A Surveillance Treaty in Disguise: Canada Quietly Signs UN Cybercrime Convention

Canada signed the UN Cybercrime Convention in mid-July with little notice, but critics say it's less about cybercrime and more about cross-border surveillance.

In mid-July, while most Canadians were on summer holiday, the federal government quietly signed the United Nations Convention against Cybercrime — a treaty it had pointedly refused to sign at the official ceremony in Hanoi just nine months earlier. The announcement, framed around child protection and human rights safeguards, omitted the part where twenty Canadian civil society organizations, leading human rights groups, and over 120 security researchers had all urged the government to stay out.

The convention began in 2017 as a Russian initiative designed to displace the Budapest Convention, which Russia refuses to join. When the UN General Assembly voted to launch negotiations in 2019, Canada stood with the United States and the European Union in opposition, warning the process was a vehicle for expanding state surveillance. Having lost that vote, Western democracies chose to engage from within rather than let Russia, China, and Iran write the rules alone. Canada was among the most active delegations pressing for human rights safeguards — and then, when the treaty was adopted by consensus in December 2024, it didn't show up to sign.

What changed between October and July is not clear. The government has offered no explanation, no public consultation, and no response to the detailed letter from Amnesty International Canada, the Criminal Lawyers' Association, PEN Canada, OpenMedia, and the Citizen Lab, all of whom warned the treaty converts repressive domestic laws into triggers for cross-border evidence gathering. Because the convention applies to any "serious crime" — defined as an offence carrying four or more years of imprisonment — countries that criminalize journalism, blasphemy, or same-sex relationships gain a standing channel to demand electronic evidence from Canada.

The Electronic Frontier Foundation and Human Rights Watch have both warned the treaty functions as a global surveillance pact: it requires signatories to establish real-time interception and data collection powers, allows gag orders on cooperation requests, and omits a political offence exception. Kate Robertson of the Citizen Lab has separately warned it could become a vehicle for complicity in the mercenary spyware trade.

The geopolitical split in signatories tells its own story. Russia, China, Iran, North Korea, Belarus, Cuba, Venezuela, and Saudi Arabia have all signed. So have the United Kingdom, Australia, France, Germany, and the European Union. The United States, New Zealand, Japan, the Netherlands, Italy, Norway, Denmark, and Finland — Canada's closest democratic allies — have not. Canada now stands with the former group while the countries it normally aligns with on digital rights remain outside.

One theory, advanced by University of Ottawa law professor Michael Geist, is that the signature is tied to Canada's domestic lawful access agenda. Ratification will require implementing legislation with expanded production orders and cross-border data sharing — precisely the powers already embedded in Bill C-22. Canada already has the Budapest Convention and bilateral treaties covering cooperation with the countries it actually wants to work with. The marginal value of this new convention lies chiefly in cooperation with the very states that create its greatest risks.

The signature does not create binding obligations — that requires ratification by Parliament — but the decision to sign a treaty the government itself boycotted less than a year ago, in the middle of summer with no consultation, raises questions that a sunny press release cannot answer.

Sources: Michael Geist — A Surveillance Treaty in Disguise, Government of Canada — Canada signs United Nations Convention against Cybercrime