UN wants to abolish banking secrecy to better combat cybercrime

The United Nations (UN) Agrees on a Draft for a „Cybercrime Convention“. It effectively abolishes banking secrecy entirely, endangers security analysts and journalists, and extends to crypto companies. However, it is not yet decided.

Last Friday, the UN finalized a draft for an international agreement against cybercrime finalized. The draft was introduced in 2017 by China and Russia and bears the hallmarks of authoritarian states. It is set to be presented for a general vote in the fall.

On one hand, it aims to „strengthen international cooperation to combat certain crimes.“ The UN member states are „concerned that the use of information and communication technologies has a significant impact on the scale, speed, and reach of criminal offenses, including human trafficking, migrant smuggling, and the manufacture and trade of illegal weapons and drugs,“ among others.

Therefore, UN states are expected to collaborate more closely to prevent these crimes and ensure that cybercriminals „have no safe haven, so their crimes can be prosecuted anywhere.“

In addition to the intensive exchange of technology and information, the draft also addresses how to handle the loot of criminals.

Bank secrecy will not be tolerated

The UN draft stipulates that the proceeds of cybercrime – which it explicitly includes cryptocurrencies – are to be frozen and confiscated as efficiently as possible. Each member state is to take measures within their judicial systems to achieve this.

These measures are intended to enable law enforcement to „identify, trace, freeze, and confiscate“ any involved asset. Every country is to enact or establish the legal measures necessary for this purpose.

In this regard, every government must „empower courts and other competent authorities to make banking records and other financial or commercial documents available or seize them.“ No government should „refuse to act on grounds of banking secrecy.“ Moreover, governments should not reject information requests from other states because they infringe on banking secrecy.

The end of banking secrecy – and beyond

Bank secrecy has, of course, long been eroded. Essentially, there is no country where banks can refuse to provide information about their customers‘ account balances to inquiries from authorities, whether they are tax offices or law enforcement.

Additionally, there is an international and automatic exchange system of tax-relevant data that has been in place since 2015. However, any data beyond this is currently only released through orders from national courts in most countries. The UN apparently wants to change this, potentially making it mandatory to release bank data based on the judgment of foreign courts. It seeks to effectively abolish banking secrecy.

Since it’s not just about banks but all forms of „property“ in which criminals store their proceeds, crypto companies could also be affected, potentially even DeFi platforms. The question also arises as to how the UN will handle the fact that cryptocurrencies have made banking services possible without banks. Will the United Nations align with the FATF’s efforts to crack down more severely on privately used wallets?

Vague definitions of cybercrime

On top of all this, the definitions of cybercrime remain vague, allowing for broad interpretation. The draft lists several offenses:

• „Accessing a whole or part of an IT system without authorization“
• „Intercepting non-public electronic data transmissions through technical means“
• „Damaging, deleting, altering, or suppressing electronic data“
• „Preventing the operation of an IT system“ by introducing or manipulating data.

Basically, any form of hacking. The Electronic Frontier Foundation (EFF) criticizes the draft for leaving „security researchers and investigative journalists dangerously unprotected.“ Standard practices in security analysis or white-hat hacking are criminalized, as is the analysis of network traffic and more.

The EFF complains that it lacks „the necessary element of criminal intent to harm, steal, or defraud.“

An Asian critical observer observed that the draft lacks „strong safeguards to prevent the misuse of digital investigations and digital evidence.“ Indeed, it allows „more surveillance and more access to data in ways that undermine people’s trust in computers and digital technologies and expose individuals to risks.“

A serious issue

However, one must acknowledge that the UN is addressing a problem that becomes more rampant every year. Cybercrime – from fraud to sabotage and extortion, and from modern slavery to arms trade and terrorism financing – is increasingly virulent, with the damages growing ever larger.

If a stricter global legislation can help prevent the financing of terrorist attacks, the enslavement of people, the bankruptcy of large companies, the disruption of hospitals, and so on – how many innocent security researchers and journalists is that worth? The question is difficult, extending into ethical grey areas – but can we afford not to consider it?

In any case, it will be some time before the draft is subject to a general vote. There’s a chance it won’t be passed in this form. Additionally, it is still a long road from a UN draft to national laws and practices. Along this path, it is likely to be further refined – if there is sufficient resistance and protest on this level.