The Hà Nội Hypocrisy: Digital Repression Behind the UN Cybercrime Treaty | #cybercrime | #infosec

“Every trace on the keyboard can be tracked.” 

This ominous warning, recently posted to Facebook by the local police in Ba Ngòi Ward (Khánh Hòa Province), was not a public service announcement about online scams or digital fraud. It was a direct threat aimed at a citizen who dared to leave a mocking comment online.

Over the past months, Vietnamese ward- and commune-level police have increasingly resorted to publicizing the personal data of dissenting voices—exposing full names, birth years, addresses, and citizen identification numbers. 

For example, when a citizen in Ô Chợ Dừa Ward (Hà Nội) commented recently, “There are still many fools in your police sector,” the police retaliated by publishing the individual’s ID number and business ties.

In most democratic nations, people recognize the unauthorized publication of sensitive personal data as doxing, a form of cyber harassment. In Việt Nam, however, it appears to be standard law-enforcement practice. 

It is bitterly ironic that while local authorities dox their own citizens, the Vietnamese government hosted the signing of the UN Convention Against Cybercrime in Hà Nội in October 2025.

The Scope of the Cybercrime Convention

Originally initiated by Russia in 2019, the UN Convention Against Cybercrime aims to establish a global framework for combating cybercrime. The treaty, adopted by consensus by the UN General Assembly in December 2024, garnered unexpectedly high diplomatic support during its October 2025 signing, when 72 countries added their signatures.

The text of the convention establishes baseline criminalizations for illegal system access, data interference, and illegal interception. More significantly, it compels signatory states to implement sweeping electronic surveillance powers, such as the real-time collection of traffic data and the interception of content data.

The Convention also obligates these member nations to collect and share electronic evidence with one another to aid in the prosecution of any “serious crime.”

The Illusion of Cooperation 

However, beneath this facade of international cooperation lies a flawed framework that human rights defenders warn authoritarian regimes will seek to weaponize.

A coalition of non-governmental organizations, including Human Rights Watch, the Electronic Frontier Foundation, Article 19, and Privacy International, issued a joint statement urging states to refuse to sign or ratify the treaty. 

Their primary critique centers on the Convention’s definition of a “serious crime.” This is broadly defined as any offense punishable by at least four years of imprisonment under a signatory state’s domestic law.

Authoritarian governments routinely criminalize activities protected by international human rights law, as Human Rights Watch points out. 

Despotic regimes can easily classify democratic exercises—such as peaceful protest, investigative journalism, whistleblowing, or criticizing the government—as “serious crimes” by imposing harsh sentences. 

Consequently, they can invoke the treaty’s sweeping cross-border surveillance and data-sharing powers to hunt down dissidents.

Similarly, the Global Initiative Against Transnational Organized Crime has criticized the treaty’s broad approach to international cooperation and data collection, noting several implications for privacy and fundamental freedoms. 

Major tech corporations and human rights NGOs entirely shunned the signing ceremony in Hà Nội, and no non-Vietnamese heads of government attended.

The Domestic Crackdown 

For years, Việt Nam has stifled online dissent using Decree 15/2020, which penalizes citizens with a standard administrative fine of 7.5 million đồng ($285) for sharing “false” or “distorted” information. 

Because the average monthly income for a worker in 2025 was 8.31 million đồng, this penalty equals nearly an entire month’s wages. This threat has bred a pervasive culture of self-censorship; terrified that a written comment will trigger state retaliation, Vietnamese netizens have resorted to expressing political frustrations through the helpless use of the “haha” reaction emoji on Facebook.

The Ministry of Public Security (MPS) is also drafting a deliberately vague new decree that would astronomically increase fines for “fake news” to 100 million đồng for individuals and 200 million đồng for organizations. 

The decree defines “fake news” simply as “information that is not true,” positioning the MPS as the sole arbiter of truth. In effect, the MPS operates a national database for fake news while pushing to revise the Penal Code to grant police broad exemptions from criminal liability when exercising “professional measures.”

For citizens whose online influence is considered too dangerous for a simple administrative fine, the state invokes the Criminal Code. According to data from Project 88, 187 activists were detained for violating the Criminal Code as of October 2025, and Human Rights Watch recorded at least 40 arrests in the first 10 months of 2025 alone.

An Internationally Sanctioned Weapon 

As it currently stands, the UN Convention Against Cybercrime does absolutely nothing to address the cybercrimes oppressive regimes commit against their own people. 

When the state itself acts as the hacker, doxer, censor, and extortionist, an international treaty expanding state surveillance and cross-border data sharing will inevitably become a weapon for oppression.

While the delegates gathered in Hà Nội may have toasted to a new era of global cybersecurity, for the citizens of Việt Nam, this treaty is nothing more than a hollow charade. 

By ratifying a convention that lacks adequate human rights protections and willfully ignoring the host nation’s authoritarianism, the international community has effectively provided autocratic states with a globally sanctioned tool for digital repression.