Budapest Convention on Cybercrime: Rules and the UN Alternative

Introduction

The Budapest Convention on Cybercrime is the principal international treaty in force establishing common legal standards for computer-related criminal offenses, electronic evidence, and cooperation between national criminal justice authorities. Opened for signature in 2001 under the Council of Europe, the Convention on Cybercrime (ETS No. 185) requires participating states to criminalize specified conduct, establish investigative powers under domestic law, and assist one another in criminal proceedings involving computer systems and digital information (Council of Europe, 2001).

The Convention addresses a recurring jurisdictional difficulty. Criminal conduct may originate in one country, affect victims in another, and leave evidence on computer systems operated from several others. National authorities may possess jurisdiction to prosecute an offense without having legal authority to obtain evidence located abroad. The treaty responds by bringing domestic criminal laws closer together and establishing procedures for international assistance.

Although negotiated within the Council of Europe, the Budapest Convention is open to participation by states outside Europe. Its geographical reach has expanded considerably since it entered into force on July 1, 2004. By November 2026, it had 84 contracting parties, although the date on which obligations become operative must be determined separately for each state.

A second international instrument has emerged through the United Nations. The UN Convention against Cybercrime, adopted by the General Assembly on December 24, 2024, establishes a separate treaty framework covering specified offenses, electronic evidence, international cooperation, asset recovery, prevention, and technical assistance. It incorporates provisions resembling those of Budapest but contains different rules concerning criminalization, cooperation procedures, and institutional arrangements (United Nations, 2024).

The distinction between the two treaties is especially significant in November 2026. The Budapest Convention is already legally operative between its parties, while the UN Convention has not entered into force. Their relationship raises questions about the scope of international electronic-evidence cooperation, the protection of individual rights, and the coexistence of treaty obligations established through different international institutions.

1. Budapest Convention on Cybercrime: Scope and Legal Effect

The Convention on Cybercrime was opened for signature in Budapest on November 23, 2001, following negotiations conducted within the Council of Europe. Its development reflected growing concern that national criminal legislation and investigative procedures were poorly adapted to offenses involving interconnected computer systems. Differences between domestic laws complicated investigations when suspects, victims, service providers, and electronic evidence were distributed across several jurisdictions.

The Convention entered into force on July 1, 2004. Its preamble identifies the need for a common criminal policy addressing offenses against computer systems and data, alongside effective arrangements for investigation and international cooperation. It also recognizes that law enforcement measures must respect fundamental rights, including privacy and freedom of expression.

Its legal architecture combines three categories of obligations. Articles 2–13 establish substantive criminal-law requirements. Articles 14–21 concern domestic investigative powers, while Chapter III regulates international cooperation. These provisions operate together, but criminalization, investigative jurisdiction, and cooperation remain distinct legal functions.

The Convention does not establish an international cybercrime prosecutor or confer general police powers on an international institution. Its obligations primarily require states to adopt legislative and other measures through their domestic legal systems. Criminal investigations, prosecutions, evidentiary decisions, and penalties remain within the competence of national authorities.

Participation is not limited to Council of Europe members. Article 37 provides an accession procedure through which eligible non-member states may become parties following an invitation under the Convention's requirements. The United States, Japan, Australia, and states across Africa, Asia, and Latin America illustrate its geographical reach.

Kazakhstan's accession on October 14, 2026, brought the Convention to 84 contracting parties, according to the Council of Europe's treaty records. The Convention is scheduled to enter into force for Kazakhstan on February 1, 2027. The distinction is legally consequential: deposit of an accession instrument does not necessarily make every substantive obligation immediately operative for the acceding state.

Implementation also differs among participating jurisdictions. Articles 40–42 permit specified declarations and reservations, while domestic legislation determines how treaty obligations are incorporated and exercised. The Convention establishes common requirements without eliminating differences in constitutional law, judicial procedures, criminal responsibility, or the organization of national justice systems.

2. Criminal Offenses Required by the Convention

The Budapest Convention establishes criminalization obligations intended to reduce substantive differences between national legal systems. Articles 2–13 address conduct directed against computer systems, offenses committed through computer technology, and related rules concerning participation, liability, and sanctions. The purpose is sufficient compatibility to support investigations and international cooperation, rather than the adoption of identical national criminal codes.

Several offenses require intentional conduct committed without legal authorization. The treaty expression "without right" distinguishes conduct lacking lawful justification from legitimate activities involving computer systems. It is particularly relevant to cybersecurity testing, system administration, and operations undertaken with the permission of an authorized operator.

The Convention permits additional conditions and reservations concerning particular offenses. Criminal liability cannot be established solely by identifying the technological activity involved. The mental element, applicable exceptions, statutory qualifications, and any permitted reservation may affect whether conduct falls within a particular criminal provision.

2.1 Illegal Access, Interception, and Computer Interference

Article 2 requires the criminalization of intentional access to all or part of a computer system without right. It addresses unauthorized entry into computer systems, including conduct commonly described as hacking. States may require additional elements, such as infringement of security measures, an intention to obtain computer data, another dishonest intention, or a connection with another computer system (Council of Europe, 2001, art. 2).

Article 3 concerns intentional interception without right, by technical means, of nonpublic transmissions of computer data. Its scope includes transmissions to, from, or within computer systems and certain electromagnetic emissions carrying data. Illegal access and illegal interception address different forms of interference: entering a computer system does not necessarily involve capturing information during transmission.

Articles 4 and 5 distinguish interference with data from interference with computer systems. Data interference concerns intentional damaging, deletion, deterioration, alteration, or suppression of computer data without right. System interference involves serious hindering of a computer system's functioning through specified actions affecting data.

The distinction is relevant to incidents involving destructive software or disruption of computer services. Altering stored information may satisfy the elements of data interference, while seriously obstructing a system's operation may engage Article 5. A single incident can involve both offenses, but each requires proof of its constituent elements under domestic law.

Article 6 concerns misuse of devices, including the production, sale, procurement for use, importation, distribution, or other making available of specified devices, programs, passwords, or access codes with the required criminal intent. Its qualifications recognize that technical tools may have legitimate as well as unlawful applications.

The provision does not require criminalization of ordinary cybersecurity research or possession of technical tools without the necessary unlawful purpose. Authorized testing and protection of computer systems must be distinguished from conduct intended to facilitate the offenses specified by the Convention.

2.2 Computer Fraud, Forgery, and Related Offenses

Articles 7 and 8 adapt established criminal-law concepts to conduct involving computer systems. Article 7 addresses intentional and unlawful manipulation of computer data resulting in inauthentic data intended to be considered or acted upon for legal purposes as though authentic. Article 8 concerns specified interference with data or computer systems causing property loss, accompanied by the requisite fraudulent or dishonest intent to obtain an economic benefit.

The distinction is substantive. Computer-related forgery centers on the authenticity and legal significance of information, while computer-related fraud concerns economic loss and wrongful gain. Manipulating an electronic record does not necessarily establish every element of fraud, just as computer-related fraud need not involve forged data.

Article 9 establishes offenses concerning material depicting sexual abuse or exploitation of children through computer systems. The original treaty uses the expression "child pornography," reflecting terminology employed when the Convention was adopted. Contemporary child-protection terminology generally distinguishes child sexual abuse material from adult pornography because the former concerns exploitation and abuse.

Article 9 contains specific definitions, age-related provisions, and permitted reservations. These qualifications affect the precise criminalization obligations applicable to participating states. National implementing legislation must be examined before attributing identical criminal liability to every form of conduct addressed by the provision.

Article 10 addresses copyright and related-rights infringements committed through computer systems. Criminalization is subject to conditions concerning intentionality, commercial scale, and the relevant international intellectual property obligations. The article does not transform every digital copyright infringement into a criminal offense.

Articles 11–13 complete the substantive framework through provisions concerning participation, attempt, corporate liability, and sanctions. Article 11 requires criminalization of intentional aiding or abetting and addresses attempts to commit specified offenses, subject to permitted reservations.

Article 12 establishes more detailed requirements concerning liability of legal persons. It addresses offenses committed for their benefit by persons holding leading positions and circumstances in which inadequate supervision or control enables an offense committed by a person under their authority. Depending on the applicable legal principles, liability may be criminal, civil, or administrative.

The Convention also requires effective, proportionate, and dissuasive sanctions. It recognizes that responsibility may extend beyond an individual perpetrator, while preserving national differences in the legal forms and procedures through which responsibility is established.

3. Domestic Powers to Obtain Electronic Evidence

The procedural provisions of the Budapest Convention address a broader investigative problem than the prosecution of computer-related offenses alone. Evidence concerning ordinary criminal conduct may exist in electronic form even where the underlying offense has no specifically technological character. Communications records, account information, financial transactions, photographs, and stored messages can become relevant in investigations concerning many categories of crime.

Article 14 requires parties to establish investigative powers for offenses covered by the Convention, other criminal offenses committed through computer systems, and the collection of electronic evidence of criminal offenses, subject to the qualifications contained in the provision. The domestic procedural framework consequently extends beyond the substantive offenses established by Articles 2–10.

The Convention requires these powers to be implemented through national law. It does not authorize investigators to disregard domestic requirements concerning judicial supervision, evidentiary relevance, proportionality, or the rights of affected individuals. Nor does the existence of a domestic investigative power automatically permit authorities to exercise it within another state's territory.

Preservation, production, search, seizure, and interception perform different legal functions. Each concerns particular categories of information and may involve different levels of interference with individual rights. Their conditions must be examined separately rather than treated as interchangeable methods of obtaining electronic evidence.

3.1 Preservation, Production Orders, and Search Powers

Article 16 requires expedited preservation of specified stored computer data where competent authorities have grounds to believe the information is particularly vulnerable to loss or modification. Preservation is intended to maintain the availability and integrity of data while investigators pursue the legal procedures necessary to obtain them.

The Convention provides for preservation for up to 90 days, with the possibility of subsequent renewal. The purpose is particularly important where service providers retain information for limited periods or where relevant data may otherwise be overwritten.

Preservation does not itself authorize disclosure. Preventing the deletion of information and obtaining access to its contents are separate legal acts. Authorities may possess sufficient grounds to preserve data while still needing an additional order or cooperation procedure before inspecting them.

Article 17 addresses preservation and partial disclosure of traffic data. Where several service providers participate in transmitting a communication, investigators may require sufficient routing information to identify another provider involved. The provision supports that identification without establishing unrestricted disclosure of communications content.

Article 18 concerns production orders. It requires domestic powers to compel production of specified stored computer data from persons within the party's territory and certain subscriber information from service providers offering services there.

Subscriber information may identify the person associated with an account, the contractual relationship governing a service, or relevant billing and access details. It remains legally distinct from traffic data and the content of communications. That distinction affects the applicable investigative provisions and the privacy interests engaged.

Article 19 regulates search and seizure of stored computer data. Its measures include accessing computer systems or storage media, securing information, and maintaining its integrity for evidentiary purposes. Subject to the article's conditions, a search may extend to another computer system within the same territory where relevant data are lawfully accessible from the system initially searched.

These powers must be read alongside Article 15's safeguards. The technical ability to obtain information does not determine whether access is legally permissible. Investigators must comply with applicable authorization procedures, while courts may subsequently examine the lawfulness and evidentiary consequences of the measures undertaken.

3.2 Real-Time Traffic Collection and Content Interception

Articles 20 and 21 address investigative measures affecting communications as they occur. Article 20 concerns real-time collection or recording of traffic data associated with specified communications. Such information may identify a communication's origin, destination, route, timing, duration, or service characteristics without necessarily revealing its substance.

Traffic data may nevertheless disclose sensitive information. Communications patterns can reveal personal associations, professional contacts, movement, or relationships between individuals. The privacy implications cannot be dismissed simply because investigators do not obtain the content of the underlying exchange.

Article 21 addresses interception or recording of content data associated with specified communications. It requires parties to establish interception powers concerning a range of serious offenses determined by domestic law. The Convention treats these powers separately from traffic-data collection, reflecting their different scope and potential intrusiveness.

Both provisions contemplate technical assistance or cooperation from service providers under conditions established by domestic law. Their application remains subject to Article 15 and the particular qualifications or reservations permitted by the Convention.

Neither article establishes a general international authorization for unrestricted surveillance. The legality of interception or collection depends on the investigative objective, the nature of the information sought, the applicable legal threshold, and the procedures governing authorization and supervision.

4. International Cooperation and Territorial Jurisdiction

Chapter III of the Budapest Convention establishes procedures for cooperation when criminal investigations involve more than one national jurisdiction. A state possessing jurisdiction to prosecute an offense does not automatically acquire authority to search foreign computer systems, seize information abroad, or compel persons in another state's territory to cooperate.

Article 22 addresses jurisdiction over specified offenses, including conduct committed within a party's territory, on ships flying its flag, and on aircraft registered under its laws. It also provides for certain nationality-based jurisdiction, subject to conditions and permitted reservations.

Article 23 establishes the general international cooperation framework. It requires parties to cooperate to the widest extent possible, in accordance with the Convention, other applicable international instruments, relevant arrangements, and domestic law, for investigations concerning computer-related offenses or the collection of electronic evidence of a criminal offense.

Chapter III combines established methods of international criminal assistance with procedures designed for electronic investigations. Extradition, mutual legal assistance, expedited preservation, access to stored data, real-time collection, and continuous contact networks perform related but legally distinct functions.

4.1 Jurisdiction, Extradition, and Mutual Legal Assistance

Article 24 addresses extradition for offenses established in accordance with Articles 2–11. Its general threshold concerns offenses punishable under the laws of both relevant parties by a maximum period of imprisonment of at least one year or a more severe penalty. Different thresholds may apply where an existing extradition treaty or another qualifying arrangement provides otherwise (Council of Europe, 2001, art. 24).

The Convention treats covered offenses as extraditable under existing extradition treaties between parties. Where a state requires an extradition treaty and no separate agreement exists, it may consider the Budapest Convention itself as the legal basis for extradition.

Extradition remains subject to applicable conditions and refusal grounds. Nationality, domestic constitutional restrictions, human rights obligations, and the legal requirements governing a particular offense may affect whether surrender is permissible. The Convention does not guarantee extradition whenever the conduct concerns a computer system.

Article 24(6) addresses circumstances in which extradition is refused solely because the requested state considers the person its national or considers itself competent to exercise jurisdiction. At the requesting party's request, the requested state must submit the case to its competent authorities for a prosecutorial decision. Submission does not predetermine prosecution or conviction.

Mutual legal assistance concerns cooperation in obtaining evidence and performing investigative acts without necessarily transferring the suspect. Article 25 establishes a broad assistance obligation, while Articles 26–28 address spontaneous information, requests transmitted through competent authorities, confidentiality, and conditions governing the use of disclosed information.

The applicable legal basis may differ between requests. Existing bilateral or multilateral agreements can govern cooperation, while the Convention establishes supplementary procedures where relevant. Article 27 provides particular rules for mutual-assistance requests in the absence of applicable agreements.

Dual criminality—the requirement that the underlying conduct constitute an offense under the laws of both states—may be relevant to certain procedures. The Convention restricts reliance on that condition in specified circumstances, particularly where urgent preservation is required.

A request to preserve information may consequently be governed by different conditions from a request to disclose its contents. Each obligation must be assessed under the relevant provision rather than assumed to follow automatically from the general duty to cooperate.

4.2 Expedited Assistance and the 24/7 Network

Electronic evidence may be deleted, modified, or overwritten before a conventional international assistance request has been processed. Article 29 addresses this difficulty by establishing procedures for expedited preservation of specified stored computer data located within another party's territory.

The requested party must preserve relevant data in accordance with the provision's conditions. Article 29 establishes a preservation period of at least 60 days, allowing the requesting authority to pursue the separate procedures necessary for disclosure.

Article 30 concerns expedited disclosure of sufficient traffic data to identify service providers involved in transmitting a communication and the path through which it was transmitted. Article 31 separately addresses assistance in accessing, securing, and disclosing stored computer data.

These provisions recognize the staged character of electronic-evidence investigations. Investigators may first need to prevent the loss of information, then identify where additional records are held, and finally obtain the material under the legal conditions governing disclosure.

Article 35 requires parties to designate a contact point available continuously, 24 hours a day and seven days a week. The network supports urgent communication, technical assistance, preservation requests, and other forms of cooperation permitted by the Convention and domestic law.

A contact point does not acquire unrestricted authority to disclose protected communications or authorize coercive investigations on foreign territory. Its actual powers depend on the national institution designated and the applicable legal procedures.

The network's function is primarily operational. It reduces communication delays and helps identify the authorities capable of acting on a request. The legal basis for preservation, disclosure, or interception remains a separate question.

4.3 Transborder Access and State Consent

Article 32 establishes two circumstances in which a party may access stored computer data without authorization from another party. The first concerns publicly available data, regardless of geographical location. The second concerns data located in another party where a person with lawful authority voluntarily consents to disclosure through a computer system in the investigating state's territory.

These exceptions are narrowly defined. Article 32 does not confer a general right to search computer systems abroad, exploit vulnerabilities in foreign infrastructure, or compel overseas service providers to disclose private information.

The provision reflects the distinction between prescriptive jurisdiction and enforcement jurisdiction. A state may legitimately criminalize conduct and prosecute an offense while lacking authority to carry out coercive investigative acts inside another state's territory.

The location of electronic information can complicate the application of these rules. Cloud-based services may distribute data across several servers, while investigators may not know where particular information is stored when access begins.

Technological uncertainty does not itself create additional international legal authority. Outside Article 32's specified circumstances, investigators require another applicable legal basis, ordinarily involving cooperation through foreign authorities or another arrangement permitted under international and domestic law.

5. The Additional Protocols to the Budapest Convention

The Budapest Convention has been supplemented by two additional protocols addressing distinct subjects. The First concerns specified racist and xenophobic offenses committed through computer systems. The Second establishes additional procedures for cooperation and the disclosure of electronic evidence.

The protocols are separate treaties. States do not become parties automatically by ratifying or acceding to ETS No. 185. Each protocol has its own participation requirements, permitted reservations or declarations, and conditions for entry into force.

This distinction affects their legal application. The First Additional Protocol has been in force since 2006 for participating states. The Second Additional Protocol had not entered into force by November 6, 2026, and its additional cooperation procedures cannot yet be treated as operative treaty obligations.

5.1 The First Protocol on Racism and Xenophobia

The First Additional Protocol (ETS No. 189) was opened for signature on January 28, 2003, and entered into force on March 1, 2006. It addresses specified criminal acts involving racist and xenophobic material communicated through computer systems.

Article 3 concerns dissemination or making available of racist and xenophobic material. Articles 4 and 5 address certain threats and insults, while Article 6 concerns specified forms of denial, gross minimization, approval, or justification of genocide and crimes against humanity (Council of Europe, 2003).

The protocol contains qualifications reflecting differences among national approaches to criminal expression. Certain provisions permit reservations, additional criminal-law elements, or alternative treatment under domestic law.

These qualifications are especially significant because freedom-of-expression protections and constitutional traditions differ among states. The protocol does not establish an unrestricted international offense covering every controversial, offensive, or historically disputed statement.

Its obligations supplement the original Budapest Convention for participating states. They do not alter the substantive criminalization requirements applicable to parties that have not accepted the additional protocol.

5.2 The Second Protocol on Electronic Evidence

The Second Additional Protocol (CETS No. 224), opened for signature in Strasbourg on May 12, 2022, addresses difficulties associated with electronic evidence held by service providers across national borders. Conventional mutual-assistance procedures may involve considerable delays when investigators seek subscriber records, account information, or evidence required during emergencies.

Article 6 concerns requests for domain-name registration information from relevant entities in another participating state. Article 7 establishes procedures for certain direct orders seeking subscriber information from service providers in another party's territory.

These mechanisms have different conditions and do not authorize unrestricted disclosure. Article 7 includes provisions concerning notification, consultation, and the opportunity for the territorial state's authorities to intervene in specified circumstances.

Other provisions address expedited disclosure in emergencies, access to subscriber information and traffic data through competent authorities, and joint investigative arrangements. The emergency provisions concern situations involving a significant and imminent risk to the life or safety of a natural person.

Article 14 establishes detailed personal-data protection requirements governing transfers under the protocol. They address matters including purpose limitation, retention, security, further disclosure, and safeguards for individuals whose information is transferred.

The protocol requires five ratifications for entry into force. By November 2026, four states had ratified it, leaving the threshold unsatisfied. Its provisions remain relevant to the development of international cooperation but cannot be relied upon as an operative treaty basis solely because states have signed the instrument.

The distinction is important when comparing Budapest with the United Nations Convention against Cybercrime. The original Convention, its First Additional Protocol, and its Second Additional Protocol do not impose identical obligations on the same group of states.

6. The UN Convention against Cybercrime

The United Nations Convention against Cybercrime emerged from a separate diplomatic process intended to establish international standards through negotiations open to all UN member states. Its full title, United Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes, reflects its concern with specified offenses and international electronic-evidence cooperation.

The negotiations followed disagreements concerning the adequacy of existing instruments, the territorial reach of investigative powers, and the conditions under which states should exchange evidence. Some governments favored negotiations within the United Nations to secure broader participation in setting international standards. Others questioned whether a new treaty was necessary alongside the Budapest Convention and existing criminal-assistance arrangements.

The adopted Convention incorporates provisions closely resembling the Budapest system while introducing additional obligations concerning criminalization, prevention, victim assistance, asset recovery, and institutional cooperation. Its legal effect must be distinguished from its diplomatic significance. Adoption establishes an agreed treaty text, while the application of treaty obligations depends on state consent and entry into force.

6.1 Negotiations, Adoption, and Entry into Force

The negotiating process originated in General Assembly Resolution 74/247, adopted on December 27, 2019. The resolution established an open-ended intergovernmental committee of experts to elaborate a comprehensive international convention addressing criminal uses of information and communications technologies.

Resolution 75/282, adopted on May 26, 2021, established further procedural arrangements. Negotiations began in 2022 and involved states holding different positions concerning criminalization, international cooperation, territorial sovereignty, privacy, and procedural safeguards.

The Ad Hoc Committee approved a draft Convention by consensus in August 2024. On December 24, 2024, the General Assembly adopted Resolution 79/243, annexing the agreed treaty text. The resolution was adopted without a vote, completing the principal negotiation process while leaving participation and entry into force to subsequent decisions (United Nations General Assembly, 2024).

The Convention opened for signature in Hanoi on October 25, 2025. The signature period continues at United Nations Headquarters until December 31, 2026. Article 65 provides that entry into force occurs on the 90th day following deposit of the 40th qualifying instrument of ratification, acceptance, approval, or accession.

As of November 6, 2026, the United Nations Treaty Collection recorded 96 signatories and three parties: Qatar, Azerbaijan, and Viet Nam. Qatar deposited its ratification on February 4, 2026, Azerbaijan on April 15, and Viet Nam on April 17.

The required number of instruments had not been deposited, and the Convention remained outside its entry-into-force stage. Signature must be distinguished from ratification or accession. Under applicable treaty law, qualifying signatories may incur a limited obligation not to defeat a treaty's object and purpose, but signature alone does not ordinarily establish the full substantive obligations where subsequent consent to be bound is required.

6.2 Criminalization and the Additional UN Offenses

Chapter II of the UN Convention establishes criminalization obligations in Articles 7–21. Articles 7–13 address illegal access, illegal interception, interference with electronic data or information and communications technology systems, misuse of devices, computer-related forgery, and computer-related theft or fraud.

These provisions substantially correspond to offenses contained in the Budapest Convention. Differences in definitions, terminology, and permissible qualifications nevertheless require separate interpretation. The expression "information and communications technology system" is not necessarily coextensive with every domestic definition of a computer system, although the underlying prohibitions are closely related.

Article 4 addresses offenses established pursuant to other applicable United Nations conventions and protocols. It requires participating states, when implementing those instruments, to ensure that conduct already criminalized under them is also considered criminal when committed through information and communications technology systems.

Article 4(2) expressly prevents that provision from being interpreted as independently establishing criminal offenses under the UN Convention. Its significance lies in connecting existing treaty-based criminalization obligations with technologically mediated conduct, rather than creating an unrestricted additional category of crimes.

Articles 14–16 introduce obligations concerning child sexual abuse or exploitation material, online solicitation or grooming of children, and nonconsensual dissemination of intimate images. These provisions extend beyond the principal offenses established by the original Budapest Convention.

Their application is subject to specified definitions and qualifications. Article 14 addresses particular forms of material and conduct while permitting certain exclusions consistent with domestic law and applicable international obligations. Article 15 permits states to require an act in furtherance of online solicitation or grooming.

Article 16 concerns the intentional and unauthorized dissemination of intimate images without the consent of the person depicted. Paragraph 2 defines an intimate image by reference to a visual recording of a person over the age of 18, sexual in nature, made in private circumstances and accompanied by a reasonable expectation of privacy.

Article 16(3) permits states to extend that definition to certain persons under 18 who are legally old enough to engage in sexual activity under domestic law, provided the image does not depict child abuse or exploitation. Paragraph 4 separately establishes that a person under 18 cannot consent to dissemination of material constituting child sexual abuse or exploitation under Article 14. States may also require an intention to cause harm before criminal liability attaches under Article 16.

These qualifications distinguish the provision from a general prohibition covering every form of intimate-image dissemination. The obligations concern specifically defined conduct, and their implementation must remain consistent with the article's age-related provisions and applicable international obligations.

Article 17 addresses laundering the proceeds of crime. States must establish relevant offenses criminalizing intentional laundering, subject to the fundamental principles of their domestic legal systems. Article 17(2) requires offenses established under Articles 7–16 to be treated as predicate offenses within the specified conditions.

For states whose legislation identifies particular predicate offenses, the treaty requires a comprehensive range of offenses established under Articles 7–16. The interpretative notes accompanying the Convention clarify that conduct is treated as an Article 17 offense under this treaty only where the predicate offense is established in accordance with those provisions.

Articles 18–21 address legal-person liability, participation and attempt, limitation periods, prosecution, and sanctions. Article 19 requires criminalization of intentional participation in Convention offenses but treats criminalization of attempt and preparation as discretionary.

Article 18 establishes liability of legal persons for participation in offenses established in accordance with the Convention, consistently with national legal principles. Liability may be criminal, civil, or administrative and does not displace the responsibility of natural persons who committed the offenses.

The provision differs from Budapest Article 12, which expressly specifies leading-position responsibility and liability arising from inadequate supervision or control. UN Article 18 does not reproduce those detailed attribution rules. Its implementation will depend significantly on domestic principles governing the responsibility of companies and other legal persons.

The difference is relevant to service providers and other commercial entities whose infrastructure may be used to commit criminal offenses. Article 18 does not itself establish automatic liability whenever a third party misuses a company's services. Criminal, civil, or administrative responsibility must be determined according to the applicable domestic legal principles and the requirements of the Convention.

6.3 Victim Protection, Asset Recovery, and UN Institutions

The UN Convention contains provisions addressing consequences of cybercrime beyond criminal prosecution. Articles 33 and 34 establish obligations concerning witness protection and victim assistance. These include appropriate measures against intimidation or retaliation and arrangements concerning compensation and restitution, subject to domestic law and the Convention's conditions.

Article 34 gives particular attention to victims of offenses involving child sexual abuse or exploitation material and nonconsensual intimate-image dissemination. It addresses assistance concerning physical and psychological recovery and measures relating to certain unlawful online material.

The Convention also contains provisions concerning confiscation and international cooperation in recovering proceeds of crime. Articles 49–52 establish arrangements for tracing, freezing, seizing, confiscating, and disposing of property associated with Convention offenses.

These provisions are relevant when financial benefits from criminal conduct are transferred or concealed across jurisdictions. Their application depends on competent domestic authorities, lawful orders, procedural requirements, and applicable international cooperation arrangements. A foreign request does not independently determine ownership or conclusively establish the criminal character of property.

Prevention and technical assistance receive separate attention. The Convention provides for cooperation intended to strengthen domestic legislation, investigative capabilities, institutional resources, and the capacity of states to respond to criminal conduct involving digital technologies.

Article 57 establishes a Conference of the States Parties, while Article 58 provides for secretariat arrangements. The Conference is intended to promote implementation, consultation, information exchange, and consideration of future institutional measures.

These arrangements resemble supervisory and cooperation mechanisms found in other UN criminal-law treaties. Their effectiveness will depend on participation, implementation, and available resources. As of November 2026, the Conference had not commenced operation as the Convention's governing body because the treaty had not entered into force.

7. Where the Budapest and UN Conventions Differ

The Budapest and UN conventions share substantial legal concepts. Both address unauthorized access, interception, interference with data and systems, computer-related fraud, preservation of electronic evidence, mutual legal assistance, extradition, and continuously available contact networks.

Their similarities reflect the practical requirements of criminal investigations involving information and communications technologies. Differences become more significant when the precise scope of cooperation, the authority for obtaining information abroad, and the safeguards governing particular procedures are examined.

A direct comparison must distinguish obligations already in force from provisions awaiting entry into force. The original Budapest Convention is operative between its parties. Its Second Additional Protocol and the UN Convention had not entered into force by November 2026. Their texts may be compared, but equivalent operational experience cannot be presumed.

7.1 Electronic Evidence and the Serious-Crime Threshold

Article 14 of the Budapest Convention extends domestic procedural powers to the collection of electronic evidence of criminal offenses, subject to specified qualifications. Article 23 of the UN Convention similarly requires domestic powers concerning offenses established under the treaty, other offenses committed through information and communications technology systems, and electronic evidence of criminal offenses.

The principal distinction concerns international cooperation. Budapest Articles 23 and 25 provide for assistance regarding criminal offenses related to computer systems and data and the collection of electronic evidence of a criminal offense. Their general formulation does not establish a uniform four-year seriousness threshold for electronic-evidence cooperation.

Article 35(1) of the UN Convention provides for cooperation concerning offenses established under the treaty, electronic evidence relating to those offenses, and electronic evidence of any serious crime. Article 2(h) defines serious crime as conduct punishable by a maximum deprivation of liberty of at least four years or a more serious penalty (United Nations, 2024, arts. 2 and 35).

Article 35(2) makes the relevant provisions of Article 40 and Articles 41–46 applicable to electronic-evidence cooperation under Article 35(1)(b) and (c). These include mutual-assistance procedures, expedited preservation, access to stored information, real-time traffic-data collection, and interception of content data.

The distinction can affect an investigation concerning an ordinary offense that is not specifically covered by the UN Convention and does not satisfy the serious-crime threshold. Budapest may provide a treaty basis for cooperation without imposing an equivalent general four-year threshold, subject to the requirements governing the requested assistance.

This does not mean Budapest obliges states to grant every request. Specific provisions, domestic law, and applicable cooperation agreements may establish limitations or refusal grounds. Conversely, the UN threshold does not prohibit assistance that states may lawfully provide under another international agreement or domestic authority.

The legal inquiry has two stages. Investigators must establish that the requested assistance falls within the relevant treaty's scope and that the conditions governing the particular measure have been satisfied. A broad cooperation obligation does not dispense with the second requirement.

7.2 Cross-Border Access and Service-Provider Disclosure

Budapest Article 32 permits limited transborder access to publicly available data and, under specified conditions, data disclosed through lawful and voluntary consent. The Second Additional Protocol establishes further procedures concerning domain-name registration information and direct cooperation with certain foreign service providers.

The UN Convention does not reproduce an equivalent standalone provision authorizing the categories of transborder access established by Budapest Article 32. Nor does it establish a general system of direct compulsory disclosure orders addressed to foreign service providers equivalent to the arrangements contemplated by the Budapest Second Additional Protocol.

This difference must be distinguished from direct cooperation between law enforcement authorities. The UN Convention contains several provisions supporting exchanges between competent national authorities, including procedures that do not always require conventional mutual legal assistance.

Article 41 establishes a 24/7 contact network. Like Budapest Article 35, it requires participating states to designate continuously available contact points to facilitate urgent cooperation. The UN provision expressly addresses assistance concerning Convention offenses and electronic evidence relating to serious crimes within the article's defined scope.

Articles 42–44 establish expedited preservation, partial disclosure of traffic information, and mutual assistance in accessing stored electronic data. These procedures substantially resemble mechanisms found in Budapest Articles 29–31.

Article 47 provides a further form of law-enforcement cooperation. It requires states to cooperate closely, consistently with their domestic legal and administrative systems, to improve action against offenses established under the Convention.

The provision includes developing secure communication channels, exchanging information concerning suspects and criminal methods, coordinating inquiries, providing investigative information where appropriate, and facilitating cooperation between competent authorities. It recognizes existing channels, including those of the International Criminal Police Organization.

Article 47(2) also addresses bilateral or multilateral arrangements for direct cooperation between law enforcement agencies. Where such arrangements do not exist, states may consider the UN Convention itself as a basis for mutual law-enforcement cooperation concerning Convention offenses.

Article 48 concerns joint investigations. States are to consider agreements or arrangements allowing competent authorities to establish joint investigative bodies. In the absence of a standing arrangement, joint investigations may take place through agreement in an individual case, with the territorial state's sovereignty respected.

These provisions are distinct from authority to compel a foreign service provider to disclose communications. Police-to-police exchanges, joint investigations, formal mutual assistance, and direct provider disclosure involve different legal acts and different conditions. A request for voluntarily shared investigative information cannot automatically substitute for the legal authorization required to obtain protected data through coercive means.

The comparison consequently cannot be reduced to a contrast between direct Budapest cooperation and exclusively centralized UN procedures. The UN Convention provides for direct cooperation between national law enforcement institutions, while retaining state control over the exercise of coercive investigative authority.

The practical speed of either system will depend on domestic legislation, authorization procedures, service-provider practices, institutional capacity, and the circumstances of the investigation. The legal availability of a procedure alone does not establish that it will produce faster or more reliable evidence.

7.3 Extradition, Dual Criminality, and Cooperation Conditions

Both conventions recognize extradition as an important means of transferring suspects between jurisdictions. Budapest Article 24 covers offenses established in accordance with Articles 2–11, subject to its penalty threshold and applicable extradition conditions.

Article 37 of the UN Convention establishes extradition arrangements for offenses criminalized under that instrument. Its application is subject to the relevant conduct being criminal under the laws of both states, with specified qualifications and exceptions.

Where a requested state makes extradition conditional on the existence of a treaty, it may consider the UN Convention a legal basis for extradition. The provision nevertheless preserves domestic conditions, including relevant minimum penalty requirements and refusal grounds.

Dual criminality remains significant in international criminal cooperation. The concept ordinarily concerns whether the conduct underlying a request constitutes an offense in both jurisdictions, even where the relevant statutes classify or describe the offense differently.

UN Article 35(3) expressly addresses this distinction. Where dual criminality is required, the condition is satisfied if the underlying conduct is criminal in both states, regardless of differences in classification or terminology.

Article 40(8) addresses mutual legal assistance where dual criminality is absent. It permits a requested state to decline assistance in specified circumstances while allowing cooperation at its discretion.

Article 40 also preserves the application of existing mutual-assistance agreements. Under paragraph 7, the detailed procedures in paragraphs 8–31 apply where the relevant states are not bound by another mutual-assistance treaty, unless states already covered by such an agreement decide to apply those procedures instead.

The Budapest Convention similarly limits reliance on dual criminality for particular preservation requests. Its provisions recognize that preserving evidence against imminent loss differs from subsequently disclosing it for use in criminal proceedings.

Neither treaty eliminates national jurisdictional restrictions, procedural requirements, or applicable human rights obligations. The legality of extradition or evidence disclosure depends on the relevant instrument, the circumstances of the request, and the legal obligations binding the requested state.

8. Human Rights Safeguards and Limits on Cooperation

Cybercrime investigations frequently involve information capable of revealing identities, private communications, professional relationships, and sensitive details of individuals' lives. Investigative measures may also affect persons who are not suspected of criminal conduct, including individuals whose information is stored on systems relevant to an investigation.

Both conventions recognize the importance of human rights when investigative powers are exercised. Their safeguards differ in wording, scope, and application. Neither establishes a single procedural code displacing domestic constitutional protections or independently applicable international human rights obligations.

The relevant legal assessment must identify the measure being undertaken, the competent authority, the information sought, the purpose of the investigation, and the conditions governing collection or disclosure. Safeguards for domestic interception do not necessarily govern every international exchange of information in the same way.

8.1 Privacy, Proportionality, and Independent Supervision

Article 15 of the Budapest Convention requires conditions and safeguards governing the establishment, implementation, and application of the domestic procedural powers addressed in its chapter. These must provide adequate protection of human rights and liberties and incorporate proportionality.

The provision also identifies judicial or other independent supervision where appropriate, grounds justifying intervention, and limitations concerning the scope and duration of investigative powers. Its formulation allows differences between national legal systems while establishing treaty obligations concerning fundamental rights.

Article 24 of the UN Convention establishes conditions and safeguards for domestic procedural powers under Chapter IV. It requires compliance with domestic law and applicable international human rights obligations, including proportionality, and identifies safeguards such as judicial or other independent review, effective remedies, grounds justifying intervention, and limitations on scope and duration.

The scope of these provisions is significant. Article 24 principally governs domestic investigative powers established under Chapter IV. It does not automatically impose an identical authorization or review requirement on every exchange between law enforcement authorities under Chapter V.

Article 6 of the UN Convention separately requires implementation in a manner consistent with applicable international human rights obligations. It also prohibits interpreting the Convention as permitting the suppression of human rights or fundamental freedoms.

Article 36 concerns international transfers of personal data under the Convention. It requires transferring states to comply with domestic law and applicable international obligations. States are not required to transfer personal data where doing so would violate their applicable data-protection laws.

Article 36 also requires effective and appropriate safeguards for received personal data within the relevant legal frameworks. Transfers to a third country or international organization require notification to, and authorization from, the original transferring state.

These provisions apply to international data transfers but do not establish an identical, comprehensive system of independent judicial authorization for every cooperation mechanism. Their operation depends partly on national legislation and existing international obligations.

The European Court of Human Rights has addressed related questions under Article 8 of the European Convention on Human Rights. In Benedik v. Slovenia, the Court held that obtaining subscriber information linked to a dynamic IP address interfered with the applicant's protected private life. The inadequate legal basis and safeguards resulted in a violation of Article 8 (ECtHR, 2018).

In K.U. v. Finland, the Court considered the protection of a child whose identity had been used in a sexual online advertisement. It found a violation of Article 8 because the national legal framework had not provided an effective means of identifying the person responsible for the conduct (ECtHR, 2008).

The judgment illustrates that human rights law may impose positive obligations to protect individuals from serious wrongdoing. Privacy protections do not necessarily prohibit investigative disclosure, but access must rest on an appropriate legal basis and be reconciled with competing rights.

In Podchasov v. Russia, the Court examined statutory requirements concerning the retention of internet communications and the ability of authorities to obtain and decrypt information. It found that the breadth of the obligations and the lack of adequate safeguards were incompatible with Article 8 (ECtHR, 2024).

These judgments concern obligations arising under the European Convention on Human Rights. They are not judicial interpretations of the UN Convention against Cybercrime and do not establish that either cybercrime treaty is inherently unlawful.

Their significance lies in the standards they illustrate. Investigative powers require a sufficiently clear legal basis and appropriate protections against arbitrary interference. In certain circumstances, human rights law may also require effective means of investigating serious offenses affecting individual rights.

The application of those principles remains system-specific. European Court judgments directly concern the obligations of states bound by the European Convention on Human Rights, while other participating states may be subject to different regional or universal human rights instruments.

8.2 Refusal Grounds and Politically Motivated Investigations

International criminal assistance creates particular risks when information is exchanged between states with different definitions of criminal conduct or different protections for political participation, expression, and privacy. Conduct protected in one jurisdiction may be criminalized in another, making the conditions governing cooperation especially significant.

Budapest Article 27(4) permits refusal of certain mutual-assistance requests on specified grounds, including circumstances concerning political offenses or prejudice to sovereignty, security, public order, or other essential interests. Its application belongs to the procedural framework established by Article 27 and must be considered alongside other applicable agreements and refusal provisions.

It would be inaccurate to treat Article 27(4) as a universal exception governing every cooperation procedure under Budapest. The legal basis for the request determines which conditions and refusal grounds apply.

UN Article 40 contains detailed provisions concerning refusal of mutual legal assistance. Paragraph 21 identifies circumstances in which assistance may be refused, including procedural deficiencies, prejudice to sovereignty or essential interests, and incompatibility with the requested state's legal system governing the relevant assistance.

Paragraph 22 addresses requests associated with discriminatory or politically motivated proceedings. It provides that the Convention does not impose an obligation to assist where the requested state has substantial grounds for believing that the request seeks prosecution or punishment on specified grounds, including political opinion, or that compliance would prejudice the person's position for those reasons.

The provision preserves a basis for withholding assistance. It does not itself establish an unconditional duty to refuse every request involving politically sensitive conduct. Other applicable human rights obligations may independently prevent cooperation in particular circumstances.

Civil society organizations have criticized the UN Convention's potential application to investigations involving activities protected by international human rights law. In a joint statement issued on October 24, 2025, Human Rights Watch and other organizations argued that the treaty could facilitate cross-border repression where states criminalize peaceful protest, journalism, whistleblowing, or legitimate online expression.

Their concern centered partly on the serious-crime threshold. A domestic offense punishable by a maximum of at least four years' imprisonment may qualify for electronic-evidence cooperation under Article 35 even where the underlying criminal prohibition raises substantial human rights concerns.

The European Data Protection Supervisor addressed the Convention in Opinion 23/2025, issued on September 4, 2025. The Opinion emphasized that international criminal cooperation involving personal data must remain consistent with European Union data-protection obligations and applicable fundamental rights guarantees.

The Supervisor recommended attention to the conditions governing transfers to third countries, the protection of personal information, and the relationship between the Convention and existing European Union law. These recommendations reflected an assessment of the adopted treaty and the proposals for European Union participation.

The criticisms must be distinguished from findings of judicial invalidity. The UN Convention contains human rights provisions, personal-data safeguards, and refusal grounds. The existence of these provisions, however, does not conclusively establish how effectively they will operate in jurisdictions with different constitutional standards and institutional practices.

The competing legal considerations are substantial. International cooperation may help investigators identify offenders, protect victims, and preserve evidence that would otherwise disappear. The same procedures may create risks where requests originate from states that criminalize protected conduct or where domestic supervision is ineffective.

Lawful implementation requires attention to both objectives. The requested authority must examine the legal basis of the request, applicable safeguards, the purpose for which information will be used, and any independent obligations restricting disclosure.

9. Treaty Coexistence and the Future of Cybercrime Cooperation

The adoption of the UN Convention does not terminate, amend, or supersede the Budapest Convention. Both are multilateral treaties founded on state consent, and neither establishes a general hierarchy over the other. Their relationship must be assessed through their respective provisions and the international law governing overlapping treaty obligations.

Article 60 of the UN Convention expressly addresses coexistence with other arrangements. It permits states that have concluded, or subsequently conclude, agreements concerning matters covered by the Convention to continue applying those agreements or regulating their relations accordingly.

Article 60(2) also preserves other rights, restrictions, obligations, and responsibilities under international law. The provision is significant because it does not require states to abandon existing cooperation arrangements when participating in the UN treaty.

The wider law of treaties supplies additional principles. Article 30 of the Vienna Convention on the Law of Treaties addresses successive treaties relating to the same subject matter, including circumstances in which the parties to different instruments are not identical (United Nations, 1969).

Its application depends on the treaties involved, the states participating in them, and any special provisions regulating their relationship. Overlapping subject matter does not automatically establish an incompatibility between obligations.

A state may consequently participate in both cybercrime conventions. Where two states share membership in both instruments, their authorities may possess more than one legal basis for cooperation, depending on the relevant procedure and any applicable agreement.

Participation patterns will influence the practical relationship. Some states are parties to Budapest, others may join only the UN Convention, and some may participate in both. Once in force, the UN treaty may provide an additional cooperation basis between states that do not share membership in the Council of Europe's system.

The European Union illustrates the developing institutional relationship. It participated in the UN negotiations and signed the Convention in Hanoi on October 25, 2025, following Council authorization.

After the European Parliament gave its consent on May 20, 2026, the Council adopted Decision (EU) 2026/1347 on June 4, approving conclusion of the Convention on behalf of the Union. The Decision also approved a declaration of competence and specified reservations.

Ireland and Denmark did not participate in the adoption of that Decision and are not bound by it, in accordance with the relevant treaty protocols governing their positions in the area of freedom, security, and justice.

The Decision's entry into force under European Union law must be distinguished from the UN Convention's international entry into force and the completion of the relevant depositary procedures. The United Nations Treaty Collection's November 2026 record continued to identify the Convention as not yet in force.

Institutional cooperation will also influence the relationship between the treaties. The Budapest Convention operates with support from the Council of Europe's Cybercrime Convention Committee, established through the consultation arrangements in Article 46.

The Committee examines implementation, facilitates exchanges between parties, and considers questions concerning the interpretation and development of the Convention. Its experience reflects the operation of a treaty system in force for more than two decades.

The UN Convention provides for a separate Conference of the States Parties. Its functions include promoting implementation, reviewing relevant information, and considering further arrangements within its mandate.

The institutions do not possess identical legal authority or membership. Cooperation between them may be useful, particularly where states participate in both treaties, but their functions remain determined by their respective legal instruments.

General Assembly Resolution 79/243 also provides for further negotiations concerning a supplementary protocol to the UN Convention. The existence of that mandate does not establish the content of any eventual agreement or alter the obligations contained in the adopted treaty.

Future implementation will require domestic legislation, competent investigative institutions, reliable assistance procedures, and safeguards capable of functioning in practice. Differences in legal systems and institutional resources may substantially affect how states use either instrument.

The Budapest Convention already provides an operative framework supported by established national cooperation arrangements. The UN Convention offers the possibility of broader participation through a separately negotiated treaty system, but its practical results cannot be determined solely from adoption, signatures, or projected membership.

Their future relationship is best understood as potential coexistence involving overlapping obligations, different cooperation procedures, and separate institutional arrangements. The governing legal considerations will remain state consent, territorial jurisdiction, domestic implementation, and compliance with applicable international human rights law.

Conclusion

The Budapest Convention on Cybercrime establishes an operative international treaty framework for criminalizing specified computer-related offenses, obtaining electronic evidence, and facilitating cooperation between national criminal justice authorities. Its legal structure combines substantive criminal-law obligations, domestic investigative powers, and procedures for assistance when criminal conduct or evidence involves several jurisdictions.

The UN Convention against Cybercrime introduces a separately negotiated framework with substantial similarities but significant differences. Its provisions include additional offenses, more extensive arrangements concerning victims and asset recovery, and an international electronic-evidence cooperation system that expressly encompasses serious crimes outside its specifically enumerated offenses.

The UN Convention also provides for cooperation between law enforcement authorities and joint investigations. Its mechanisms must be distinguished from both conventional mutual legal assistance and the limited direct transborder-access procedures established under the Budapest system.

As of November 6, 2026, the difference in legal status remains decisive. Budapest is already in force between its participating states, while the UN Convention awaits the ratifications necessary for entry into force. Its adoption does not displace existing Budapest obligations or establish an automatic hierarchy between the instruments.

The relationship between the treaties will depend on state participation, the legal conditions governing particular forms of cooperation, domestic implementation, and the protection of fundamental rights. Neither instrument removes territorial sovereignty or replaces the human rights obligations binding its parties.

The development of international cybercrime law consequently involves an expansion of treaty-based cooperation rather than the creation of a single international criminal justice system. The central legal question is how states can obtain and exchange electronic evidence effectively while respecting jurisdictional limits, procedural safeguards, and the rights of individuals affected by criminal investigations.

References

Additional Protocol to the Convention on Cybercrime, concerning the Criminalisation of Acts of a Racist and Xenophobic Nature Committed through Computer Systems (2003) Strasbourg, 28 January 2003. European Treaty Series, No. 189. Entered into force 1 March 2006. Available at: https://www.coe.int/en/web/conventions/full-list?module=treaty-detail&treatynum=189 (Accessed: 1 November 2026).

Convention for the Protection of Human Rights and Fundamental Freedoms (1950) Rome, 4 November 1950. European Treaty Series, No. 005. Entered into force 3 September 1953. Available at: https://www.coe.int/en/web/conventions/full-list?module=treaty-detail&treatynum=005 (Accessed: 1 November 2026).

Convention on Cybercrime (2001) Budapest, 23 November 2001. European Treaty Series, No. 185. Entered into force 1 July 2004. Available at: https://www.coe.int/en/web/conventions/full-list?module=treaty-detail&treatynum=185 (Accessed: 1 November 2026).

Council of Europe (2026) ‘Kazakhstan becomes the 84th Party to the Convention on Cybercrime’, 14 October [online]. Available at: https://www.coe.int/en/web/cybercrime/-/kazakhstan-becomes-the-84th-party-to-the-convention-on-cybercrime (Accessed: 2 November 2026).

Council of Europe (n.d.) ‘Cybercrime Convention Committee (T-CY)’ [online]. Available at: https://www.coe.int/en/web/cybercrime/tcy (Accessed: 2 November 2026).

Council of Europe Treaty Office (2026) ‘Chart of signatures and ratifications of Treaty 224: Second Additional Protocol to the Convention on Cybercrime’ [online]. Available at: https://www.coe.int/en/web/conventions/full-list?module=signatures-by-treaty&treatynum=224 (Accessed: 2 November 2026).

Council of the European Union (2025) Council Decision (EU) 2025/2307 of 13 October 2025 on the signing, on behalf of the European Union, of the United Nations Convention against Cybercrime. Official Journal of the European Union, L, 2025/2307, 11 November. Available at: https://eur-lex.europa.eu/eli/dec/2025/2307/oj/eng (Accessed: 2 November 2026).

Council of the European Union (2026) Council Decision (EU) 2026/1347 of 4 June 2026 on the conclusion, on behalf of the European Union, of the United Nations Convention against Cybercrime. Official Journal of the European Union, L, 2026/1347, 19 June. Available at: https://eur-lex.europa.eu/eli/dec/2026/1347/oj (Accessed: 2 November 2026).

European Court of Human Rights (2008) K.U. v. Finland, Application No. 2872/02, Judgment, 2 December. Available at: https://hudoc.echr.coe.int/eng?i=001-89964 (Accessed: 3 November 2026).

European Court of Human Rights (2018) Benedik v. Slovenia, Application No. 62357/14, Judgment, 24 April. Available at: https://hudoc.echr.coe.int/eng?i=001-182455 (Accessed: 3 November 2026).

European Court of Human Rights (2024) Podchasov v. Russia, Application No. 33696/19, Judgment, 13 February. Available at: https://hudoc.echr.coe.int/eng?i=001-230854 (Accessed: 3 November 2026).

European Data Protection Supervisor (2025) EDPS Opinion 23/2025 on the Two Proposals for Council Decisions on the Signing and Conclusion of the United Nations Convention against Cybercrime. Brussels: European Data Protection Supervisor, 4 September. Available at: https://www.edps.europa.eu/system/files/2025-09/25-09-04_opinion_united_nations_convention_against_cybercrime_en.pdf (Accessed: 3 November 2026).

Human Rights Watch et al. (2025) ‘Joint Statement on the Signing of the UN Convention on Cybercrime’, 24 October [online]. Available at: https://www.hrw.org/news/2025/10/24/joint-statement-on-the-signing-of-the-un-convention-on-cybercrime (Accessed: 3 November 2026).

Second Additional Protocol to the Convention on Cybercrime on Enhanced Co-operation and Disclosure of Electronic Evidence (2022) Strasbourg, 12 May 2022. Council of Europe Treaty Series, No. 224. Available at: https://www.coe.int/en/web/conventions/full-list?module=treaty-detail&treatynum=224 (Accessed: 3 November 2026).

United Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes (2024) Adopted 24 December 2024. Annex to United Nations General Assembly Resolution 79/243, A/RES/79/243. Available at: https://mandates.un.org/mandate/A/RES/79/243 (Accessed: 3 November 2026).

United Nations General Assembly (2019) Countering the Use of Information and Communications Technologies for Criminal Purposes. Resolution 74/247, A/RES/74/247, 27 December. Available at: https://digitallibrary.un.org/record/3841023 (Accessed: 6 November 2026).

United Nations General Assembly (2021) Countering the Use of Information and Communications Technologies for Criminal Purposes. Resolution 75/282, A/RES/75/282, 26 May. Available at: https://digitallibrary.un.org/record/3928637 (Accessed: 6 November 2026).

United Nations General Assembly (2024) United Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes. Resolution 79/243, A/RES/79/243, 24 December. Available at: https://digitallibrary.un.org/record/4071955 (Accessed: 6 November 2026).

United Nations Treaty Collection (2026) ‘United Nations Convention against Cybercrime: Status of Signatures, Ratifications and Accessions’, Chapter XVIII, No. 16, status as of 4 November 2026 [online]. Available at: https://treaties-prod.un.org/pages/ViewDetails.aspx?chapter=18&clang=_en&mtdsg_no=XVIII-16&src=TREATY (Accessed: 6 November 2026).

Vienna Convention on the Law of Treaties (1969) Vienna, 23 May 1969. United Nations Treaty Series, Vol. 1155, p. 331. Entered into force 27 January 1980. Available at: https://treaties.un.org/pages/ViewDetailsIII.aspx?chapter=23&mtdsg_no=XXIII-1&src=IND (Accessed: 6 November 2026).