When the UN Convention against Cybercrime opened for signature in Hanoi last October, much of the debate focused on whether the first global UN cyber treaty would make binding rules easier to negotiate elsewhere. At the Global Mechanism’s first plenary in July, Russia called the Convention “indisputable evidence of the demand for global treaties to regulate the digital space” and argued that voluntary norms can be observed but only treaty obligations can be implemented. Kiribati, which sat through all three years of the Convention negotiations, offered a different lesson: at the end of them, its networks at home were “not one day better defended.”
In Vienna and New York, two UN cyber processes are deciding who may take part in implementation, what evidence they may bring, and what happens when that evidence implicates a government. The frameworks differ, but a similar pressure is emerging in both: participation becomes more contested when independent evidence bears directly on state conduct. The issue is not simply whether civil society has a seat, but whether either process can examine politically consequential evidence about governments.
Vienna
The Convention’s investigative and cooperation powers are broad, while important safeguards will depend on domestic law and institutions. It requires states to protect human rights and apply proportionality, with safeguards that may include independent review, remedies and limits on scope and duration. Yet in many jurisdictions, national law does not require prior judicial authorisation. Civil society organisations warned throughout the negotiations that broad cybercrime powers risk being used against journalists, researchers and dissidents. Much of the Convention’s human rights impact will therefore turn on implementation and scrutiny.
In January 2026, the Ad Hoc Committee met in Vienna to draft the Rules of Procedure for the Convention’s Conference of States Parties. Key questions remain unresolved. A single state objection can send an organisation’s accreditation to the Conference; continuity for organisations that joined the negotiations is not guaranteed; speaking opportunities and access to working documents are uncertain; and one proposed restriction would prevent NGOs from referring to specific country situations.
Together, these rules determine who gets into the room, whether they can contribute, and whether they can identify the state practice they want scrutinised. Nor does the draft guarantee that future review or monitoring bodies will inherit the same participation and transparency standards.
That matters because the Conference is supposed to review implementation. If organisations cannot participate, access relevant material or identify the country practice showing whether a safeguard worked, the review loses the evidence it needs. Assessing implementation means asking what happened, where, and to whom.
A second front opened in Vienna at the same time: proposals for a Protocol adding new offences. The Convention is not yet in force, so there is no implementation record from which to establish that new offences are needed. Talks on both questions resume in January 2027.
New York
Six months after Vienna, the Global Mechanism held its first substantive plenary. Fifty of the ninety-two organisations that applied were blocked. Russia accounted for forty-three, citing “unfounded political attribution of computer attacks” and “politicized propaganda.” The number matters, but so does the reason: politically contested attribution of malicious cyber activity to governments was presented as evidence that an organisation could not contribute impartially.
The fight then moved to the Dedicated Thematic Groups, where implementation discussion begins in December. Russia’s reading is that only approved experts may participate, that each requires the consent of all the states, and they can only come from accredited organisations. Iran argued that the expert pool should include only stakeholders already accredited by member states through the consensus process. China warned against a separate rulebook for the groups.
Several delegations also wanted work on additional legally binding obligations to begin now. Malawi asked whether, before concluding that legal gaps exist, states should first ask whether the problem is the law or their ability to implement it.
The Chair has since proposed critical infrastructure protection as the first thematic topic and opened nominations to a pool of experts. States may nominate experts from government, academia, civil society, the technical community and the private sector; the Chair, in consultation with the co-facilitators, will then select briefers on criteria including geographical balance, diversity of professional background and relevance of expertise. On paper, the door is open. Governments do not hold all the relevant evidence. Incident responders, researchers, operators, and digital-security organisations often see pieces of an incident before diplomats do. Sometimes their findings implicate governments.
Put the two cities side by side. In Vienna, a state objection can complicate an organisation’s accreditation, while proposed participation rules can restrict what observers say once admitted. In New York, state objections have already excluded dozens of organisations, including on the basis of politically contested attribution. In Vienna, negotiations on additional offences are mandated before the Convention has entered into force; in New York, some states are pressing for new legal obligations while others argue that implementation of the existing framework must come first.
Different procedures, same pressure point: governments can shape both who enters the discussion and what evidence can be put before it. The record does not show coordination. It does show similar tests for “acceptable” participation appearing in both processes.
What is actually being fought over
Not all exclusion is equivalent. The EU, through Estonia, objected to JSC Positive Technologies and published its reasons, identifying the Russian firm as serving FSB clients and part of a sanctioned group holding an FSB-administered licence. Ukraine argued against government-sponsored entities whose purpose is to advance a state’s position. Both point to a different test: independence.
So, the real dispute is not open versus closed. It is over what "political" means. One approach treats politicisation as capture: an organisation is acting as an instrument of a state rather than as an independent participant. The other risks treating independent documentation of state conduct as politicisation. The first protects the process from proxies. The second risks turning political discomfort into a basis for excluding evidence.
Both processes need to confront evidence about state conduct, though in different ways. The Mechanism’s mandate is responsible state behaviour. The Convention’s Conference will review how states implement and use the treaty’s powers. Estonia said it plainly in July: criticism of a state’s conduct is not propaganda, and states may rebut it but not silence it.
Who loses when expertise is excluded
Some of the clearest arguments for independent expertise in New York came from states concerned about unequal technical capacity. New Zealand said it levels the information playing field for countries without large technical establishments. Kiribati said the excluded organisations are often exactly the partners on whom states like it depend, and that silence from objecting states costs the rest of the room a great deal.
Outside actors do not substitute for domestic institutions. But smaller delegations often have less in-house access to technical research, incident data, and comparative implementation experience. Excluding independent expertise leaves them with a thinner evidence base. The same problem carries into Vienna, where states with smaller justice, technical and oversight institutions will still have to implement complex electronic-evidence and cooperation provisions.
The way forward: two tests of implementation
The processes need different fixes. In New York, the question is whether a state-led process can still hear evidence that states find uncomfortable. In Vienna, it is whether the Convention’s safeguards acquire enough meaning in practice to constrain how its powers are used.
1. New York: protect the evidence base. The Global Mechanism should not reproduce the plenary accreditation fight inside the thematic groups. States should give reasons for objections, resist treating politically contested attribution or criticism of state conduct as grounds for exclusion, and use the expert pool to bring independent technical expertise into the room. Consensus can govern what states decide. It should not govern what they are allowed to hear. Before reaching for new norms, the first cycle should use that evidence to establish where the existing framework is failing.
2. Vienna: build the safeguards into practice. The Rules of Procedure should make scrutiny predictable rather than discretionary. Objections should be reasoned; organisations accredited during the negotiations should have a presumption of continuity; observers should have timely access to documents and structured opportunities to contribute; country-specific implementation must remain discussable; and the same baseline should carry into future review and monitoring bodies. Governments that fought for the Convention’s human rights safeguards should also put their interpretation of those safeguards on the record through Conference statements, national implementation positions and, where appropriate, interpretative declarations. Before adding new offences, states should first have an implementation record showing where genuine gaps exist.
New York needs an evidentiary record broad enough to test state behaviour. Vienna needs an interpretative record strong enough to discipline state power.
