Russia asked the UN for a treaty against ‘extremism,’ ‘subversion,’ and ‘discrediting the authorities.’ Instead, it got one that covers hacking and fraud.

In 2026, Russia will submit a new international treaty to the State Duma for ratification - the United Nations Convention against Cybercrime. Russia initiated this treaty, but it will be ratified with reservations. The treaty aims to create a framework for international cooperation against cybercrime. It allows investigators in one country to obtain assistance from foreign counterparts in freezing, seizing, confiscating, and returning proceeds from certain crimes, as well as collecting and sharing evidence in electronic form.

To ensure the preservation of evidence, countries must develop the ability to intercept internet traffic in real time and store it for at least 90 days, or delegate this task to internet service providers. This approach resembles Russia's Yarovaya law, which was passed in 2014 and requires telecom operators and information dissemination organizers to store various types of user data for specific periods.

While previous cybercrime treaties like the Budapest Convention (adopted in 2001) already required member countries to adopt measures for real-time traffic interception, the new convention goes further by demanding that countries be capable of intercepting and storing citizens' internet traffic. However, unlike the Budapest Convention, the UN convention does not obligate countries to intercept and store the traffic of all citizens.

The UN convention has faced criticism from human rights organizations, who argue that it may target dissidents, journalists, and independent security researchers. Russia's proposed treaty aimed to cover a broader range of crimes connected to the internet, including administrative offenses. The final text of the treaty, however, was influenced by Western countries, resulting in compromises that changed its title to a more unwieldy form.