That is a fairly bad take tbh.
I mentioned this in my previous comment about this treaty, and the primary driver is the fact that most countries (especially China, Russia, Singapore, South Korea, Saudi Arabia, UAE, Iran, India) are NOT parties of the Budapest Convention because of the Censorship or Surveillance portions.
Now that offensive security capabilities have proliferated, some amount of norms are required (which is what Article 12, 13 and 17 touch on), but the countries listed above will not budge on their censorship or surveillance stance.
This treaty is itself is a result of the Track 1.5 Dialogues around cyberwarfare happening between the 5 Eyes and China [1][2] after tensions became dangerously bad in the early 2020s.
If letting China continue their Great Firewall means we can formalize the rules of engagement for gray-zone operations using a third party (Appin/India, LockBit/Russia, ChamelGang/China or NK), so be it.
The UN treaty is superseded by American jurisdiction anyhow.
> future of a free internet
The internet was never truly free. Access was always arbitrated by telcos (and a major reason why the tech industry has been a major donor to the EFF) who themselves are strongly regulated by governments.
The difference is, the internet isn't only a Western project anymore, and consensus will need to be formed with other nations, unless we want to end up forming regionalized "internets"
[0] - https://news.ycombinator.com/item?id=41210110#41211961
[1] - https://www.chathamhouse.org/about-us/our-departments/intern...
[2] - https://www.idcpc.org.cn/english2023/bzhd/202406/t20240618_1...
Can you elaborate a bit further on why you see this as a necessary step for a given outcome?
Otherwise this just looks like giving in to bad faith actors and weakening our own protections in the process.
Well, the EFF's take on the resolution is always going to be more about the censorship it introduces than how much it enables law enforcement to curb actual crime.
I'm aligned with the EFF on this, and would vote against this if it were raised in any democratic forum I voted in, but that's because I care more about reducing censorship than reducing online crime. Yes, I, unlike most voters in modern liberal democracies, would let ten paedos walk free to save one Aaron Swartz.
If you really care about them ~equally - as you have to, for your comment to be made in good faith - then you can't take your talking points from the EFF.
Because it is.
The existing status quo over cyberwarfare is untenable, and runs the very real risk of causing chaos if we don't tamp down on the usage of third parties for plausible deniability.
Most countries have offensive security capabilities directly under direct government control, but a number of them will also tolerate third party actors attacking a rival country so long as they don't attack the host country.
This is what LockBit (Russia), ChamelGang (either China or NK), Appin (India), etc has done.
Either everyone allows cybercriminals in their countries to attack other countries (and spark actual chaos in our entire internet infra that could escalate into actual violence), or all nation states agree to tamp down on third party attackers.
The Budapest Convention was the previous cybercrimes agreement, but most countries outside of the West that matter didn't ratify it. This meant terms of engagement over cyberwarfare weren't truly formalized, and a bad actor like NK or China could in good faith argue that a North Korean or Chinese cybergang did no wrong.
The brutal reality is that performative treaties like the Budapest Convention have no teeth, and a global Internet means that terms of engagement are needed for warfare, or the entire Internet splinters.
[0] https://documents.un.org/doc/undoc/gen/v24/055/06/pdf/v24055...
>Each State Party shall adopt such legislative and other measures as may be necessary to empower its competent authorities to: (a) Collect or record, through the application of technical means in the territory of that State Party; and (b) Compel a service provider, within its existing technical capability: (i) To collect or record, through the application of technical means in the territory of that State Party; or (ii) To cooperate and assist the competent authorities in the collection or recording of; traffic data, in real time, associated with specified communications in its territory transmitted by means of an information and communications technology system.
That is pretty bad. Some parts of this draft actually seemed pretty reasonable - eg. Article 14 making CSAM illegal. I guess that is part of the trick.
>States Parties are encouraged to establish bilateral or multilateral arrangements to facilitate the transfer of personal data.
>This treaty is itself is a result of the Track 1.5 Dialogues around cyberwarfare happening between the 5 Eyes and China [1][2] after tensions became dangerously bad in the early 2020s.
>If letting China continue their Great Firewall means we can formalize the rules of engagement for gray-zone operations using a third party (Appin/India, LockBit/Russia, ChamelGang/China or NK), so be it.
>The internet was never truly free. Access was always arbitrated by telcos
>the internet isn't only a Western project anymore
None of what you wrote here is an argument for mandating data collection, as outlined in articles 29 and 30. Those two articles are unrelated to your points here. They aren't about establishing norms for an existing phenomenon or about preventing or regulating cyberwarfare between the US and China or about formalizing rules of grey zone operations. It's just a requirement for data collection.
Data Collection was one of the primary reason why Russia, China, India, Singapore, and other nations did not become parties to the Budapest Convention (the precursor to this treaty) [0][1]
Most nations other than the US, Canada, EU, and Japan mandate collection and retention of metadata by ISPs and Online Services, and this was a major sticking point that lead to the inefficacy of the Budapest Convention.
> Those two articles are unrelated to your points here
I just gave links to the currently ongoing Track 1.5 dialogues to show the ongoing diplomacy work that has started over cybercrime in the early 2020s.
[0] - https://www.uscc.gov/sites/default/files/Research/China%20In...
[1] - https://ccdcoe.org/uploads/2018/10/InternationalCyberNorms_C...
Then they should just not mention data collection at all if there is no agreement on it. "These countries are already doing it" is not a good reason to agree to something. Especially since it makes changing the law in those countries impossible now.
>this was a major sticking point that lead to the inefficacy of the Budapest Convention.
Really? Are you saying those other countries said they would not agree to any Cybercrime Convention unless it had an article mandating data collection? I find that hard to believe. In any case, even if that were true, it would be better to have no convention at all.
This treaty is supposed to supersede the Budapest Convention. The Budapest Convention is explicitly in favor of data privacy (a number of it's data privacy norms influenced the GDPR).
Either data collection mandates are left to individual states or the same deadlock that happened with the Budapest Convention would happen again.
> it would be better to have no convention at all
Then you're left with the status quo that every nation that isn't a party of the Budapest Convention can use 3rd party groups to hack a rival, which leads to chaos.
I take it you oppose the EU-US Data Privacy Framework then?
What is wrong with this? This seems extremely obvious. The fact that you do not mention this option in your original post seems almost disingenuous. Unless you meant to address it in the 'unless we want to end up forming regionalized "internets"' line? Although leaving the entire meat of your argument to one unexplained line isn't great either. And even then I don't see how the lack of mandating data collection would result in regionalized internets. So far I can access websites in Russia or South Korea just fine despite this point. And in any case you can create a regionalized internet even if all these rules are followed. See China and north korea.
>you're left with the status quo that every nation that isn't a party of the Budapest Convention can use 3rd party groups to hack a rival, which leads to chaos.
US, China, Russia and North Korea will continue to hack each other, no matter the outcome of this UN Convention. Even ignoring that point it is still strictly much better to have hacking than have globally mandated data collection
This seems overblown. The behavior you're describing has been present nearly as long as the internet has been globally accessible. It's an inconvenience and it means we need to do a better job securing systems against attacks, which is hardly the worst thing from an evolutionary perspective. Better that systems get hardened now to prevent ransomware than that they remain vulnerable until there is an actual war and an enemy state takes advantage of longstanding complacency.
> or all nation states agree to tamp down on third party attackers.
This doesn't happen even with a treaty, because not all countries will be signatories, and even the signatories can just ignore the provisions as they do with many other treaties. Corrupt governments deflect blame; "the attack seems to have originated from here but we investigated ourselves and found ourselves innocent" etc. Proving otherwise without local cooperation is close to impossible because the location of the originating systems is not inherently the location of the attackers. And, of course, corrupt governments are the places where these things are already happening.
Think of the children has been a trope for a very very long time because it takes a real backbone to stand up against it and to risk being labeled a pedo yourself because other than lawyers (who have to) and other pedos, who would defend a pedo?
Fun fact, there is a large overlap between pedos, those who argue against teaching kids from early age on about their bodies and sexuality, and those who consistently see pedos everywhere they look at.
25 years ago I could never have imagined the internet we have today.
25 years from now we could easily have a free internet protocol that is taking hold and the whole process repeats.
So much has came and went in a single generation but it works both ways. It is not an eternally negative, march towards complete totalitarianism even if it it feels like that right now.