In October 2025, at a large ceremony organized in Hanoi, 72 states signed the U.N. Cybercrime Convention (UNCC, or Hanoi Convention), the first U.N.-wide convention to combat cybercrime and increase cooperation in this area. Although at least 40 states must submit their instrument of ratification for the UNCC to enter into force, the signing ceremony bought things one step closer and was already lauded by many states as finalizing the intense but fruitful negotiations, resulting in a text that harmonizes cybercrime legislation and enforcement powers globally. Not everyone celebrated, however, with human rights activists and others arguing that the Convention could be abused by totalitarian states in bringing down dissidents.
Russia took the lead in launching the treaty negotiations that resulted in the UNCC, formally initiating the process at the U.N. General Assembly in 2019, gaining support from many developing states, including those who saw it as a response to the lack of international cybercrime legislation in some regions. However, observers also noted Russia may have an additional motive in advancing the Convention: to globalize a system of “international information security” modeled on the Russian approach.
Yet, by agreeing to the inclusion of a judicial settlement clause in the Convention, Russia may have opened a new route by which it can be brought in front of the International Court of Justice (ICJ) for disputes surrounding cyber operations. This is particularly notable in light of Russia’s well-documented role as a leading state actor in conducting cyber operations worldwide, both in sponsoring and facilitating cybercriminal activity and in conducting a broad range of malicious cyber operations through its intelligence services.
However, the path to bring Russia to justice under this provision is not simple. The two main challenges are Russia potentially declaring itself not to be bound by the judicial settlement clause of the Convention, and (relatively unlikely) Russia deciding not to ratify the UNCC after all. Yet there may also be paths to overcoming these hurdles. Ultimately, Russia – ironically – has contributed to broadening the possibilities of achieving state responsibility in cyberspace by initiating the negotiations of the Hanoi Convention.
Potential Hurdles – And How They Might Be Overcome
1. Russia Declaring It Is Not Bound by Article 63, Para. 2
If Russia declares that it is not bound by the UNCC’s judicial settlement clause, then this precludes states from bringing disputes arising out of the UNCC against Russia to the ICJ.
Article 63, para. 3, of the UNCC enables states to declare, “at the time of signature, ratification, acceptance or approval of or accession,” that they do not consider themselves to be bound by the judicial settlement clause of Article 63, para. 2, and provides for the ICJ as the dispute resolution forum of last resort. So far, only Azerbaijan has formally submitted such a declaration. The United States has recognized the possibility but has not yet taken any concrete steps in this direction. Russia, so far, has remained silent about Article 63. According to para. 3, however, states may still issue this declaration at the time of ratification or accession to the Convention. Thus, while Russia has not done so, it is still able to declare not to be bound by Article 63, para. 2.
It is hard to say what Russia will do. Curiously, Russia did not make use of similar provisions under the U.N. Convention against Transnational Organized Crime (UNTOC), nor the U.N. Convention Against Corruption (UNCAC), two law enforcement conventions from which the UNCC heavily borrowed language. This could be an indication that Russia may refrain from making a similar declaration with respect to the UNCC. (An additional reason may be that Article 63, para. 3 also provides that a state opting out of jurisdiction cannot bring claims against other states, and Russia may wish to reserve this option – particularly given the indications that the Convention was drafted to some extent consistent with its own international policy aims.)
Even if Russia opts out of Article 63 para. 2, however, other accountability mechanisms remain. Once ratified, the Convention is subject to an implementation mechanism, which includes a periodic review of the implementation of the Convention (see Article 57, para. 5 lit e) by the Conference of the States Parties. The rules of procedure for this Conference of States Parties will be discussed at the end of January. Although the specifics of this mechanism are yet to be determined, the Convention foresees that a periodic review of states’ implementation of the UNCC will be part of the agenda. In that case, while the mechanism is designed to encourage cooperation and is thus not punitive in nature (similar to the mechanisms foreseen in UNTOC and UNCAC), potential issues where Russia (or any other state party) is not properly implementing the UNCC’s provisions, such as the ones on enforcement or international cooperation (see below), can be brought to the attention of the Conference of the States Parties. Thus, even if Russia could not be brought to the ICJ, the UNCC has opened up an additional avenue of discussing states’ (including Russia’s) lack of cooperation with respect to cyber operations within a convention Russia itself has pushed for being negotiated.
Granted, the review mechanism – given its non-punitive nature – may only have limited effectiveness, and some human rights activists have voiced concern that it does not provide efficient safeguards against human rights abuse. Yet, it arguably remains preferable to the absence of any mechanism at all, as the UNCC has at least opened up a new avenue for raising and discussing concerns about state behavior.
2. Russia Deciding Not to Ratify the Convention
Although Russia initiated the negotiations and signed the Convention, there is still a slim chance that it may end up not ratifying the Convention after all. So far, no state has submitted their instrument of ratification, including Russia. Russia deciding not to ratify seems unlikely, however; as others have observed, negotiating a U.N.-wide convention was a whole-of-government initiative, suggesting that ratification is a core Russian goal, supported even by President Vladimir Putin. Deciding not to ratify now would undermine Russia’s credibility as the one state initiating and arguing for years for the necessity of a global convention to combat the criminal use of information and communication technologies.
The UNCC’s Judicial Settlement Clause
Assuming that Russia ratifies the Convention and does not opt out of the judicial settlement clause, what would be the UNCC’s path of getting to the ICJ?
Article 63 UNCC sets forth a multi-step process of judicial settlement. If a dispute concerning the interpretation or application of the UNCC comes up, states would first have to seek to settle their disputes through negotiation or any other peaceful means (para. 1). If the issue cannot be resolved through negotiation, states parties shall submit the dispute to arbitration (para. 2). If, six months after the date of the request for arbitration, states are still unable to agree on the organization of the arbitration, any party to the dispute may refer the case to the ICJ.
This is not necessarily “new” in the area of cybercrime conventions, as the Budapest Convention on Cybercrime also contains a similar judicial settlement clause (see Article 45). Russia, however, is not party to the Budapest Convention, which is why the UNCC, if it enters into force, may present a new path for states to bring disputes regarding Russian cyber operations to the ICJ. In contexts outside of cybercrime or cybersecurity, states have pursued comparable treaty-based jurisdictional strategies: For instance, Ukraine brought a suit against Russia under the International Convention for the Suppression of the Financing of Terrorism, using the treaty’s dispute settlement clause as a jurisdictional gateway to litigate aspects of Russia’s conduct in eastern Ukraine before the ICJ. It is therefore possible that the UNCC’s judicial settlement clause could be invoked to bring Russia to the ICJ for malicious cyber operations.
States’ Obligations Under the UNCC
The UNCC is the first U.N.-wide cybercrime convention, aimed at harmonizing cybercrime legislation and procedural powers for countering cybercrime. The majority of UNCC provisions require states to adopt legislation within their own state to criminalize certain offences (such as illegal access to an information and communications technology system without right, see Article 7) or establish the requisite powers and procedures for the purpose of criminal investigations or proceedings. The goal here – much like the Budapest Convention – is to harmonize national legislation, so the same rules apply everywhere, making it easier to investigate, prosecute, and convict cyber criminals globally. Importantly, if a state was negligent in taking the requisite legislative steps to implement the criminalization or procedural powers provisions as foreseen in the Convention, it can be held responsible for breach of its treaty obligations.
Next to these implementation provisions, the UNCC also contains self-executing provisions that impose obligations that states must carry out directly. For instance, Article 22 stipulates a state’s obligation to establish jurisdiction when the offence is committed on its territory (Article 22 para. 1), as well as when the alleged offender is present on a state party’s territory and the state party refuses to extradite the offender solely on grounds of nationality (Article 22, para. 3). The UNCC also contains an obligation to prosecute an alleged offender without undue delay, in case the state party refuses to extradite the individual on the basis that it is one of its nationals (Article 37, para. 11). The UNCC further sets out several obligations of state parties to cooperate, ranging from a more general obligation (Article 47, para. 1) to more concrete obligations in terms of cooperating for purposes of mutual legal assistance (see, for instance, Article 40).
According to the UNCC’s judicial settlement clause, a dispute may either concern the “interpretation” or “application” of the UNCC’s provision. Thus, even questions regarding the extent of a cooperation provision, which could become highly relevant in the case of Russia, could become subject of a dispute. For example, Russia is known to regularly refuse cooperation when it comes to cyber operations allegedly originating from its territory (one may only remember the Estonia 2007 DDoS attacks). Were these instances to happen again – notably after the UNCC’s entry into force and Russia’s ratification – I argue that they could now become subject to a dispute by which states could assert that Russia is in breach of its cooperation obligation(s) under the UNCC.
Thus, once the Hanoi Convention enters into force (and Russia ratifies it), it arguably would be more difficult for Russia to continue serving as a safe harbor for cyber criminals or otherwise tolerating or instigating malicious cyber behavior, as this could be considered a breach of its obligations under the UNCC.
While this analysis focuses primarily on Russia, the UNCC has opened up a new avenue for bringing cyber disputes against all states parties to the ICJ (as others have also observed). The UNCC has thus – perhaps ironically, given concerns about the motivations of Russia and other states promoting it – broadened the possibilities of achieving state responsibility in cyberspace.
FEATURED IMAGE: A billboard for the Signing Ceremony & High-Level Conference of the United Nations Convention Against Cybercrime at the National Convention Centre in Hanoi on October 24, 2025. (Photo by NHAC NGUYEN/AFP via Getty Images)
Click Here For The Original Source.
