A Surveillance Treaty in Disguise: Canada Signs UN Cybercrime Convention

It feels like there’s this weird layer to domestic and international politics where you do a lot of signalling to one audience while simultaneously winking at other audiences that you’re not actually serious. (I can never tell who is getting winked at…)

I feel like WYSIWYG politics is what most of us want, but probably doesn’t actually work. The Ned Stark character that is righteous and right and quickly meets the headman’s axe of the game theory and brinksmanship of everyone else.

Canada is so lucky to have someone like Michael Geist. He's been reporting on and doing in depth investigations on privacy invasions for about 2 decades now.

>As of May 2026, the following 76 participants have signed the treaty: Algeria, Angola, Australia, Austria, Azerbaijan, Belarus, Belgium, Brazil, Brunei, Burkina Faso, Cambodia, Columbia, Chile, China, Costa Rica, Ivory Coast, Cuba, Czechia, North Korea, Democratic Republic of the Congo, Djibouti, Dominican Republic, Ecuador, Egypt, European Union, Fiji, France, Ghana, Greece, Guinea-Bissau, Iran, Ireland, Jamaica, Kazakhstan, Laos, Libya, Luxembourg, Malaysia, Maldives, Mali, Mauritius, Morocco, Mozambique, Namibia, Nauru, Nicaragua, Nigeria, Palau, Papua New Guinea, Peru, Philippines, Poland, Portugal, Qatar, Russia, Rwanda, Saudi Arabia, Slovakia, Slovenia, South Africa, Spain, Sri Lanka, Palestine, Sweden, Thailand, Tajikistan, Togo, Turkey, Uganda, United Kingdom, Tanzania, Uruguay, Uzbekistan, Venezuela, Vietnam, and Zimbabwe.

Some wonderful countries here: North Korea, Saudi Arabia, China. Thankfully the US hasn't signed it and probably won't because it thinks itself too above international law.

Interestingly, Qatar signed it with [the reservation](https://treaties.un.org/Pages/ViewDetails.aspx?src=TREATY&mt...) that

>The State of Qatar does not consider itself bound by the provisions of Articles (16), (15), and (14) of the Convention, as they contradict the provisions of Islamic Sharia, national legislation, and the social and cultural values of the State of Qatar.

These provisions [being](https://www.unodc.org/unodc/en/cybercrime/convention/text/co...) Article 14: Offences related to online child sexual abuse or child sexual exploitation material, Article 15: Solicitation or grooming for the purpose of committing a sexual offence against a child, Article 16: Non-consensual dissemination of intimate images.

I am trying to figure out what this means, as I am aware the Prophet married a 9 year old, but Google assures me the minimum age of marriage in Qatar is 16 with parental approval, and it's rare, and I thought Islam required no images of really anything at all, much less females of any age who are to be in burqas when in public.

So has Australia, the EU, and the UK [0].

That said, being a signatory has limited impact as long as it isn't ratified.

[0] - https://treaties.un.org/pages/ViewDetails.aspx?src=TREATY&mt...

About "cybercrime" in general my feeling is there is a status quo between the criminals and countries. Something like we do not take down your economy and you do not go after us.

I know for a fact that even the most powerful organizations are powerless to have some relatively unsophisticated group caught and put behind bar.

The idea we would need conventions to start acting is a joke.

Wrong. The government cares.

At this point what does Canada really have to offer? It's GDP barely exceeds the poorest state in America. Anybody who is decent or talented have left it for America. It has a 3~4x more importation of demographic from third world countries without the economy and public funds to support them all without raising taxes on middle class Canadians already tapped out from previous wave of real estate speculation. It's trying to latch on to a crumbling bureaucracy across the ocean with its own wave of illegal migration/problematic demographics while facing an adversary determined to reclaim its own lands and without a united front or America behind it. It's leaders and political party have squandered public funds brazenly ranging from ridiculous ideological to pure corruption. It's pissed off it's largest trading partner literally across the border.

What's left for Canada, I'm curious to hear from Canadians.

The only way to have age verification on an international level, is to have treaties allowing for the sharing of information about citizens, digitally, in that context.

And this is that level of cooperation. And it has all the hallmarks of what comes next, identity verification. And this, is what this is for.

In order to prosecute anyone, you need to validate who did the crime. And that requires knowing who that person is. Not hearsay, not postulated, but validated "who this is". So you need to lock down anonymous access to the internet, in order to ensure you can easily and always prosecute such crimes.

And one of the issues right now, is that if someone in the UK does "bad thing" in Canada via the internet? It's doubly hard to track. So creating frameworks which will (on the backend) require some form of identity verification to work effectively, well... that tracks from where I sit and have seen in the last 2 years.

Frankly, from a government's perspective, this is no different than all the changes with KYC, for example 50 years ago the Government of Canada knew pretty much nothing about its citizenry. Certainly, it had no clue about bank account balances, transactions, investment holdings, a person's wealth and more. Now it knows enormous amounts of data, perhaps an arbitrary example is that your RRSP and TFSA(like American 501k) information, balances, and more are now yearly sent to the GoC. I believe also all information on trades made are, too, even in non-registered accounts. This absolutely wasn't the case, not to this degree, even a decade or two ago.

Some of these obligations are via ratified international treaties. The degree of surveillance, fiscally, is astonishing now. Americans know of this of course, after 9/11 they gave their government enormous data, and keep giving it, eg credit card transactions.

I remember when I was young, my parents arguing about having to get SIN cards (social insurance number). While it as introduced in the 60s, something happened which made it more of a requirement. Its only purpose at the time was for Revenue Canada to track info. Everyone argued about it, discussed it, was upset! It was the first time people needed "a number" to open certain bank accounts.

Yet we come from that, to this in really one generation's lifetime.

One of the problems is that, there is a massive, immense, enormous problem here right now, in terms of bots/foreign actors/asshats spreading immense disinformation for profit or state actor based goals. And with LLMs, it's going to get so much worse. People on HN at least are capable of some filtering, but the average Joe just sees video and 100% believes it is factual and true.

I wish I could see another path to locking out the asshattery, whilst keeping the internet anonymous. But I don't really. And unless a grass roots movement comes around, to ensure that every crime on the internet has a very high degree of success for prosecution? Then we'll be getting an identity managed internet.

I'm sure a lot of people will say "We can force companies to filter!", well, can you? For every forum out there? For torrents? For everything? And even if you think the "big boys" can be the main filter points, well, do you want a private company to decide what you post or not? And they'll need some way to ensure people don't just create a new account when banned! So they'll want ID too, if they're legislated to filter.

And if they're legislated to filter, can you fight decisions in court? Do you have the presumption on innocence? Do you have the right to face your accusers? A jury of your peers? With Google, Facebook, anyone these days, you get banned and it's nigh impossible to even find out why.

While there are exceptions, our governments are required to have criminal courts, and things prosecuted there.

I really don't want private, fiscally motivated companies to be the gatekeepers, if gatekeepers there must be.

Ah well. This is all a very unpleasant path.

When are we going to see substantive legislation advancing digital rights instead of chipping away at them?

For the US, we need a new bill of rights, a bill of digital rights that constitutionally protects right of repair, right to root our own devices, right to be free from dragnet surveillance, right to general purpose computing, and the right to access speech without government-mandated age or identity checks.

With all the libertarian millionaires and billionaires swirling around silicon valley and the venture capital space, why can't we make that happen?