---
title: "Canada Quietly Signs a UN Treaty It Spent Years Opposing"
description: "Canada signed the UN cybercrime treaty in July after years opposing it. Critics call it a cross-border surveillance pact, not a crime convention."
dek: "Ottawa spent years fighting a Russian-proposed UN treaty, then skipped its signing ceremony. Nine months later it signed anyway, in July, without explaining why."
published_at: "2026-08-02T13:23:27.708Z"
updated_at: "2026-08-02T13:23:27.708Z"
tags:
  - "Privacy"
  - "Policy"
  - "Security"
source_url: "https://www.michaelgeist.ca/2026/07/a-surveillance-treaty-in-disguise-the-trouble-with-canadas-quiet-decision-to-sign-the-un-cybercrime-convention/"
source_domain: "michaelgeist.ca"
canonical: "https://hex37.com/canada-quietly-signs-un-treaty-it-spent-years-opposing"
---

In mid-July, three Canadian cabinet ministers put out a press release announcing that Canada had added its name to the United Nations Convention against Cybercrime. The statement leaned on the treaty's provisions against child sexual abuse material and praised its human rights language as some of the sturdiest ever written into an international criminal justice agreement.

What the announcement did not mention is that Canada spent years arguing this treaty should never exist. It did not mention that Canadian officials sat out the formal signing ceremony in Hanoi nine months earlier. And it did not mention that roughly twenty Canadian civil liberties groups, legal associations and academic researchers had written to the government asking it, in detail, not to do exactly this.

The gap between the press release and the record is the story. As the Ottawa law professor Michael Geist [laid out in an analysis of the decision](https://www.michaelgeist.ca/2026/07/a-surveillance-treaty-in-disguise-the-trouble-with-canadas-quiet-decision-to-sign-the-un-cybercrime-convention/), nothing publicly visible changed between October and July. Only the answer did.

## A treaty Moscow wanted and Ottawa resisted

The convention did not start life as a good-governance project. Russia proposed it at the UN in 2017, and its purpose was structural: to build an alternative to the [Budapest Convention](https://en.wikipedia.org/wiki/Budapest_Convention_on_Cybercrime), the [Council of Europe](https://en.wikipedia.org/wiki/Council_of_Europe) treaty that has governed police cooperation on [computer crime](https://en.wikipedia.org/wiki/Cybercrime) since the early 2000s. Russia has never joined Budapest and objects to it on sovereignty grounds — it allows police in one country to reach directly for data stored in another. A rival treaty written at the UN, where Russia and its partners have more allies, could dilute Budapest's influence.

When the General Assembly voted in 2019 to open negotiations, Canada voted no, alongside the United States and the European Union. The stated reason was blunt: this looked like a mechanism for growing state [surveillance](https://en.wikipedia.org/wiki/Surveillance) powers under a criminal-justice label.

They lost the vote. That left the democracies with a choice familiar to anyone who has watched multilateral negotiations — walk away and let Russia, China and Iran draft the text unopposed, or stay in the room and fight over every clause. They stayed, and Canada was among the more forceful delegations. The effort worked in one important respect: the authoritarian bloc's early wish list, which included criminalising categories of online speech and content, did not survive into the version adopted by consensus in December 2024.

Damage limited is not the same as danger removed. Last October, when the treaty was opened for signature in Hanoi, Canada declined to sign. So did the US, Japan, New Zealand, the Netherlands, Italy, Norway, Denmark and Finland. Russia, China, Iran, North Korea, Belarus, Cuba, Venezuela and Saudi Arabia signed. So did the UK, France, Germany, Australia and the EU. Canada's explanation at the time noted that whether the treaty worked would depend entirely on whether states actually honoured the human rights protections written into it — a diplomatic way of saying it did not trust the other signatories to do so.

## The definition that does the real work

Understanding the objection means looking past the title. The convention does list specific computer offences — unauthorised system access, malicious software, that sort of thing. But two other parts of the text reach much further.

First, the investigative powers it obliges countries to build are not restricted to hacking cases. They apply to electronic evidence in any criminal matter. Since nearly every criminal case now involves a phone, a message log or a cloud account, that is close to universal coverage.

Second, the obligation to help other countries kicks in for any "serious crime," which the treaty defines by penalty rather than by conduct: any offence a country punishes with four years in prison or more. That single definition is the hinge. Some states jail people for four years or longer for insulting the head of state, for journalism, for blasphemy, for being in a same-sex relationship. Under this framework, those domestic laws become valid grounds for asking Canada — or any other party — to help gather evidence against someone.

Digital rights organisations including the Electronic Frontier Foundation and Human Rights Watch have argued the result is less a crime treaty than a surveillance-sharing arrangement. Their specific complaints are concrete: the convention requires countries to have real-time interception capability, but leaves the question of whether a judge must approve it to each country's own law. It permits secrecy orders that stop a company from telling a customer their data was handed over. And it omits the political offence exception — the traditional escape hatch that lets a country refuse assistance when a prosecution is really about politics.

## Who this lands on in Canada

The December 2024 letter from Canadian signatories — among them Amnesty International Canada, the Criminal Lawyers' Association, PEN Canada, OpenMedia, and Citizen Lab researchers Ron Deibert and Kate Robertson — made an argument that is easy to miss from a distance. Canada is home to large diaspora communities whose members criticise governments back home. A permanent, treaty-backed channel for evidence requests gives those governments a routine, legitimate-looking way to pursue critics abroad. The letter also warned the treaty could route around protections built into Canada's existing mutual legal assistance rules, which are designed to let officials say no.

Robertson has separately flagged the risk that the treaty becomes a laundering mechanism for the commercial spyware industry. More than 120 security researchers raised a different alarm: the offences as drafted could criminalise the people who probe systems for weaknesses in order to report them.

## The question the announcement skipped

So why now? One plausible explanation sits in Canada's own legislative queue. "Lawful access" is the shorthand for laws compelling companies to hand user data to police. Bill C-22, currently before Parliament, would expand production orders and cross-border data sharing. Ratifying the UN convention — which, unlike signing, creates binding obligations — would require implementing legislation that looks remarkably like C-22. Each makes the other easier to justify.

The practical case for signing is thin. Canada already belongs to Budapest and has bilateral agreements with the countries it actually wants to cooperate with. What the new convention adds, mostly, is a cooperation channel with the states whose participation is precisely what worries the critics.

Signing is reversible; ratification is where the commitment hardens. But a decision announced in July, with no consultation, no response to a detailed public objection and no account of what changed, sets the terms for everything that follows.