If your software is only intended to demonstrate the existence of a security flaw but contains no payload, then it is less obviously criminal. Still technically so, I suppose, but not so obviously that you couldn't make some kind of argument.
The collection of traffic and 'content' data is not beneficial though, so I suppose the treaty has to go for that reason.
> But: a State Party "shall not decline to act" under the provisions of the freezing, seizure and confiscation of the proceeds of crime "on the ground of bank secrecy". The Convention is expected to be adopted by the end of the year.
So Russia and any other can country can ask for records on any US person they want under a pretext of committing some crime there and unless the US is itself investigating this party then it's allowed? & conversely, if the US tried to do this Russia or any hostile country can just claim they're investigating said persons in crimes? Surely my reading of this is absurd & it's not actually this badly written?
It's particularly telling that it was Russia & China who proposed it in 2017 in the first place.
> Advocates including the Biden administration said the deal reflects the interests of the U.S. and its allies.