1. Introduction
Cybercrime has become a global concern due to its transnational character and evolving nature.Footnote 1 According to the 2024 Cyberthreat Defense Report issued by CyberEdge Group, cybercrimes such as data breach, identity theft, and others not only plague 72 per cent of organizations around the world, but also afflict almost everyone accessible to Internet services.Footnote 2 In response, 156 countries (80 per cent) have enacted cybercrime legislation at the domestic level,Footnote 3 and 128 states (65.64 per cent) have acceded to eight treaties on cybercrime under six regional organizations since 2001.Footnote 4 These efforts have facilitated international co-operation of countering cybercrime by ‘rules and procedures that … guide, steer, and constrain the actions (or nonactions) and conditions of existence of others’,Footnote 5 but are not enough to produce global collective action.
Pre-existing studies have had diverse discussions on countering cybercrime at the transnational level.Footnote 6 First, pre-existing studies show that ‘cybercrime’ is an open-ended concept. Early scholars have had extensive discussions on classifying ‘cybercrime’, and they have largely agreed on a tripartite classification that has depended on the role of technology in the commission of crime.Footnote 7 Nevertheless, more recent studies indicate that the boundary of ‘cybercrime’ is not clear.Footnote 8 For example, incitement to commit genocide on the Internet may both constitute transnational cybercrime and one of the ‘core crimes’ subject to the International Criminal Court.Footnote 9 Also, some scholars have implied that ‘cybercrime’ could entail cyberattacks and cyber espionage not committed by a state actor.Footnote 10
Second, scholars recognize that regulatory divide attributable to economic and institutional factors of states is a major obstacle to transnational lawmaking on cybercrime.Footnote 11 For example, some states such as Cambodia and Ethiopia apply a paternalist approach that recognizes national security instead of human rights as the more prevailing ‘good’ that needs to be protected in cyberspace.Footnote 12 In contrast, some states such as the United Kingdom (UK) criminalize certain offences facilitated by digital technology, such as hate speech, which positively correlates with offline racially and religiously aggravated crime.Footnote 13 Furthermore, there are contentions on the extension of criminal law to offences like hate speech due to its severe sanction on a certain type of free expression and its potential greater social harm than leaving it outside the criminal law.Footnote 14 For example, Irving indicates that the UN Special Rapporteur on Freedom of Opinion and Expression and civil society is reluctant to support state regulation of atrocity speech because domestic criminalization could become an instrument of ‘suppress[ing] political dissent online under the guise of suppressing hate speech and incitement’.Footnote 15 In this regard, it is still preferrable to channel offences in cyberspace to tort law and other non-criminal law,Footnote 16 even when digital technology as a ‘force multiplier’ that facilitates offences ‘to be committed on a scale that could not be achieved in the offline environment’.Footnote 17
Third, scholars have diverged on the effective solution, namely by (i) concluding treaties, (ii) customary international law, or (iii) regime complex, to counter cybercrime. Some scholars have praised that treaties concluded between states should be the most effective method of preventing and prosecuting (certain types of) cybercrime by harmonizing the domestic criminal laws.Footnote 18 Nevertheless, some scholars have pointed out that even the Budapest Convention cannot mitigate regulatory differences across states because it has not adequately addressed data protection and privacy concerns, provided a clear guidance to identify who should be responsible to prosecute cybercrime, established effective enforcement mechanisms, enabled participation of developing states and others.Footnote 19 In this regard, Cody pointed out that any response to cybercrime must be flexible and evolving; therefore, customary international law along with principles borrowed from economics to align interests of states should be the most efficient and effective means.Footnote 20 Also, the engagement of private actors in countering cybercrime has long deemed necessary to respond to cybercrime due to the incremental effects on behaviour in cyberspace in a society.Footnote 21 For example, Mačák and other scholars have indicated that the engagement of non-state actors is not to replace decision-making processes of sovereign states but to provide an alternative solution to global governance of cybercrime by meeting the needs of states for highly specialized knowledge and direct control of information systems.Footnote 22 Nevertheless, this proposal is not without problems unless there is a stable legal framework to allocate roles and functions of private actors in law enforcement.Footnote 23 In particular, it is recognized that ‘cybercrime may yet—and should—cause transformations in how transnational criminal justice is configured, with more focus on the people affected as suspects and witnesses, and less focus on nation states’.Footnote 24
The pre-existing studies contribute to explaining that (i) evolving nature of cybercrime; (ii) national disparities; (iii) policy preferences at the transnational level are the main obstacles to global collective action against countering cybercrime. Nevertheless, the pre-existing studies have taken ‘cybercrime’ as ipso facto without observing (i) how ‘cybercrime’ has been framed under the pre-established treaties; (ii) if and how ‘cybercrime’ is evolving at the transnational level; and (iii) how evolution of ‘cybercrime’ enlightens potential strategies for global co-operation in countering cybercrime. Notwithstanding, the clarifications are essential to understand (i) how international co-operation of countering cybercrime has been operating; (ii) to what extent limits of international law to national power could be accepted in the international society; (iii) how inherent weakness of international law may affect global collective action against countering cybercrime. In this regard, this article will fill in the gaps. Methodologically, a socio-legal approach which is interdisciplinary by bringing Transnational Criminal Law (TCL) into dialogue with the conceptual framework of recursivity will be adopted.Footnote 25 TCL, which reveals obscurity in international criminal law and crimes of international concern, contributes to contextualizing ‘cybercrime’ in the pre-existing regional prohibition regimes, while recursivity helps illuminate legal changes emerging from the UN negotiating processes on formulating a scheme for global collective action against cybercrime.Footnote 26 This article argues that normative changes in transnational criminalization of ‘cybercrime’ reflect that a common interest is crystallizing without common understanding. Therefore, this author proposes that states should maintain a minimum public order to avoid stagnation of international co-operation in countering cybercrime. The structure of this article goes as specified: following the Introduction, Section 2 presents how TCL and recursivity as the conceptual frameworks will methodologically contribute to contextualizing concepts in prohibition regimes and illuminating legal changes under the international legal system; Section 3 analyses how the pre-existing treaties shape ‘cybercrime’ and what the implications of the framing are; Section 4 presents and analyses different positions of states in negotiations on framing cybercrime under the UN. In particular, the observations serve determination of state practice and opinio juris, which further helps define rights and obligations of states in cyberspace under international law;Footnote 27 Section 5 discusses implications of the normative changes by arguing that global ‘denationalization’ and ‘renationalization’ of ‘cybercrime’ is unlikely in the international society without central enforcement mechanism, when states are still working on adapting human and sovereignty in cyber governance by expanding old regulation and creating new rules to deal with law in computation;Footnote 28 Section 6 concludes this article.
2. The conceptual frameworks for framing transnational crime
2.1 Transnational criminalization: A conceptual construct
Transnational criminalization is a constructive set of processes that ‘locate, perceive, identify, and label’ certain activities ‘transcending international borders, transgressing the laws of several states or having an impact on another country’ as crimes.Footnote 29 Essentially, transnational criminalization does not ‘criminalize’ but seeks common ground on prosecuting criminals at a levelling playing field across states.Footnote 30 In other words, only ‘the indirect suppression by international law through domestic penal law of criminal activities’Footnote 31 is created to aim at ‘fending off harmful behaviour … necessarily geared to protection of what are legitimate interests’.Footnote 32 In practice, states always need to persuade domestic and foreign audiences to accept that international intervention in the internal affairs of other states should be justifiable and legitimate.Footnote 33 Therefore, transnational criminalization by no means produces ‘a neutral system of disincentives that convey no disapproval’Footnote 34 but only sets ‘a base line of criminalization and punishment’ without obstructing discretion and autonomy of states to create offences with broader scopes or more severe punishments.Footnote 35 For example, the US Supreme Court ruled that forcible abduction of Alvarez-Machain, a Mexican, by agents of the Drug Enforcement Administration (DEA) to the US after failing ‘to gain respondent’s presence in the United States through informal negotiations with Mexican officials’ was not a shield from being tried ‘in a court in the United States for violations of the criminal laws of the United States’.Footnote 36
Generally, transnational criminalization can produce two effects. One is that a state has justifications to police extraterritorially and/or render adjudication with extraterritorial effects by ‘establish[ing] their jurisdiction over persons, property, and acts outside their territory, limited only in certain cases by pre-existing “prohibitive rules” of international law’.Footnote 37 For example, the ICJ indicates in the Immunities and Criminal Proceedings case that a requirement of double criminality under ‘Article 6 (2)(c) of the Palermo Convention does not provide for the exclusive jurisdiction of the State on whose territory such an offence was committed’.Footnote 38 The other is to reshape domestic criminal law, which will be re-uploaded to alter international lawmaking processes and further influence other national laws.Footnote 39 For instance, some developing states such as China and Brazil are also influencing the process of transnational criminalization, which was historically subject to the crime control policies of the developed states, to block criminal flows originating in developing states.Footnote 40 Notwithstanding, transnational criminalization does not necessarily mitigate jurisdictional conflicts which could result in international discord as it is long recognized that the best place of punishment should be the place where the crime was committed.Footnote 41
2.2 Transforming transnational criminalization in plurality
Undoubtedly, plural sources of legal normativity with heterogeneity of interests coexist in the international legal sphere without either complete autonomy or dependency: states operate through the balance of power, producing (i) actor mismatch; (ii) diagnostic struggles; (iii) contradictions; and (iv) indeterminacy of law, as four incentives that change the course of international decision-making processes including transnational criminalization.Footnote 42
First, actor mismatch arises from normative interactions when stakeholders are excluded from law-making processes: the excluded actors may marginalize the laws, which would frustrate the regulatory goals.Footnote 43 One example is the Rome Statute of the International Criminal Court (the Rome Statute) which has not embodied China’s stance of rejecting automatic jurisdiction and preferring an opt-in system; therefore, the Rome Statute has lost its goal of inviting universal participation due to China’s final opposing vote.Footnote 44 Second, disagreements with the scope of the conduct or ‘over whether a social problem should be addressed through criminal law measures or alternative policies’ in crime controls would trigger diagnostic struggles.Footnote 45 For example, both China and the UK criminalize sexual offences, but China does not criminalize ‘forced sodomy on other men or young boys older than age fourteen’.Footnote 46 In practice, the struggles would drive domain expansion that produces new conceptualization of social problems and stretch the definitional boundaries of the targeted phenomenon.Footnote 47 Third, unresolved tensions in and between norms may lead to contradictions which ‘seek simultaneously to satisfy competing ideologies in the same law without resolving … to the mutual satisfaction of the conflicting parties to lawmaking’.Footnote 48 A tension between drug control and guarantees of the right to liberty and security of person under the Single Convention on Narcotic Drugs which allows deprivation of liberty as penal sanctions on drug abuse without clearly setting a limit to sovereign prerogative can be an example.Footnote 49 Operationally, contradictions strengthen the norms when contester(s) can reconstruct the pre-existing authorit(ies), and vice versa.Footnote 50 Fourth, an intention of states to compete for interpretative authority would cause indeterminacy of law.Footnote 51 Developing countries often adopt such a strategy in formulating regional trade agreements with higher flexibilities to adapt diverse interests and preferences.Footnote 52 Nevertheless, indeterminacy would dampen a regime’s ability to operate as ‘a system of rules coordinating the freedom of actors who behave in line with a purposive rationality’.Footnote 53
In practice, whether a cycle of normative changes may end up modifying pre-existing rules depends on persuasiveness which is conditioned by (i) support of multiple great powers; (ii) consistency with dominant epistemic justification in the international legal order; and (iii) sufficiency of normative bases.Footnote 54 Simultaneously, conceptual and/or operational internalization at the domestic level decide whether transformation would be successful.Footnote 55 Otherwise, states would be prompted to retreat and to resort to opportunistic alliance/partnership to reap profits at the expense of institutional capacity and longevity.Footnote 56 Currently, stagnation in multilateral law-making is general due to asymmetric power structures arising from great power rivalry and a shifting distribution of global power under weakened multilateral institutions.Footnote 57
3. Transnational criminalization of cybercrime in the fragmented world
3.1 The regional regimes as clubs
The eight treaties on cybercrime as noted in the Introduction have uneven distribution with modest overlaps as specified in Figure 1.Footnote 58
Current multilateral treaties on countering cybercrime and their overlaps
Evidently, the treaties have been club goods with different leveraging power: the Budapest Convention, with all member states of the EU, 11 American countries including the US, five African states, five Asian states, and two Oceanian states, not only has the greatest institutional power but also has significant productive power to diffuse knowledge and discursive practices as many Pacific Island Countries (PICs) that are non-parties have imported its provisions into domestic legislation.Footnote 59 Conversely, the Agreement on Cooperation in Ensuring International Information Security between the Member States of the Shanghai Cooperation Organization (ACEIIS) only share members with the Treaty establishing the Commonwealth of Independent States (CIS Agreement), which has limited the spread of the norms and enabled the states with dual membership to move between the two venues for the sake of convenience and benefits.Footnote 60 Additionally, the Arab Convention on Combating Information Technology Offences (ACCITO) also has scarce intersection with the other treaties probably because the Arabian states intend to be flexible in balancing power in a co-ordinated manner by the identity of Islam.Footnote 61 In turn, they are cautious about ‘separat[ing] states who are seriously interested in cooperation from those who have more exploitative motivations’.Footnote 62
3.2 Criminalizing ‘cybercrime’ in normative plurality: Scopes, liability, and conditions
This section observes the contours of cybercrime under the treaties from three dimensions: (i) the scopes of offences; (ii) the scope of criminal liability; and (iii) the conditions of criminal liability.
3.2.1 Kaleidoscopic ‘cybercrime’
Given the elasticity of ‘cybercrime’ ranging from ‘direct attacks against systems and networks, with the goal of flaunting institutions by crashing systems or causing physical damage’ to ‘the manipulation of social media and the theft or purchase of personal profiles’,Footnote 63 only the CIS Agreement and ACEIIS define ‘cybercrime’ as ‘a criminal act … whose encroachment is computer information’Footnote 64 and ‘using information resources and/or influencing them in the information space for illegal purposes’.Footnote 65 Simultaneously, ‘cybercrime’ under the treaties all includes two categories of offences, namely cyber-dependent offences that are ‘malicious activities that would not exist outside of the digital realm’ and cyber-enabled offences that digital technology is leveraging to amplify existing forms of offending.Footnote 66 First, all the treaties recognize (i) unauthorized access to computers or computer systems; (ii) malicious software; and (iii) denial of service attacks as cyber-dependent offences, but states can still have ‘discretion in implementation as to … [create] an idiosyncratic representation of different features or elements of the conventions in a number of different pieces of national legislation’:Footnote 67 the similarity in cyber-dependent offences may simply represent coincidence in wide abhorrence of harmful behaviour rather than substantive harmonization of domestic criminal law, which is sufficient to enable international co-operation.Footnote 68 For example, unlike the US, the UK does not prescribe a conduct that ‘exceeds authorised access’ to obtain information as illegal access, although both countries are parties to the Budapest Convention.Footnote 69
Second, the treaties diverge greatly on cyber-enabled offences as specified in Table 1:
Types of cyber-enabled offences under the treaties
Essentially, domestic criminal law and culture serve as a pivotal conditioning factor. For example, the CIS Agreement does not require states to proscribe fraud and forgery in cyberspace given disparities in the domestic criminal laws of the CIS member states: Articles 281–282 of the Criminal Code of the Republic of Tajikistan address general forgery without any digital element, while Azerbaijan does not criminalize ‘fraud’ per se.Footnote 70 The situation is similar in child pornography because ‘minor’ is an aggravating factor instead of an independent punishable crime under the Russia Criminal Code.Footnote 71 Simultaneously, the ACCITO and Directive on Fighting Cybercrime within Economic Community of West African States (DFC) require complete prohibition of pornography which is ‘unethical’ in Islamic norms which pervade both regions.Footnote 72 Furthermore, the scope of cyber-enabled offences would be implicitly enlarged under the ACEIIS, ACCITO, DFC, and the African Union Convention on Cyber Security and Personal Data Protection (CCSPDP) as ‘State Parties shall take the necessary legislative and/or regulatory measures to consider as aggravating circumstances the use of information and communication technologies to commit offences such as … money laundering’.Footnote 74 Nevertheless, these proscriptions may result in vague and broad rules that do not ‘satisfy the cumulative conditions of legality, necessity and legitimacy’ at the domestic level.Footnote 75 For example, the Mauritian Information and Communication Technologies Act 2001 provides that ‘in any other manner contravenes this Act or any regulations made under this Act, shall commit an offence’ which brings about ‘a fine not exceeding 1,000,000 rupees and to penal servitude for a term not exceeding 10 years’.Footnote 76
3.2.2 No agreement on when to be accountable for ‘cybercrime’
First, some treaties such as the CIS Agreement and ACEIIS lack proscriptions of attempts and complicity, which suggests that the states lack a co-ordinated standard for constraining risks arising from cybercrime:Footnote 77 attempts and complicity are probabilities that crime would follow uponFootnote 78 and ‘assistance or encouragement someone gives another in the commission of a crime as itself a crime’.Footnote 79 In practice, such an absence would dampen the goal of the treaties ‘to mark out that range of pre-existing (pre-criminal) wrongs that the polity will treat as public wrongs, and for which citizens will therefore be called to account, convicted, and punished by the polity’s criminal courts’Footnote 80 because ambiguity in the texts is the room left for later fine-tuning of those unresolved disagreements or uncertainties.Footnote 81 Second, only the Budapest Convention and CCSPDP require the states to prescribe ‘intention’ as the central and most grave mental state in constituting ‘cybercrime’,Footnote 82 although most of the treaties except the ACEIIS ascribe ‘the property of bodily-movement-caused-by-a-volition’.Footnote 83 In other words, there is significant disparity in whether preventive efficacy of public censure at the expense of ‘an essential safeguard against unjust convictions and disproportionate punishment’ should be prioritized:Footnote 84 mens rea ‘restrict[s] criminal statutes to conduct that is “inevitably nefarious”’Footnote 85 and helps avoid charges of ‘mistaken or careless acts of unauthorized access of a computer or data therein’.Footnote 86 For example, the Supreme Court of the United States in Rehaif v. United States provides that the application of mens rea ‘helps to separate wrongful from innocent acts’,Footnote 87 although there is always a ‘fit problem’ between intention and harm.Footnote 88
3.3 Appraisal
The aforementioned observations and analyses on ‘cybercrime’ under the treaties demonstrate that states have wide demands for framing ‘cybercrime’ under ‘a multiplicity of domestic legal systems in loose array’Footnote 89 by simple clarification of ‘the general and abstract question whether a crime has been committed’.Footnote 90 Nevertheless, no shared ‘understanding of the nature of particular wrongs and the way these are protected in law’Footnote 91 has emerged from the aspirations to help set ‘legal limits that delimit [sovereign] scope of action, that confer power by allocating it’Footnote 92 at the transnational level: even the similarity between the Budapest Convention and CCSPDP may only reflect that the European states have embedded its institutions in Africa through colonization, foreign aid, cultural influence, and political engagement.Footnote 93 Correspondingly, unavoidable norm conflicts and strategic rivalry may arise, especially when the treaties have different institutional capacities.Footnote 94 For example, Armenia and Azerbaijan by participating in the CyberEast under the Budapest Convention have been recommended to ‘take action against all proceeds of crime involving [virtual assets]’ through measures adapted to domestic circumstances to counter online fraud,Footnote 95 but there is no resolution device to clarify whether the recommendations are compatible with the commitments under the CIS Agreement.Footnote 96 Otherwise, ‘undue encroachment on a jurisdiction more properly appertaining to, or more appropriately exercisable by, another State’ would still occur.Footnote 97 What the Supreme Court of Norway has suggested in Tidal Music AS v. The public prosecution authority about the exercise of investigative power is a good example: ‘Tidal [as] a group of companies domiciled among other places in the USA and several European countries’ is not preconditioned on state consent because
it is not easy to tell on which server a Norwegian user’s data is stored, and the storage place may be changed over time without the user knowing or being able to control it. Although one agrees that the physical storage place is not in Norway, the state in which the data is stored at any given time may – as demonstrated in this case – be unknown.Footnote 98
Correspondingly, a gap between ‘the extent of international law’s claim to legitimate authority and the effective scope of its legitimacy’Footnote 99 may arise: just as Bianchi writes that ‘in a highly complex normative system without any centralized authority, issues of coordination and conflict among its different components are likely to arise and their solution may not be immanent’, states may resort to ‘a transparent disguise for instrumentalism based on domestic criminal law models’ as an alternative until ‘the drifting of the discipline towards a higher degree of specialization’.Footnote 100 In response, the human rights instruments are de facto exercising public authority, although some of the treaties that expand the scope of cyber-enabled crimes are resisting human rights inflation.Footnote 101 For example, the European Court of Human Rights (ECtHR) in K.U. v. Finland indicates that the state has a positive obligation to protect a teenager who was the victim of online child pornography even when ‘any legislative shortcoming should be seen in its social context at the time’ and ‘freedom of expression and confidentiality of communications are primary considerations and users of telecommunications and Internet services must have a guarantee that their own privacy and freedom of expression will be respected’.Footnote 102 Also, the ECOWAS Court of Justice indicates in The Incorporated Trustees of Laws and Rights Awareness Initiatives v. The Federal Republic of Nigeria that Section 24 of the Cybercrime Act is ‘not necessary in a democratic society and disproportionately violate[s] the right to freedom of expression’ by ‘plac[ing] restrictions on freedom of expression to protect the rights of others, has established penal punishment for conducts that it considers offensive to honor, consideration, reputation, morals, etc., with high penalties of fine … and imprisonment …’Footnote 103 In a sense, the reasonings imply a move to ‘frame the issue either as a special kind of politics or as above politics’ to respond to negative effects arising from rapid advancement of digital technologiesFootnote 104 given ‘the operative part of the final judgment [extends] far beyond the individual case identifying structural problem, [which] request[s] the respondent state party to adopt specific general and/or individual measures’.Footnote 105
Nevertheless, what if such a political morality for states to prioritize protection of human rights as an assumed legal ideal is simply a demand of liberal democracy for ‘an alignment of law and morality around the model of individual choice and responsibility’?Footnote 106 Judge Oda stated in the Separate Opinion of the Legality of the Use by a State of Nuclear Weapons in Armed Conflict that ‘the WHO lack the competence to submit a request for advisory opinion to the Court on the above-mentioned question, which appears not to arise “within the scope of [its] activities”’, but originates from lobbying of some non-governmental organizations (NGOs).Footnote 107 In this regard, constraints on sovereign power of countering cybercrime in the name of human rights protections would not necessarily resolve normative conflicts but act as ‘Western domination over the making of international law’:Footnote 108 let alone the Universal Declaration of Human Rights (UDHR) requires states to ‘strive … by progressive measures, national and international, to secure their universal and effective recognition and observance, both among the peoples of Member States themselves and among the peoples of territories under their jurisdiction’, heterogeneity does not obstruct ‘a harmony of interests which has a basis more real and tangible than the illusions of the sentimentalist or the hypocrisy of those satisfied with the existing status quo’.Footnote 109 Otherwise, it would be impossible to answer the question about individual duties owed to sovereignty when economic globalization directed by Western liberalism has made non-state actors instead of sovereignty the major violators of human rights.Footnote 110
4. Global framing of ‘cybercrime’
4.1 Global incremental law-making on countering cybercrime
The current negotiating processes on cybercrime under the UN are not the first attempt of states to form a guarantee mechanism in relation to obligations and situations arising from transnational prosecution of cybercrime.Footnote 111 As early as 1998, states considered ‘developing international principles that would … help to combat information terrorism and criminality’ under the UN First Committee, but the decision-making processes have grown into a non-legislative act which mainly focuses on crystallizing norms that stipulate minimum standards for state behaviour in cyberspace.Footnote 112 Precisely, states did not ‘invite the Commission on Crime Prevention and Criminal Justice [CCPCJ] … to examine the feasibility of providing further assistance in that area under the aegis of the United Nations in partnership with other similarly focused organizations’Footnote 113 until the Eleventh United Nations Congress on Crime Prevention and Criminal Justice (UNCCPCJ) in 2005. At the Twelfth UNCCPCJ, states further recognized that the United Nations Office on Drugs and Crime (UNODC) should help states ‘improve national legislation and build the capacity of national authorities … to deal with cybercrime’ upon request, while mandating the CCPCJ to:
consider convening an open-ended intergovernmental expert group [OEIEG] to conduct a comprehensive study of the problem of cybercrime and responses to it by Member States, the international community and the private sector … with a view to examining options to strengthen existing and to propose new national and international legal or other responses to cybercrime.Footnote 114
In 2012, the Global Programme on Cybercrime (GPC) was established ‘to provide technical assistance and capacity-building on cybercrime’Footnote 115 in response to problems specified in the Comprehensive Study on Cybercrime, including uneven criminalization of cybercrime across the countries.Footnote 116 These activities have laid a solid foundation for the UN General Assembly to ‘establish an open-ended ad hoc intergovernmental committee of experts, representative of all regions, to elaborate a comprehensive international convention on countering the use of information and communications technologies for criminal purposes’.Footnote 117 Up until the completion of this article, the Open-Ended Ad Hoc Intergovernmental Committee of Experts (the AHC) has held the concluding session from 29 January to 9 February 2024, but a reconvened concluding session will be held on the proposal of Mexico from 29 July to 9 August 2024.Footnote 118
4.2 Reshaping transnational criminalization of cybercrime
4.2.1 Actor mismatch in whether a global convention on cybercrime should be shaped
Generally, the states parties to the Budapest Convention have not intended to formulate a global convention on cybercrime in contrast to those under the CIS Agreement, ACEIIS and ACCITO as specified in Figure 2.Footnote 119
Voting
The unwilling participation has indicated an intention of the states to maintain the status quo which enables mobilization of interest groups for political advantages while preventing the proponent states from ‘legitimis[ing] and disseminat[ing] [their] foreign policy values and interests’.Footnote 120 Nevertheless, the states parties to the Budapest Convention have had a shift of position in the negotiating processes: proactive participation in different sessions may help the states to accommodate ‘pluralities of competing interests and institutional checks and balances’.Footnote 121 Furthermore, lacks of political, staff, and ideational capacities have barred the states parties to the ACCITO, DFC and CCSPDP from being substantially involved in the negotiating processes, although a majority of them have recognized the necessity to formulate a global treaty on countering cybercrime:Footnote 122 only six non-voting states – Côte d’Ivoire, El Salvador, Ghana, Mexico, Turkey, and Uruguay – have made submissions during the sessions, but they have actively participated in the inter-sessional consultations.Footnote 123 Additionally, diverse IOs and non-state actors have also been intensively involved in identifying what appropriate rules should be; therefore, even the less competent states may obtain information about the past and make estimates of the future for the guidance of decisions from the negotiating processes, though norm contestations could be provoked: it is still likely to culminate in a commitment through facilitating ‘those who are targets of manipulation [to] have access to information about their predispositions obtained by the agents of manipulation’.Footnote 124
4.2.2 Wrestling with framing ‘cybercrime’
According to the three consolidated negotiating documents (CNDs) produced by the AHC, states still intend to not define ‘cybercrime’ but to categorize cyber-dependent offences, cyber-enabled offences, and cyber-assisted offences.Footnote 125 First, there are diagnostic struggles across states as to whether ‘cybercrime’ must have a phenomenological transnational ‘hook’:Footnote 126 states have general consensus on proscribing illegal access, illegal interception, interference with digital system/information/devices, misuse of devices, computer-related forgery, and use of forged data in domestic criminal law, but the states parties to the Budapest Convention have insisted that those offences should be completely virtual.Footnote 127 For example, Austria indicates that transnational cyber-trespass offences should not include ‘the interception of telephone landlines that work without computers’ because ‘[s]uch an offence has no international dimension that would justify its inclusion in a UN Convention’.Footnote 128 In contrast, Russia, Iran, Belarus, Burkina Faso, Venezuela, and Egypt deem a mere transnational normative hook enough as ‘cybercrime’ should comprise a mandate to ‘establish as an offence under its domestic law the intentional creation, distribution and/or use of software or other digital information knowingly designed to interfere unlawfully with critical information infrastructure’.Footnote 129
Second, contradictions are prominent between the major states parties to the Budapest Convention and the ACEIIS/CIS Agreement in reshaping offences against the person and whether cyber-assisted offences should be established under the future global convention as specified in Table 2.Footnote 130
Contradictions
Most of the contentions arise from concerns that states may extend criminal penalties that exclusively serve domestic needs for addressing moral issues to the international legal system because any commitments to apply ‘criminal laws to punish the spread of [information disorder] … can have a chilling effect on freedom of expression’.Footnote 131 For instance, the UN Human Rights Committee (UNHRC) pointed out in Jong-Kyu Sohn v. Republic of Korea that the state should not have applied criminal law to the persons who ‘issued a statement supporting the [labour] strike and condemning the Government’s threat to send in troops’ because they ‘w[ere] exercising [their] right to impart information and ideas within the meaning of article 19, paragraph 2, of the Covenant’.Footnote 132 Nevertheless, attempts to expand the scopes of offences against the person and cyber-assisted offences may enable states to seek global legitimacy for using criminal law to compensate for institutional incapacity to respond to lesser cybercrime with low penalties at the domestic level, although potential duplication with other international rules and norms could come about.Footnote 133 In this regard, the critical issue does not lie in whether states may apply criminal law to those offences but concerns how to make state interventions ‘become fully effective’Footnote 134 without ‘put[ting] in jeopardy the right itself’:Footnote 135 digital technology has been reshaping the ability of individuals worldwide to exercise their freedom of expression, which has multiplied commitments on human rights protection through coercion and persuasion.Footnote 136 Notwithstanding, what if states are using human rights law to disguise accommodation of political agendas such as election interference, which ‘would undermine the rights of others or the ability of States to protect legitimate national security or public order interests’?Footnote 137 For example, the UNHRC reasoned that the criminal conviction of a journalist who disclosed political opinion polls for the 23-day period running up to and including election day was not excessive.Footnote 138 After all, criminal law is the last resort for a state to undertake its positive obligation to obstruct ‘hostility, violence, discrimination, or exclusion by others’Footnote 139 arising from ‘the soul-shriveling humiliation that a discriminatory rebuff can give rise to’.Footnote 140
4.2.3 Decreasing indeterminacy in criminal liability and condition of cybercrime
In general, states have mitigated the significant divide in prescribing the liability and condition of ‘cybercrime’ under the pre-existing treaties during the negotiations: states have agreed on the necessity to criminalize ‘attempt’ and ‘complicity’ as well as prescribe ‘intent’ in committing cybercrime at the domestic level, although the broad expressions such as ‘the participation in any capacity’ and ‘any attempt’ as well as a demand for not ‘imposing an unnecessary burden of translation and explanation’ to mens rea Footnote 141 provide little guidance for states to substantively harmonize a requirement of ‘evil mind’ as well inchoate and derivative liabilities in domestic criminal law.Footnote 142 For example, Niger, Malaysia, Indonesia, Vietnam, and Tanzania propose that ‘[k]nowledge, intent or purpose required as an element of an offence established in accordance with this Convention may be inferred from objective factual circumstances’.Footnote 143 In practice, the convergences could facilitate assertion of criminal jurisdiction over regulating cybercrime without resolving jurisdictional conflicts, especially in terms of jurisdictional overreach where ‘different sovereigns may bring successive prosecutions for … different offences’ arising from one incident:Footnote 144 improvement in semantic determinacy does not necessarily resolve structural indeterminacy which emerges from tensions between a quest for common values and the basic need to maintain independence in the international society.Footnote 145 For example, the US District Court for the Eastern District of New York in the United States v. Augustine case reasoned that prosecution of the defendant for attempting to provide personnel to a Federal Terrorist Organization (FTO) after prior prosecution by the Tunisian court proceedings has been justifiable by ‘the dual sovereignty principle’.Footnote 146 In this regard, over-criminalization could happen, especially when circumstantial evidence may justify actions against or even punishment of conducts tangential to serious and organized crimes in cyberspace.Footnote 147
4.3 Appraisal
The aforementioned analyses suggest that states have certain consensus on operational rules for taking joint action on cybercrime in the midst of ‘pluralities of competing interests and institutional checks and balances’.Footnote 148 Nevertheless, the diagnostic struggles and contradictions suggest that the pre-existing treaties have failed to nurture a wide agreement among states to couch the disputed issues concerning cybercrime in certain specific terms due to a lack of principled foreign policy to prevent states from ‘us[ing] their control of implementation to undermine and subvert legal changes’.Footnote 149 In this respect, the negotiations may not go beyond cultivating an exceptional and extended compromise resting on the prior treaties as justifications for countering cybercrime transnationally as the UN may only enable states to strategically get to the best outcome out of irreconcilable issues:Footnote 150 just as Professor Crawford writes that ‘treaties are time-bound promises or propositions that generally reflect a perspective at the time of being made. But we know that over time custom may actually be employed to “mould and even modify” the content of otherwise static treaties’,Footnote 151 it is likely that states would reach acceptable trade-offs concerning most of the cyber-dependent offences and certain cyber-enabled offences, such as child pornography, by continuous inquiry that may ‘help each party understand the realities the other is working with’.Footnote 152 In particular, Australia, Mexico, China, the UK, and others have agreed that private actors play a significant role in addressing cybercrime, although China favours hierarchical governance by underlining that states should ‘clarify the responsibilities of the private sector’ while the UK appreciates co-governance by ‘reach[ing] inter-subjective understanding’ of collaboration.Footnote 153 Therefore, it is likely to persuade or provide alternative policy options for Austria to accept that ‘the interception of telephone landlines that work[s] without computers’ is culpable given that the affinal relationship between cybercrime and ICT has been well recognized.Footnote 154
Nevertheless, global collective action against cybercrime will still be a slim chance unless ‘both the identity and preferred distribution pattern of basic goal values, and implementing institution’ are well allocated to balance sovereign prerogatives and the need to maintain co-existence of states.Footnote 155 First, does a demand for global collective action against cybercrime justify a need for observing a universal set form of calculus for determining what degree of reducing harms is required and what socially acceptable levels of risk are?Footnote 156 The answer is substantially ‘no’ because even a common concern does not ipso facto prevail over a state’s entitlements. The ECtHR’s ruling in Al-Adsani v. The United Kingdom is one example: a state’s right to enjoy ‘immunity from civil suit in the courts of another State where acts of torture are alleged’ remains intact, even when the prohibition of torture ‘has achieved the status of a peremptory norm in international law’.Footnote 157 Similarly, the ICJ in the Whaling in the Antarctic case implied that the exercise of international law should have deference to national disparities by refusing to settle differences about the appropriate policy towards whales and whaling at the domestic level.Footnote 158 In this regard, either criminalization of hate speech or reconstruction of conventional crimes as ‘cybercrime’ should still be domaine réservé as long as states observe proportionality when imposing deterrence, although ‘[t]here is no uniformity … in the practice or the doctrine as to the formulation of the principle, the strictness or flexibility of the principle and the criteria on the basis of which proportionality should be assessed’.Footnote 159 Essentially, liberty is socially embedded and ‘can be evaluated from the perspectives of a variety of normative orders or normative control systems and thus, importantly, can also be justified from a variety of such perspectives’:Footnote 160 it is justifiable to subordinate individual interests to the goals of their collective or ingroups with the purpose of preserving a democratic political community and individual rights without sufficient state capacity.Footnote 161
Second, what is ‘the extent to which and the methods by which states can pursue any national-culturally determined goals in the international society’?Footnote 162 The requirements for human rights protection and democratic principles have restrained state autonomy since 1945, but such a constraint does not extend to prescribe how a state should provide a range of acceptable options to achieve individual full potential:Footnote 163 what the Lotus case requires has long been a duty of each state to maintain ‘co-existence of independent communities and facilitate the achievement of common aims’.Footnote 164 In this respect, the duties discourse as recognized by certain regional human rights regimes should also be well noted.Footnote 165 For example, Article 29 of the African Charter on Human and Peoples’ Rights requires that ‘[t]he individual shall have the duty … [n]ot to compromise the security of the State whose national or resident he is’. Also, Paragraph 2, Principle 23 of the Declaration of Principles on Freedom of Expression and Access to Information in Africa adopted by the African Commission on Human and Peoples’ Rights (ACHPR)Footnote 166 reaffirms that ‘individual rights … originate from, and acquire existence, effectiveness and significance in, the context of collective rights’.Footnote 167 Therefore, a state may discard the idea that ‘the individual achieves her full freedom only when untrammelled by State and community regulation’Footnote 168 but turn to a rationale that ‘[t]he fulfilment of duty by each individual is a prerequisite to the rights of all’ as long as the state’s intention is to sustain human relationships and individual identity.Footnote 169 In a word, just as the ICJ in the Application of the International Convention on the Elimination of All Forms of Racial Discrimination case refuses to recognize its jurisdiction ratione materiae on ‘alleged “indirect discrimination” resulting from the effect of the media block on persons of Qatari national origin’ on the ground that media corporations are not “institutions” which ‘refers to collective bodies or associations … [as] individuals or groups of individuals’,Footnote 170 not any of the ideologies across different cultures but ‘the international reaction to the genocide and atrocities committed by National Socialist Germany’ should be the only constraint on state behaviour at the universal level.Footnote 171
5. Positioning ‘cybercrime’ in the pluralist legal order
This section discusses the implications emerging from the evolution of ‘cybercrime’ on the international plane. This author will then propose an alternative to mediate the diversity of the international society.
5.1 Is protection from cybercrime an emerging common interest of the international society?
Stepping beyond the unresolved tension between states in the processes of global (re-)framing of ‘cybercrime’, it is clear that ‘a common sense of nations’ that protection from cybercrime demands active co-operation beyond the simple precept of coexistence: it is necessary to form a community in law in quest for common values, higher norms, and objective responsibility in terms of countering cybercrime.Footnote 172 In other words, states are seeking an erga omnes partes obligation in the midst of traditionally bilateralist international law: a state has an obligation of imposing criminal sanctions on offences in cyberspace, which objectively owes to all the other parties under the prospective regime.Footnote 173 Alternatively, a ‘general principle’ which is logically connected with the phenomenon of ‘cybercrime’ has emerged to ‘establish the existence of a legal principle that has a general scope and may be applied to a situation not initially envisaged by the rules from which it was derived’.Footnote 174 In this regard, what contradictory practice reflects is not a lack of ‘acceptance as law’ about countering cybercrime but about what operationalized regime is appropriate:Footnote 175 the developing states are avoiding yielding ‘the armed governing apparatus of the sovereign and … the rich resources of the state[s]’ to increasing inter-dependence,Footnote 176 while the developed states have turned to democratizing and humanizing international law to overcome a structural problem inherent in the international society where even commitments to realize common good are essentially contractual.Footnote 177 George Abi-Saab indicated that:
the traditional view staunchly held in Western quarters, that a new State is born in a legal universe that binds it … [but] the alleged universality and legitimacy of the international legal system [is] a system developed without their participation and used to justify their subjugation; an unjust system, for whilst formally based on sovereign equality and hence reciprocity, in actuality it works in one direction and in favour of one side only; and finally an antiquated system that does not correspond to contemporary conditions and their specific needs.Footnote 178
Accordingly, ‘[t]he interest of the community … is [still] … the sum of the interests of the several members who compose it’:Footnote 179 the winner would be able to create an imposed regime which would enable the introduction of ‘“alien” doctrines … [that] require[s] fundamental change of domestic principles of participation and obligations’,Footnote 180 which could deprive certain other states of ‘undertakings possessing their own value and consequently are capable of independent application’.Footnote 181 Otherwise, conflicts would arise from resistance of the affected states just as China had tried to regain control and ownership of her territory through tactically declaring war on Germany in 1917.Footnote 182
Notwithstanding, a global demand for ‘all States can be held to have a legal interest in their protection’ still contributes to producing ‘transboundary moral impacts’:Footnote 183 just as Nardin recognizes that ‘[d]urable relations among adversaries presuppose a framework of common practices and rules capable of providing some unifying bond where shared purposes are lacking’,Footnote 184 the global negotiations still ‘render events or occurrences meaningful and thereby function to organize experience and guide action’ against cybercrimes across borders.Footnote 185 In a word, what states demand is to be emancipated from ‘hierarchical relations of domination and subordination’Footnote 186 and to ‘accept a range of different and equally legitimate normative choices by national governments and international institutions and tribunals … within the context of a universal system’.Footnote 187 The ICJ articulates in the Military and Paramilitary Activities in and against Nicaragua case that ‘[t]he existence in the opinio juris of States of the principle of non-intervention is backed by established and substantial practice. It has moreover been presented as a corollary of the principle of the sovereign equality of States’.Footnote 188
5.2 Is seeking a minimum public order a solution?
Eventually, a more profound question arises: what are the more advantageous alternatives to mediate claims and counter-claims in the global framing of ‘cybercrime’? The failure of the International Convention Concerning the Use of Broadcasting in the Cause of Peace (ICCUBCP) concluded under the League of Nations in 1936 can provide some enlightenment.Footnote 189 During the interwar period, states made deep commitments to regulate information flow to prevent ‘the detriment of good international understanding … as to incite the population of any territory to acts incompatible with the internal order or the security of a territory of a High Contracting Party’.Footnote 190 Nevertheless, the International Convention Concerning Use of Broadcasting in the Cause of Peace (ICCUBCP) was barely operative due to a lack of ‘a public order system in which the basic values of human dignity are widely produced and widely shared’:Footnote 191 states such as Spain and the Soviet Union thought it either premature to implement at the domestic level or impossible to apply without like-mindedness.Footnote 192 Eventually, the ICCUBCP collapsed without curbing broadcast propaganda which conspired in the outbreak of the Second World War.Footnote 193 Just as Professor Müllerson observes that ‘[d]ominance is rarely voluntarily accepted’,Footnote 194 the ICCUBCP’s destiny foreshadows potential outcomes of the future global convention on countering cybercrime.
In this regard, any attempts to shape ‘cybercrime’ at the global level should not go beyond ‘the maintenance or re-establishment of minimum order and, then, within the social space created by the maintenance of minimum order, to the optimum ways in which all life opportunities are produced and distributed’.Footnote 195 Otherwise, it is unlikely to crystallize ‘the highest common denominator of relevant rules’:Footnote 196 it is unrealistic to ‘format … norms and values coming from different cultures and religions into a common paradigm of legal norms and principles’,Footnote 197 when dominators seek perpetual domination and the dominated seeks to ‘join or replace the dominators’.Footnote 198 For example, states such as the US, China, Russia, Iran, and others are abusing public attribution to compete for normative power in cyberspace, which further escalates tension in the international society due to lack of consensus and guidance.Footnote 199 Therefore, global framing of cybercrime should head for a satisfactory arrangement through subsequent improvements rather than delimiting the morally permissible range of diversity among states that cannot exercise their right on an equal footing:Footnote 200 it is more just and practical to require states to observe procedural obligations such as periodical information sharing and reporting of accountability in accordance with agreed rules,Footnote 201 which ‘place in juxtaposition quite divergent diagnoses and prescriptions for action … [and] allow implementing nations to follow quite divergent courses of action while each appeals to the same global norms’.Footnote 202 Judge Huber indicated that ‘[s]overeignty in the relations between States signifies independence … [which] is the right to exercise therein, to the exclusion of any other State, the functions of a State’,Footnote 203 a pressing need to jointly combat cybercrime and the globality of cyberspace does not equate to rendering states ‘the right to intervene in the internal or external affairs of another’Footnote 204 and to compel states to give up domaine privilégié that concerns protection of political organizations, internal and external security, and major economic interests.Footnote 205 After all, consensus is not necessarily preconditioned by institutionalization of power just as Colombia as a non-party still recognizes the relevant provisions of the United Nations Convention on the Law of the Sea concerning the baselines of a coastal state and its entitlement to maritime zones, the definition of the continental shelf and the provisions relating to the delimitation of the exclusive economic zone and the continental shelf as applicable due to their role as customary international law:Footnote 206 the essential features retained in the public order system of today still underpin new developments in the future and state consent is indispensable to resolve normative conflicts in a highly complex normative system without any centralized authority.Footnote 207
6. Conclusion
This article has observed and analysed transnational criminalization of cybercrime under the treaties and global negotiations under the UN. The observations show that a common interest of preserving peace and security in cyberspace through criminal justice is crystallizing in operation amid divergences of states on framing ‘cybercrime’, but such a global aspiration to develop an optimum public order that promotes the greater production and wider distribution of all values is still utopian.Footnote 208 Simultaneously, states should secure the duties to co-operate and avoidance of harm first when there is no ‘unified society of states adhering to generally the same norms, rules, identities, and views of moral conduct’:Footnote 209 a collection of ‘self-contained bod[ies] of law or legal system[s], the sum-total of norms, indicating the proper rules of obligatory conduct, binding on members of a law-governed human society’Footnote 210 is not all about the international legal order for maintaining co-existence of states and upholding human dignity. Therefore, the hope of the states to delegate the League of Nations to maintain peace and international security was doomed to disillusion without paying attention to ‘the possibility of integrating them in a lasting political and economic order’.Footnote 211 Analogically, transnational criminalization is not ‘a status quo project of legitimation … for those who might otherwise have contributed to a new global politics’Footnote 212 by exercising special privileges upon some states with a limited capacity for rights in international law.Footnote 213 After all, the UN’s ‘values-based framework’ may not serve other than to ‘ensure … all the threats … that are distant do not become imminent and those that are imminent do not actually become destructive’.Footnote 214
Open access
