Context

• The signing of the United Nations Cybercrime Convention in late 2024 marked the first new multilateral criminal justice instrument in over two decades.
• Rather than signalling renewed multilateralism, the refusal of several major states to sign revealed deep divisions in governing cyberspace.
• For India, the Convention exposes a strategic dilemma shaped by shifting power balances, contested norms, and weakening global institutions.

The Politics Behind the UN Cybercrime Convention

• The Convention emerged from a 2017 resolution led by Russia and supported by China, aimed at challenging existing cyber governance frameworks.
• Until now, global cooperation in this area had largely revolved around the Budapest Convention, a European-led treaty that excludes non-invited states.
• Its limited inclusivity explains why many countries outside Europe declined to join.
• Although the UN Convention is formally open to all, consensus remained elusive.
• European states signed largely because the treaty incorporates definitions and procedures familiar from earlier frameworks, allowing them to retain influence over rule-making.
• By contrast, several countries, including the United States, expressed concern that vague definitions could legitimise expansive state control and undermine human rights.
• These disagreements illustrate how cyber governance has become deeply entangled with geopolitics, trust, and competing visions of digital order.

India’s Reluctance and the Limits of Global Influence

• India’s decision not to sign reflects a careful cost–benefit calculation rather than disengagement.
• Unlike earlier cybercrime frameworks, New Delhi participated actively in negotiations but failed to secure acceptance of its proposals, particularly those aimed at protecting national sovereignty and control over citizens’ data.
• This outcome points to a broader decline in India’s influence over global norm-setting compared to its earlier successes in climate diplomacy.
• India’s caution is driven by concern over preserving institutional autonomy in a fragmented system.
• While some powers seek to reshape global norms and others aim to preserve their seat at the table, India remains wary of commitments that could constrain domestic policymaking.
• The resulting divisions cut across traditional alliances, highlighting the growing complexity of contemporary governance.

The Growing Gulf Between Principles and Practice

• The Convention also illustrates the widening gap between shared principles and uneven implementation.
• Initial agreement focused on combating universally condemned harms, such as online child sexual abuse.
• However, broad and imprecise definitions of cybercrime allow states significant discretion in expanding criminal liability, potentially at the expense of civil liberties.
• This pattern mirrors developments in the regulation of artificial intelligence.
• Across global forums, governments endorse common values such as safety and trust, yet translate them into highly divergent domestic rules.
• India’s draft requirements for watermarking AI-generated content demonstrate how accepted objectives can lead to unusually prescriptive regulation, complicating cross-border cooperation and raising questions about proportionality.

Polycentrism and the Crisis of Multilateralism

• The Cybercrime Convention must be viewed within a wider crisis of global institutions. Financial retrenchment, institutional paralysis, and declining trust have weakened traditional forums.
• In this environment, global rule-making increasingly relies on smaller, overlapping arrangements, producing polycentricism.
• Multiple frameworks now coexist, interact, and sometimes conflict, placing heavy demands on state institutions.
• Cybercrime and cross-border data governance exemplify this trend. While there is broad agreement on goals, mechanisms differ widely, increasing compliance costs and testing national capacity.
• For countries like India, navigating this dense institutional landscape is becoming progressively more challenging.

Conclusion

• The UN Cybercrime Convention reflects not a unified digital future but a fragmented international order.
• For India, maintaining strategic autonomy will require more than principled restraint.
• It demands sustained investment in technical expertise, regulatory coherence, and the ability to engage simultaneously across multiple forums.
• Without such efforts, India risks losing influence in shaping the rules that will govern its digital and economic future.