zlacker

IMO it is good that norms around offensive security are being formulated at the nation state level, especially because major nations like China, Russia, Iran, NK, SK, India, Pakistan, UAE, Saudi Arabia, Singapore, Indonesia, and Malaysia are NOT signatories of the Budapest Convention on Cybercrime

This seems to be an attempt at creating a detente between China, US, Russia, etc over cyber espionage attempts on each other. This seems to be a result of the UK-China and US-China Track 1.5 Dialogues over the past 2-3 years.

Over the past decade, offensive security capabilities have proliferated, and have caused increased chaos, especially after notable cases in signatory states like the HSE Attack (Ireland), the Assencion Attack (USA), the Apple Rootkit (Russia), Bundestag (Germany), Macron's cellphone (France), etc.

Articles 12, 13, and 17 are the majors ones at hand, and Articles 14-16 is fluff as it is already covered in most countries jurisdictions, Articles 25-30 are already the norm in the jurisdictions that voted, and Articles 37-54 are already the norm under Interpol.

Furthermore, at least within the US, such treaties can only be ratified by the Senate.

Realistically, offensive operations under direct nation-state control will continue, but this narrows the scope for gray-zone operations using a third party (Appin/India, LockBit/Russia, ChamelGang/China or NK).