More than seventy states signed the United Nations Convention against Cybercrime within its first year of being open for signature, yet only three have ratified it. With the signature window closing at the end of 2026, the gap between diplomatic signature and legal commitment has become the treaty’s defining feature.
By Vladimir Tsakanyan, PhD | Director, Center for Cyber Diplomacy and International Security (CCD-IS)
The United Nations Convention against Cybercrime was adopted by the General Assembly by consensus on December 24, 2024, after five years of negotiation, and opened for signature at a ceremony in Hanoi on October 25–26, 2025. Seventy-one states and the European Union signed at the ceremony itself; the total has since grown to roughly 74 to 76 signatories. As of mid-2026, however, only three states — Qatar, Azerbaijan, and Vietnam — have completed ratification, out of the forty required for the Convention to enter into force. The signature window at UN Headquarters in New York closes on December 31, 2026. Between now and then, the treaty’s practical relevance will depend less on how many additional states sign than on how many are willing to convert signature into a binding legal commitment.
From a Contested Proposal to a Consensus Adoption
The Convention originated with a 2019 push from Russia to establish a UN-negotiated alternative to the Council of Europe’s Budapest Convention on Cybercrime, the existing international standard that Russia and China have never joined. The initial resolution to launch negotiations passed with only minority support, and the five years of subsequent talks were marked by sustained disagreement over the treaty’s scope — whether it should cover a narrow list of core cybercrimes or extend to any offense committed using information and communications technology. The General Assembly ultimately adopted the final text without a vote in December 2024, with the United States and other skeptical states choosing to join the consensus rather than block adoption, while signaling that consensus at adoption did not commit them to signing the treaty once it opened.
A Geopolitically Mixed Signing Ceremony
That distinction proved consequential. At the Hanoi ceremony, Russia, China, Iran, and the European Union were among the signatories, alongside delegations from the African Union and the Shanghai Cooperation Organization. The United States was not. A State Department spokesperson said at the time only that the United States was continuing to review the treaty, and the U.S. mission to the United Nations later set out a more detailed position: Washington is unlikely to sign or ratify until it sees evidence that signatory states are implementing the human rights and legal safeguards the Convention itself requires, and it reserved the right to reject mutual legal assistance requests from any state found to be invoking the Convention to suppress fundamental freedoms.
UN Secretary-General António Guterres framed the Convention as a binding instrument to strengthen collective defenses against cybercrime and pointed to its value for developing countries seeking assistance and training, citing UN estimates that cybercrime costs the global economy more than $10 trillion annually. Even the Convention’s critics have acknowledged specific provisions as genuine achievements, particularly Articles 14 through 16, which improve international coordination against the nonconsensual distribution of intimate images, child sexual abuse material, and online grooming. The broader criticism, voiced by close to twenty human rights organizations in a joint statement issued before the ceremony and echoed by industry voices including Microsoft, centers on the Convention’s extension of cooperation obligations to any “serious” offense carrying a sentence of four years or more — a scope critics argue is broad enough to sweep in protected activity such as dissent, whistleblowing, and independent security research.
The Ratification Gap
Signature carries no binding legal obligation; ratification does. The gap between roughly 75 signatories and 3 ratifiers as of mid-2026 suggests that a significant share of signatory states have not yet decided, or are not yet prepared, to be legally bound by the Convention’s provisions. Some governments that signed in Hanoi were explicit that their participation reflected an interest in shaping implementation from within rather than an endorsement of the text as written — a rationale the United States itself invoked in explaining its decision to join consensus on adoption, and one several European governments echoed in justifying their own decision to sign despite having opposed the Convention’s launch in 2019.
A special treaty event held in Abu Dhabi on April 25, 2026, alongside the UN Congress on Crime Prevention and Criminal Justice, gave states an additional opportunity to sign or deposit ratification instruments, but produced no reported surge in ratifications. States that do not sign by the December 31, 2026 deadline retain the option to accede to the Convention afterward, so the closing signature window is not itself a hard deadline for the treaty’s survival. It does, however, mark the end of the period in which the Convention can plausibly build broad diplomatic momentum before entry into force is decided by a much smaller and less representative group of early ratifiers.
Contested Even Among Signatories
The Convention’s core disagreements have not been resolved by signature; they have shifted into its implementing institutions. Between January 26 and 30, 2026, the Ad Hoc Committee that negotiated the original text convened to draft Rules of Procedure for the Conference of States Parties, the body that will oversee the Convention once it enters into force. Member states could not reach consensus on how to secure meaningful roles for civil society, the private sector, academia, and technical experts in that oversight process, and the session closed with a Mexican proposal serving as the basis for continued talks rather than an agreed text. The disagreement is significant because the Conference of States Parties is the primary mechanism the Convention’s own defenders, including the United States in its formal position, have pointed to as the venue where abuses of the Convention would be identified and addressed. Its procedural design remains unsettled more than a year after the treaty opened for signature.
Outlook
Three data points will indicate whether the Convention is converging toward or drifting away from the 40-ratification threshold: the pace of new ratifications between now and the December 31, 2026 signature deadline, the outcome of the Conference of States Parties’ Rules of Procedure negotiations, and any shift in the U.S. position, which remains explicitly conditioned on evidence of safeguard implementation that does not yet exist because the treaty has not yet entered into force. Because the identity of early ratifiers shapes the norms the Conference of States Parties will operate under from its first session, a Convention that reaches 40 ratifications quickly through states with weaker rule-of-law records will produce a different implementation trajectory than one that reaches the same threshold more slowly through a broader and more balanced set of parties. For now, the wide gap between signature and ratification leaves that question open.
About the Author Vladimir Tsakanyan, PhD, is a political scientist and strategic analyst specializing in cyber diplomacy and international security. He is Director of the Center for Cyber Diplomacy and International Security (CCD-IS). ORCID: 0000-0002-9349-1907.
Sources
- United Nations Office on Drugs and Crime, “United Nations Convention against Cybercrime” treaty status and home page
- United Nations General Assembly Resolution 79/243 (December 24, 2024); UN Office of Legal Affairs coverage of the Hanoi signing ceremony
- United Nations Treaty Collection (treaties.un.org), current signature and ratification status
- United States Mission to the United Nations, Explanations of Position on the UN Convention against Cybercrime
- The Record (Recorded Future News) and Cybersecurity Dive, reporting on the Hanoi signing ceremony (October 2025)
- Human Rights Watch, joint civil society statement on the Convention’s signing
- EU Cyber Direct / Global Network Initiative, analysis of the January 2026 Ad Hoc Committee session on Rules of Procedure
Leave a comment