India Just Signed the World's First Global Cybercrime Treaty: A Global Rulebook for a Borderless Crime
On 25 September 2026, at UN Headquarters in New York, External Affairs Minister S. Jaishankar signed the United Nations Convention against Cybercrime on the sidelines of the 81st session of the UN General Assembly, calling it a step that "strengthens international cooperation for a safer digital future."
The signature places India among the growing list of nations joining what is officially the first comprehensive global treaty dedicated to cybercrime. What Jaishankar's brief statement did not mention is that this same treaty has spent the better part of three years drawing sustained, detailed criticism from human rights organisations, technology companies, and digital rights groups, who argue it risks becoming a tool for surveillance rather than a tool against crime.
A Conversation CyberPeace Has Been Having for Years
For CyberPeace, India’s signature is not an isolated development but the latest chapter in a conversation the organisation has been following since the Convention was still being negotiated.
In December 2024, CyberPeace published its analysis of the emerging UN Convention against Cybercrime, examining its objectives, proposed offences, mechanisms for international cooperation, electronic evidence and its relationship with the Budapest Convention. The analysis also highlighted an important principle embedded in the emerging framework: that stronger cybercrime enforcement must operate alongside due process, privacy and human-rights safeguards.
That conversation continued in October 2025, when CyberPeace published The Digital Leviathan: The UN Cybercrime Treaty and the Future of Global Governance. The piece examined the Convention not merely as a cybercrime instrument, but as part of a larger evolution in global digital governance, particularly around cross-border evidence, international cooperation and the changing architecture of cyber sovereignty.
And in August 2026, CyberPeace returned to the question from the operational side in The World Is Rewriting the Rules Against Cyber-Enabled Transnational Crime. The analysis placed the Convention alongside the wider international response to transnational cyber-enabled crime, including scam networks, financial fraud and increasingly sophisticated criminal ecosystems that operate across multiple jurisdictions.
What the Convention actually is
The treaty's full, formal title is unusually descriptive for a UN instrument: the United Nations Convention against Cybercrime, Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes. The UN General Assembly adopted it unanimously on 24 December 2024, following three years of negotiation, and it opened for signature at a ceremony in Hanoi, Vietnam, in October 2025. It will remain open for signature at UN Headquarters through 31 December 2026, and comes into force ninety days after the fortieth country ratifies it.
At its core, the Convention gives signatory states a shared legal framework for two things: preventing and prosecuting offences committed through digital systems, and cooperating across borders when evidence, offenders, or victims of a crime are scattered across multiple jurisdictions, a structural problem that has long frustrated cybercrime investigations. It also includes provisions specifically addressing the recovery of criminal proceeds, adding a financial dimension that lets states cooperate not just on prosecuting offenders but on tracing and reclaiming stolen money that has moved across borders, often through mule accounts and shell transactions designed to outrun any single country's jurisdiction.
Why India signed, in its own words
Jaishankar's public reasoning was concise. Cybercrime, in the government's framing, does not respect national boundaries, and India's own cybercrime caseload, spanning cross-border financial fraud, romance scams, and organised online extortion networks often operating from outside India's borders, has repeatedly run into exactly the jurisdictional walls this Convention is designed to lower. Prof. Triveni Singh, a well known cybercrime expert and former IPS officer, put the practical case plainly: "Cybercrime does not stop at national borders. Criminals can operate from one country and target victims in another. This convention can help countries share evidence and work together faster. For India, stronger international cooperation can make it easier to investigate cross-border cyber fraud and trace stolen money."
The part the announcement leaves out
Here is where the story gets considerably more complicated than a signing ceremony photo suggests. Since before the Convention's text was even finalised, a wide coalition of digital rights organisations, including the Electronic Frontier Foundation, Human Rights Watch, the Global Network Initiative, and Privacy International, has warned that the treaty's language is dangerously broad, and that its safeguards against misuse are considerably weaker than they need to be.
Cisco, one of the few major technology companies to comment publicly, stated the Convention does not do enough to "sufficiently protect basic human rights." UN Secretary-General António Guterres, notably, has himself urged countries to sign and ratify the Convention while simultaneously calling for its implementation to be "rooted in human rights," a somewhat unusual dual message from the very institution that produced the text, and one that implicitly acknowledges the concerns raised against it.
Where this leaves India
None of this means India's signature was unwarranted. The jurisdictional friction Prof. Triveni Singh described is real and well documented, and a shared international framework for evidence sharing genuinely could accelerate investigations that currently stall for months while agencies wait on slow, bilateral mutual legal assistance requests. India's existing domestic cybercrime coordination architecture is already substantial, spanning I4C, the National Cybercrime Reporting Portal, and newer mechanisms like the Citizen Financial Cyber Fraud Reporting and Management System and the Sahyog platform, and a global treaty that maps onto this existing infrastructure could genuinely close gaps that purely domestic tools cannot reach, particularly in cases where the perpetrator, the server, and the victim all sit in different countries, a pattern that has become close to the default in organised online financial fraud rather than the exception.
But the criticisms levelled at the Convention are not fringe objections; they come from some of the most established digital rights organisations in the world, and they focus specifically on the treaty's most powerful surveillance and cross-border cooperation provisions, the very mechanisms India will now need to operationalise domestically. Signing the Convention is also only the first procedural step; India's obligations under it will not take practical effect until the instrument is ratified domestically, a process that typically allows room for a signatory state to clarify how broadly or narrowly it intends to apply the treaty's more expansive provisions. How India chooses to implement those provisions, whether through the kind of judicial oversight and narrow, offence-specific application human rights groups have called for, or through the broader interpretation the treaty's text technically permits, will likely determine whether this Convention becomes a genuine tool against fraud and organised cybercrime, or a broader instrument whose reach eventually extends well past the digital offences it was signed to address.
References
- The420.in, "India Signs UN Cybercrime Convention to Strengthen Global Fight Against Digital Crime." ANI, "EAM Jaishankar signs UN Convention against Cybercrime on UNGA sidelines." https://aninews.in/news/world/us/eam-jaishankar-signs-un-convention-against-cybercrime-on-unga-sidelines20260926063207/
- Ministry of Cyber Affairs, "India signs UN Convention against Cybercrime at UNGA 81." https://ministryofcyberaffairs.com/news/india-signs-un-convention-against-cybercrime-at-unga-81-95b7e43b-7e29-4722-a4a7-304bca55b71c
- Electronic Frontier Foundation, "UN Cybercrime Convention Negotiations Enter Final Phase With Troubling Surveillance Powers Still on the Table." https://www.eff.org/deeplinks/2023/08/un-cybercrime-convention-negotiations-enter-final-phase-troubling-surveillance
- Electronic Frontier Foundation, "First Draft of UN Cybercrime Convention Drops Troubling Provisions, But Dangerous And Open-Ended Cross Border Surveillance Powers Are Still on the Table."
- https://www.eff.org/deeplinks/2023/07/first-draft-un-cybercrime-treaty-drops-troubling-provisions-dangerous-and-open
- Global Network Initiative, "GNI Calls on Member States Not to Support the UN Cybercrime Convention." https://globalnetworkinitiative.org/gni-statement-on-uncc/
- Just Security, "The UN Cybercrime Convention: Analyzing the Risks to Human Rights and Global Privacy." https://www.justsecurity.org/98738/cybercrime-convention-human-rights/
- TechRadar Pro, "UN cybercrime convention inadequate, says Human Rights Watch." https://techradar.com/pro/un-cybercrime-convention-inadequate-says-human-rights-watch
- Digital Watch Observatory, "Comparative analysis: the Budapest Convention vs the UN Convention Against Cybercrime." https://dig.watch/updates/comparative-analysis-the-budapest-convention-vs-the-un-convention-against-cybercrime
- epicenter.works, "Cybercrime Convention: Cross-Border Human Rights Violations." https://epicenter.works/en/content/cybercrime-convention-cross-border-human-rights-violations
- UN Press, "Secretary-General Urges All Countries to Sign, Ratify New UN Convention against Cybercrime, Calls for Solutions Rooted in Human Rights." https://press.un.org/en/2025/sgsm22961.doc.htm
- https://cyberpeace.org/resources/blogs/the-digital-leviathan-the-un-cybercrime-treaty-and-the-future-of-global-governance
- https://cyberpeace.org/resources/blogs/the-world-is-rewriting-the-rules-against-cyber-enabled-transnational-crime
Related Blogs
Introduction
Cert-In (Indian Computer Emergency Response Team) has recently issued the “Guidelines on Information Security Practices” for Government Entities for Safe & Trusted Internet. The guideline has come at a critical time when the Draft Digital India Bill is about to be released, which is aimed at revamping the legal aspects of Indian cyberspace. These guidelines lay down the policy framework and the requirements for critical infrastructure for all government organisations and institutions to improve the overall cyber security of the nation.
What is Cert-In?
A Computer Emergency Response Team (CERT) is a group of information security experts responsible for the protection against, detection of and response to an organisation’s cybersecurity incidents. A CERT may focus on resolving data breaches and denial-of-service attacks and providing alerts and incident handling guidelines. CERTs also conduct ongoing public awareness campaigns and engage in research aimed at improving security systems. The Ministry of Electronics and Information Technology (MeitY) oversees CERT-In. It regularly releases alerts to help individuals and companies safeguard their data, information, and ICT (Information and Communications Technology) infrastructure.
Indian Computer Emergency Response Team (CERT-In) has been established and appointed as national agency in respect of cyber incidents and cyber security incidents in terms of the provisions of section 70B of Information Technology (IT) Act, 2000.
CERT-In requests information from service providers, intermediaries, data centres, and body corporates to coordinate reaction actions and emergency procedures regarding cyber security incidents. It is a focal point for incident reporting and offers round-the-clock security services. It manages cyber occurrences that are tracked and reported while continuously analysing cyber risks. It strengthens the security barriers for the Indian Internet domain.
Background
India is fast becoming one of the world’s largest connected nations – with over 80 Crore Indians (Digital Nagriks) presently connected and using the Internet and cyberspace – and with this number is expected to touch 120 Crores in the coming few years. The Digital Nagriks of the country are using the Internet for business, education, finance and various applications and services including Digital Government services. Internet provides growth and innovation and at the same time it has seen rise in cybercrimes, user harm and other challenges to online safety. The policies of the Government are aimed at ensuring an Open, Safe & Trusted and Accountable Internet for its users. Government is fully cognizant and aware of the growing cyber security threats and attacks.
It is the Government of India’s objective to ensure that Digital Nagriks experience a Safe & Trusted Internet. Along with ubiquitous applications of Information & Communication Technologies (ICT) in almost all facets of service delivery and operations, continuously evolving cyber threats have become a concern for the Government. Cyber-attacks can come in the form of malware, ransomware, phishing, data breach etc., that adversely affect an organisation’s information and systems. Cyber threats leading to cyber-attacks or incidents can compromise the confidentiality, integrity, and availability of an organisation’s information and systems and can have far reaching impact on essential services and national interests. To protect against cyber threats, it is important for government entities to implement strong cybersecurity measures and follow best practices. As ICT infrastructure of the Government entities is one of the preferred targets of the malicious actors, responsibility of implementing good cyber security practices for protecting computers, servers, applications, electronic systems, networks, and data from digital attacks, also remain with the ICT assets’ owner i.e. Government entity.
What are the new Guidelines about?
The Government of India (distribution of business) Rules, 1961’s First Schedule lists a number of Ministries, Departments, Secretariats, and Offices, along with their affiliated and subordinate offices, which are all subject to the rules. They also comprise all governmental organisations, businesses operating in the public sector, and other governmental entities under their administrative control.
“The government has launched a number of steps to guarantee an accessible, trustworthy, and accountable digital environment. With a focus on capabilities, systems, human resources, and awareness, we are extending and speeding our work in the area of cyber security, according to Rajeev Chandrasekhar, Minister of State for Electronics, Information Technology, Skill Development, and Entrepreneurship.
The Recommendations
- Various security domains are covered in the standards, including network security, identity and access management, application security, data security, third-party outsourcing, hardening procedures, security monitoring, incident management, and security audits.
- For instance, the rules advise using only a Standard User (non-administrator) account to use computers and laptops for regular work regarding desktop, laptop, and printer security in the workplace. Users may only be granted administrative access with the CISO’s consent.
- The usage of lengthy passwords containing at least eight characters that combine capital letters, tiny letters, numerals, and special characters; Never save any usernames or passwords in your web browser. Likewise, never save any payment-related data there.
- They include guidelines created by the National Informatics Centre for Chief Information Security Officers (CISOs) and staff members of Central government Ministries/Departments to improve cyber security and cyber hygiene in addition to adhering to industry best practises.
Conclusion
The government has been proactive in the contemporary times to eradicate the menace of cybercrimes and therreats from the Indian cyberspace and hence now we have seen a series of new bills and polices introduced by the Ministry of Electronics and Information Technology, and various other government organisations like Cert-In and TRAI. These policies have been aimed towards being relevant to time and current technologies. The threats from emerging technologies like web 3.0 cannot be ignored and hence with active netizen participation and synergy between government and corporates will lead to a better and improved cyber ecosystem in India.
Executive Summary
A video circulating on social media claims that Chief of Defence Staff Anil Chauhan described US leaders as “toothless rulers” and said that US President Donald Trump cannot disobey Israeli Prime Minister Benjamin Netanyahu. The clip is being widely shared as a recent statement. However, research by the CyberPeace Research Wing found the claim to be misleading. A review of the full interview revealed that Chauhan was speaking about the need for India to prepare for the next phase of ‘Operation Sindoor’. He emphasised that the armed forces must move beyond past operations and gear up for future challenges.
Claim
Social media users have shared the video claiming that CDS Anil Chauhan referred to US leaders as “toothless rulers” and stated that Donald Trump cannot act against the wishes of Benjamin Netanyahu.
- Link: https://x.com/InsiderWB/status/2046263000928330130
- Archive: https://archive.ph/j8CeL
Fact Check
A detailed keyword search using terms such as “CDS Anil Chauhan, Donald Trump, JD Vance, Pakistan” did not yield any credible reports or verified statements supporting the viral claim. A reverse image search of keyframes from the clip traced it back to a post shared by India Today on April 18, 2026, where the same visuals and setting were used.
https://x.com/IndiaToday/status/2045531069647327240
In the original interview, Chauhan focused on military preparedness and the future course of ‘Operation Sindoor’. He did not make any remarks about US leadership, Donald Trump, or Benjamin Netanyahu. The complete version of the interaction, also aired on Aaj Tak, was reviewed in full and similarly contains no such controversial or political statements.
Conclusion
The viral claim is misleading. The video has been edited or taken out of context to falsely attribute remarks to CDS Anil Chauhan that he never made. In reality, his statements were limited to India’s military preparedness and did not include any comments on US or Israeli leadership.
Executive Summary
A video allegedly showing India’s Defence Secretary Rajesh Kumar Singh making remarks about Pakistan’s cyber capabilities is being widely shared on social media. The clip claims that Singh admitted Pakistan had “jammed Indian systems” on May 10 and described Pakistan’s cyber and electronic warfare capabilities as a major challenge for India. Research by CyberPeace Research Wing found that the viral clip is an AI-generated deepfake being circulated to spread misinformation. Rajesh Kumar Singh never made any such statement.
Claim
An X user shared the viral video claiming that India’s Defence Secretary had acknowledged Pakistan’s technological superiority. The post alleged that Singh admitted Pakistan successfully jammed Indian systems and claimed that India was lagging behind in cyber and electronic warfare technology.
Fact Check
To verify the claim, we searched relevant keywords on Google but found no credible media reports carrying such a statement from the Defence Secretary. We then extracted keyframes from the viral clip and conducted a reverse image search. During the research, we found the original video uploaded on the YouTube channel of ANI on April 30, 2026.
A review of the full video confirmed that Rajesh Kumar Singh never made the remarks heard in the viral clip. The original footage had been manipulated and altered using AI-generated audio techniques.
Conclusion
Our research confirms that the viral video is fake and AI-manipulated. The statement attributed to India’s Defence Secretary Rajesh Kumar Singh is fabricated, and the deepfake clip is being shared with misleading claims to spread disinformation.
