If your software is only intended to demonstrate the existence of a security flaw but contains no payload, then it is less obviously criminal. Still technically so, I suppose, but not so obviously that you couldn't make some kind of argument.
The collection of traffic and 'content' data is not beneficial though, so I suppose the treaty has to go for that reason.
> But: a State Party "shall not decline to act" under the provisions of the freezing, seizure and confiscation of the proceeds of crime "on the ground of bank secrecy". The Convention is expected to be adopted by the end of the year.
So Russia and any other can country can ask for records on any US person they want under a pretext of committing some crime there and unless the US is itself investigating this party then it's allowed? & conversely, if the US tried to do this Russia or any hostile country can just claim they're investigating said persons in crimes? Surely my reading of this is absurd & it's not actually this badly written?
It's particularly telling that it was Russia & China who proposed it in 2017 in the first place.
Say a foreign law enforcement entity is investigating Mr X, and asking a domestic authority for some information on Mr X.
The treaty says that generally speaking, the domestic authority should provide such assistance.
However, assume that instead another domestic law enforcement entity was asking the domestic authority for information on Mr X, but (under purely domestic jurisdiction) the domestic authority would be prohibited to provide such assistance for some reason (say, due to privacy laws, procedural protections, or so).
Then, the foreign law enforcement entity would not be entitled to the assistance, either.