must take into account these risks to the dignity of their citizens and the sovereignty of their nations. A new treaty must not validate the criminalization of legitimate conduct, nor intrusive surveillance practices that undermine human rights and gender equality.

We urge States to respect their international obligations and align with the guidelines of the Inter-American system. Therefore, we urge Latin American States not to adopt or ratify the first UN Convention on Cybercrime as contrary to their international human rights obligations.

[1] hey denounced before the IACHR the advance of “judicial harassment” against journalists in Latin America. Clarín. Available at: https://www.clarin.com/politica/denunciaron-cidh-avance-acoso-judicial-periodistas-america-latina_0_ en4HJXFUSv.html.

Article 19: Acoso judicial a periodistas y defensores(as) de derechos humanos, la víctima es la libertad de expresión (Judicial harassment of journalists and human rights defenders, the victim is freedom of expression). Available at:                                                       https://articulo19.org/acoso-judicial-a-periodistas-y-defensoresas-de-derechos-humanos-la-victima-es -la-libertad-de-expresion/.