Countries are hiding censorship in 'cybercrime' bills. A UN treaty could make things worse.

Late last year, the United Kingdom, France, China, Iran, Saudi Arabia and dozens more nations signed the United Nations Convention Against Cybercrime, a treaty ostensibly intended to improve global cooperation to fight crimes taking place over computer systems. Canada joined them this summer. The United States remains a notable exception and says it is still reviewing the treaty. 

Three nations have since ratified it, and the treaty will enter into force 90 days after 40 states do so. As FIRE has long warned, the treaty opens the door to greater violations of free expression online — and new cybercrime bills popping up around the world show why.

What does the cybercrime treaty say?

The treaty purports to improve international cooperation in addressing crimes taking place using computer systems — but cooperation is not limited to specific online criminal acts like fraud or phishing. Instead, the treaty pushes nations to share personal data that other nations request about individuals accused of committing “serious” crimes.  

But there’s an important question here. What constitutes a “serious” crime? The treaty does little to define it other than clarifying that it’s a crime carrying at least a four-year prison sentence as a punishment. For billions of people around the world, speech is a crime that warrants a long prison term.

The treaty also would command nations to adopt legislation and measures “as may be necessary to oblige a service provider to keep confidential” the execution of government searches for user data. Even more concerning, a nation seeking data from other countries can request that the user under surveillance not be notified and “may require that the requested State Party keep confidential the fact and substance of the request.”

As I wrote previously about the treaty:

The likely outcome here is obvious: The treaty will streamline unfree countries’ involvement with other unfree countries’ repression and pressure freer ones into helping, too. And it can all take place confidentially, without the knowledge of the public or even those being targeted . . . 

And as though existing national laws punishing political expression aren’t enough, the treaty could even incentivize governments to enact harsher penalties on expressive acts. After all, if you’d like other nations to assist you in punishing your critics on the internet, you’ll want to ensure their expression qualifies for inclusion under the treaty’s definition of “serious crimes.”

How is ‘cybercrime’ legislation evolving?

A review of cybercrime legislation that has emerged in the wake of the treaty suggests that the free speech problems surrounding online “crime” and the UN treaty are just beginning. Take three bills, one of which has been passed by the Malaysian Parliament, under review by legislators this year in countries which signed on to the treaty. When reading the below, keep in mind that the UN treaty defines “serious” crime as that which is punishable by four or more years in prison.

First, Malaysia’s Cybercrimes Bill 2026. Article 19 criticized a number of the bill’s problems, including a lack of procedural safeguards for privacy and other issues, and some provisions that directly target content. The bill criminalizes content “generated or manipulated” by computer systems and “resembling an existing person, object, place, entity or event that falsely appears to a person to be authentic or truthful” with the intent to violate any other existing laws. This new offense is punishable by up to seven years in prison and, as Article 19 points out, runs the risk of targeting “satire, artistic works, journalism, or comments critical of the government.” The group also warns that the bill’s section on “intimate” imagery is written so broadly as to essentially punish any pornographic imagery made or transmitted using computer systems with up to five years in prison.

German bill would criminalize denying Israel’s right to exist

Germany is weighing a bill that would criminalize denying Israel’s right to exist, and offenders could face up to five years in prison.

Read More

Next, let’s look at Namibia’s Cybercrime Bill 2026, the draft of which is still being finalized. In its current form, the bill threatens the vague offense of “cyberbullying” with 10 years’ imprisonment. “Failure to moderate undesirable content” — which includes material that “promotes racism” or is “inaccurate” and intended to “mislead the public” — is punishable with up to five years. Use of computer systems to publish pornography deemed “lascivious or obscene” can net up to 15 years.

And then there’s China’s Draft Law on Cybercrime Prevention and Control, which was published for comment earlier this year but is not yet enacted. Readers are unlikely to be surprised that it seeks to further entrench China’s authoritarianism online. Read Human Rights Watch’s analysis for a full breakdown, but here’s just a glimpse: The bill targets so-called offenses like “disrupting online order,” harming “national security” and “public interest,” “disrupting the real-name management system,” and “disseminating false information.”

While South Sudan and Iraq have not yet signed the treaty, they may yet in the future — and they, too, just unveiled troubling new cybercrime laws.

Every day it seems nations are pursuing new limitations on people’s ability to express themselves online.

South Sudan’s newly enacted Cybercrimes and Computer Misuse Act, 2026 punishes publication of “false or misleading” information that damages a person’s reputation with up to five years in prison, and a similar sentence can be doled out to administrators or intermediaries who don’t take “reasonable steps to restrict or remove access to unlawful content.” And Iraq is reviewing a cybercrime bill that would, among other things, dole out harsh punishments to those who publish what authorities deem “misinformation.”

What does this mean for the future of online expression?

There are, no doubt, serious transnational crimes taking place on the internet that require international cooperation. And there are ways we can improve cross-border collaboration to fight actual crime. But this treaty risks emboldening states that already seek to crush out online dissent, giving them more tools to do so, and enlisting freer states in this campaign.

And, perhaps most concerningly, this treaty may exacerbate what is already a uniquely dangerous era for free speech online. Every day it seems nations are pursuing new limitations on people’s ability to express themselves online, passing privacy-threatening age-gating restrictions, and seeking to gut government critics’ ability to speak anonymously. It’s more urgent than ever that democratic nations seek to reverse this corrosive trend rather than deepen it.