Canada Quietly Signs a UN Treaty It Spent Years Opposing
Ottawa spent years fighting a Russian-proposed UN treaty, then skipped its signing ceremony. Nine months later it signed anyway, in July, without explaining why.
In mid-July, three Canadian cabinet ministers put out a press release announcing that Canada had added its name to the United Nations Convention against Cybercrime. The statement leaned on the treaty's provisions against child sexual abuse material and praised its human rights language as some of the sturdiest ever written into an international criminal justice agreement.
What the announcement did not mention is that Canada spent years arguing this treaty should never exist. It did not mention that Canadian officials sat out the formal signing ceremony in Hanoi nine months earlier. And it did not mention that roughly twenty Canadian civil liberties groups, legal associations and academic researchers had written to the government asking it, in detail, not to do exactly this.
The gap between the press release and the record is the story. As the Ottawa law professor Michael Geist laid out in an analysis of the decision, nothing publicly visible changed between October and July. Only the answer did.
A treaty Moscow wanted and Ottawa resisted
The convention did not start life as a good-governance project. Russia proposed it at the UN in 2017, and its purpose was structural: to build an alternative to the Budapest Convention, the Council of Europe treaty that has governed police cooperation on computer crime since the early 2000s. Russia has never joined Budapest and objects to it on sovereignty grounds — it allows police in one country to reach directly for data stored in another. A rival treaty written at the UN, where Russia and its partners have more allies, could dilute Budapest's influence.
When the General Assembly voted in 2019 to open negotiations, Canada voted no, alongside the United States and the European Union. The stated reason was blunt: this looked like a mechanism for growing state surveillance powers under a criminal-justice label.
They lost the vote. That left the democracies with a choice familiar to anyone who has watched multilateral negotiations — walk away and let Russia, China and Iran draft the text unopposed, or stay in the room and fight over every clause. They stayed, and Canada was among the more forceful delegations. The effort worked in one important respect: the authoritarian bloc's early wish list, which included criminalising categories of online speech and content, did not survive into the version adopted by consensus in December 2024.
Damage limited is not the same as danger removed. Last October, when the treaty was opened for signature in Hanoi, Canada declined to sign. So did the US, Japan, New Zealand, the Netherlands, Italy, Norway, Denmark and Finland. Russia, China, Iran, North Korea, Belarus, Cuba, Venezuela and Saudi Arabia signed. So did the UK, France, Germany, Australia and the EU. Canada's explanation at the time noted that whether the treaty worked would depend entirely on whether states actually honoured the human rights protections written into it — a diplomatic way of saying it did not trust the other signatories to do so.
The definition that does the real work
Understanding the objection means looking past the title. The convention does list specific computer offences — unauthorised system access, malicious software, that sort of thing. But two other parts of the text reach much further.
First, the investigative powers it obliges countries to build are not restricted to hacking cases. They apply to electronic evidence in any criminal matter. Since nearly every criminal case now involves a phone, a message log or a cloud account, that is close to universal coverage.
Second, the obligation to help other countries kicks in for any "serious crime," which the treaty defines by penalty rather than by conduct: any offence a country punishes with four years in prison or more. That single definition is the hinge. Some states jail people for four years or longer for insulting the head of state, for journalism, for blasphemy, for being in a same-sex relationship. Under this framework, those domestic laws become valid grounds for asking Canada — or any other party — to help gather evidence against someone.
Digital rights organisations including the Electronic Frontier Foundation and Human Rights Watch have argued the result is less a crime treaty than a surveillance-sharing arrangement. Their specific complaints are concrete: the convention requires countries to have real-time interception capability, but leaves the question of whether a judge must approve it to each country's own law. It permits secrecy orders that stop a company from telling a customer their data was handed over. And it omits the political offence exception — the traditional escape hatch that lets a country refuse assistance when a prosecution is really about politics.
Who this lands on in Canada
The December 2024 letter from Canadian signatories — among them Amnesty International Canada, the Criminal Lawyers' Association, PEN Canada, OpenMedia, and Citizen Lab researchers Ron Deibert and Kate Robertson — made an argument that is easy to miss from a distance. Canada is home to large diaspora communities whose members criticise governments back home. A permanent, treaty-backed channel for evidence requests gives those governments a routine, legitimate-looking way to pursue critics abroad. The letter also warned the treaty could route around protections built into Canada's existing mutual legal assistance rules, which are designed to let officials say no.
Robertson has separately flagged the risk that the treaty becomes a laundering mechanism for the commercial spyware industry. More than 120 security researchers raised a different alarm: the offences as drafted could criminalise the people who probe systems for weaknesses in order to report them.
The question the announcement skipped
So why now? One plausible explanation sits in Canada's own legislative queue. "Lawful access" is the shorthand for laws compelling companies to hand user data to police. Bill C-22, currently before Parliament, would expand production orders and cross-border data sharing. Ratifying the UN convention — which, unlike signing, creates binding obligations — would require implementing legislation that looks remarkably like C-22. Each makes the other easier to justify.
The practical case for signing is thin. Canada already belongs to Budapest and has bilateral agreements with the countries it actually wants to cooperate with. What the new convention adds, mostly, is a cooperation channel with the states whose participation is precisely what worries the critics.
Signing is reversible; ratification is where the commitment hardens. But a decision announced in July, with no consultation, no response to a detailed public objection and no account of what changed, sets the terms for everything that follows.
Questions
Does signing the treaty mean Canada is now bound by it?
No. Signing indicates political support and an intent to take the treaty seriously, but the binding obligations only attach on ratification, which in Canada would require implementing legislation passed by Parliament. That is the stage where the practical consequences — expanded interception and data-sharing powers — would actually take effect.
What is the Budapest Convention and why does it matter here?
It is the Council of Europe treaty, in force since the early 2000s, that has been the main international framework for cooperation on computer crime. Canada is already a party. Because it covers cooperation with most of Canada's existing partners, critics argue the new UN treaty's main practical addition is cooperation with states like Russia, China and Iran.
How can a cybercrime treaty apply to crimes that have nothing to do with computers?
Two definitions do the work. The treaty's investigative powers cover electronic evidence in any criminal case, not just hacking. And its international cooperation duties apply to any offence a country punishes with four or more years in prison, regardless of what the offence is — which in some countries includes journalism, blasphemy or same-sex relationships.
Why did Canada oppose the treaty originally?
When the UN General Assembly voted in 2019 to begin negotiations, Canada joined the US and EU in voting against, on the grounds that the Russian-led initiative was a vehicle for expanding state surveillance powers. Having lost the vote, Canada participated in the drafting to limit the damage, and succeeded in keeping proposed speech and content offences out of the final text.