1. Background: Emergence of the UN Convention against Cybercrime
The United Nations adopted the text of the ‘Convention against Cybercrime’ through the General Assembly in December 2024, marking the first multilateral criminal justice treaty negotiated in over two decades. The Convention was conceived through a 2017 Russian-sponsored resolution and required eight formal negotiation sessions and five intersessional consultations, reflecting both urgency and deep disagreement.
The Convention seeks to establish a global legal framework to address cyber-enabled crimes, responding to rising digital harms such as online fraud, child sexual abuse material, and cross-border cyber offences. Its universal ambition contrasts with earlier instruments that were geographically or politically limited.
However, only 72 countries supported the final text, and several major digital powers, including India, the United States, Japan, and Canada, did not sign the Convention at the initial ceremony. This non-participation underscores fragmentation in global cyber governance.
The episode highlights the difficulty of achieving consensus in an increasingly contested international system, particularly in domains where technology, sovereignty, and human rights intersect.
The governance logic is that cybercrime requires collective responses, but weak consensus leads to diluted norms; if ignored, fragmented approaches will reduce enforcement effectiveness and increase regulatory arbitrage.
2. Competing Cybercrime Frameworks and Global Power Alignments
Global cyber governance has long been shaped by the 2001 Budapest Convention on Cybercrime, a Europe-led initiative with 76 parties. Its restricted accession model excluded countries like Russia, China, and India, limiting its claim to universality and legitimacy.
The UN Convention was positioned as an alternative, open to all states and negotiated multilaterally. Russia and China collaborated closely to advance it, seeking to reshape global cyber norms away from Euro-Atlantic dominance and towards state-centric control over cyberspace.
European states signed the UN Convention despite reservations, as it borrows several definitions and procedures from the Budapest Convention. An EU Council document (July 2025) justified participation as a way to retain influence during implementation rather than remain outside rule-making.
The United States and allied civil society groups expressed concern that the Convention’s broad definitions of “serious crimes” could enable misuse against journalists, activists, or political opponents, particularly in authoritarian contexts.
The underlying logic is strategic positioning rather than legal coherence; ignoring this dynamic risks normalising power-driven rulemaking over rights-based governance.
3. India’s Position and Constraints in Global Rulemaking
India actively participated in negotiations on the UN Convention, unlike its disengagement from the Budapest framework. However, key Indian proposals, particularly those aimed at retaining stronger institutional control over citizens’ data, were not incorporated into the final text.
India’s decision not to sign reflects a cautious calculus: participation without sufficient safeguards could dilute domestic sovereignty over data and law enforcement processes. This contrasts with earlier successes in global negotiations, such as climate change, where India led coalitions like the Group of 77.
Over the past two decades, India has struggled to shape outcomes in emerging areas of global governance, including digital trade, data flows, and cyber norms. This has gradually eroded its bargaining leverage in multilateral forums.
The divisions over the Convention also cut across plurilateral groupings such as the Quad and Five Eyes, indicating that shared strategic interests do not automatically translate into common digital governance positions.
The governance reasoning is that participation without influence weakens autonomy; if ignored, India risks being a rule-taker in domains critical to national security and development.
4. Digital Constitutionalism and the Rights–Security Tension
The Convention reveals a widening gap between international legal principles and domestic implementation. While negotiations began with broad agreement on addressing universally condemned harms, such as child sexual abuse material, the final text lacks precise limits on what constitutes cybercrime.
This flexibility allows signatory states to expand criminal offences under domestic law, potentially infringing on freedom of expression, privacy, and due process. Procedural safeguards, including judicial oversight, are made contingent on existing national legal frameworks rather than universal standards.
Such an approach weakens the idea of digital constitutionalism, where cyberspace governance is anchored in shared rights-based principles. Instead, it legitimises divergent practices under the cover of multilateral consensus.
The result is a system where the same treaty can enable both rights-protective and rights-restrictive outcomes, depending on domestic political contexts.
The logic is that vague norms prioritise agreement over protection; if ignored, international law may legitimise rights dilution rather than constrain it.
5. Parallels with Global Governance of Artificial Intelligence
A similar pattern is visible in the governance of artificial intelligence. Globally, states agree on high-level principles such as “safe, secure, and trustworthy” AI, reflected in instruments like the OECD AI Principles, the G7 Hiroshima Process, and the UN Global Digital Compact.
However, consensus at the level of principles masks significant divergence in regulatory practice. India’s draft rules on watermarking AI-generated content illustrate this gap. While grounded in the accepted principle of user safety, the proposal envisages highly prescriptive measures, such as labels covering 10% of content.
This mirrors the cybercrime debate, where shared objectives coexist with contested implementation strategies. Such divergence increases compliance costs and complicates cross-border digital operations.
The absence of harmonised operational norms risks fragmenting the global digital ecosystem, even as technologies like AI and cybersecurity are inherently transnational.
The governance takeaway is that principle-only consensus is insufficient; if ignored, implementation conflicts will undermine trust and cooperation.
6. Polycentricism and the Erosion of Multilateral Effectiveness
The cybercrime Convention reflects a broader crisis in multilateral governance. The U.S. reduction in UN funding, paralysis of the WTO dispute settlement system since 2019, and the Security Council’s ineffectiveness in conflicts such as Ukraine and Gaza illustrate systemic weakening.
In this context, global governance is increasingly limited to broad principles, while operational rules emerge through smaller bilateral or plurilateral arrangements. This leads to polycentricism, marked by overlapping institutions and competing norms.
Cyber governance and cross-border data flows exemplify this trend. While the idea of data sharing among “trusted partners” is widely accepted, there is no consensus on mechanisms to operationalise trust.
Such fragmentation places high demands on state capacity, as countries must engage simultaneously across multiple forums with differing rules and expectations.
The logic is that fragmented governance strains institutions; if ignored, capacity gaps will translate into strategic vulnerabilities.
7. Implications for India and the Way Forward
India’s ability to preserve institutional autonomy in a polycentric global order depends on strengthening domestic technical, legal, and negotiating capacities. Regulatory and administrative reforms must keep pace with technological change.
Domestically, India faces a vast reform agenda to align cybersecurity, data protection, and AI governance with global debates while safeguarding national interests. Internationally, sustained engagement across multiple forums is essential to avoid marginalisation.
Without such capacity-building, India risks being constrained by externally defined norms that may not align with its developmental and security priorities.
The governance logic is that autonomy flows from capacity; ignoring this will lock India into reactive rather than agenda-setting roles.
Conclusion
The UN Convention against Cybercrime exemplifies the tensions shaping contemporary global digital governance: inclusivity versus precision, sovereignty versus rights, and consensus versus effectiveness. For India, navigating this landscape requires moving beyond caution to capability-building. In the long term, only sustained institutional and technical strengthening can enable meaningful participation in shaping rules that will define the digital foundations of governance and development.
