E-Paper
Brics backed UN cybercrime treaty at Delhi summit: What it does, why India has not signed it yet
82 countries have signed, three have ratified. India, which spent five years negotiating the text, isn’t among them.
Prefer HTon Google
The New Delhi Declaration issued at Saturday’s Brics summit backed the United Nations Convention against Cybercrime, encouraging all states to sign and ratify the treaty adopted by the UN General Assembly in December 2024 and opened for signature in Hanoi last October.
Paragraph 47 of the declaration is the first time the Brics grouping explicitly endorsed the Convention. India, which hosted the summit and helped negotiate the treaty over five years, has not signed it. As of this week, 82 other states have.
Sandeep K Shukla, cybersecurity expert and director of the Cyber Manthan Center at IIIT Hyderabad, flagged this issue, noting that the declaration “encouraged countries to sign the UN treaty on cybercrime but interestingly India is yet to sign the treaty whereas 70+ countries have signed”.
The Indian cybercrime picture has two parts.
The first is the country's own domestic cottage industry. The phishing rings of Jamtara, the OTP-fraud clusters in Mewat, the mule-account networks operating out of small towns across northern and eastern India — these runs on cheap smartphones, stolen SIMs and social-engineering scripts, and target ordinary bank customers at volume. Individual losses tend to be small, but cumulatively, the drain is enormous.
The second is a newer layer. Over the last three years, industrial-scale scam compounds have taken root in pockets of Cambodia, Myanmar and Laos, largely run by Chinese criminal syndicates and staffed in part by trafficked Indians — young workers lured with promises of IT-sector jobs abroad and then held captive to run phone banks. These compounds dial into India at scale, running the “digital arrest” scam in which fraudsters pose as law enforcement or judicial officials over video call and extort money by threatening imminent arrest; investment scams that funnel victims into fake trading apps; and loan-app extortion rackets. Individual losses here are large.
The 73-year-old Ambala woman whose complaint triggered the Supreme Court's ongoing suo motu lost more than ₹1 crore. The Indian Cyber Crime Coordination Centre estimated in early 2024 that around half of daily complaints on the national cybercrime portal originate from this overlay: China and pockets of Cambodia and Myanmar. Its head added Laos to the list in a follow-up press conference that May.
Both are large, and both are growing. Losses to cybercrime overall tripled between 2023 and 2024, rising from ₹7,465 crore to ₹22,845 crore across roughly 2.2 million incidents — 85% of it is financial fraud, the Ministry of Home Affairs told Parliament in July last year. The evidence, the servers and the money trail in the transnational half are increasingly in jurisdictions Indian agencies have no access to.
The Supreme Court has been tracking this. In the ongoing digital-arrest suo motu, a bench headed by Chief Justice Surya Kant has said the state must respond with an “iron hand”. The attorney general told the Court in July that the Central Bureau of Investigation (CBI) alone was investigating some 20 major cases with individual losses above ₹10 crore each. On November 17, 2025, Justice Joymalya Bagchi asked Solicitor General Tushar Mehta whether India had ratified the UN Convention against Cybercrime. Mehta told the court it had not.
Also read: Cyber fraud ring busted, ₹5,600 cr trail uncovered in Kanpur; two held
India and the UN treaty
India spent five years helping draft this treaty. It voted for the 2019 Russian resolution that set up the negotiating committee, and its submissions helped shape the final language on data-transfer sovereignty. India’s delegation did not sign at the Hanoi opening ceremony on October 25-26 last year, when 71 states put their names to the document on the first day.
If India does sign it, it will also need to ratify it. Signature signals intent and creates an obligation not to act against the treaty’s purpose. Ratification binds a state to its actual provisions.
Under the convention's rules, the signature window closes on December 31, 2026. Forty ratifications are needed for the treaty to come into force, with entry 90 days after the fortieth. Only three states — Qatar, Azerbaijan and Vietnam — have ratified so far, all with substantive reservations. Qatar has excluded the articles on non-consensual intimate imagery and child sexual abuse material, citing conflict with Islamic Sharia. Vietnam has declared the entire convention non-self-executing — meaning its provisions do not automatically become Vietnamese law and would need separate domestic legislation to take effect.
A recent peer-reviewed paper in the Journal of Economic Criminology, co-authored by Shukla, sets out the reasoning on the India side. India refused, over two decades, to accede to the Council of Europe’s 2001 Budapest Convention — the treaty the new one is meant to supersede globally — because Article 32(b) of that instrument would have allowed foreign authorities to access data on Indian servers without domestic authorisation.
The UN treaty was, in part, India’s preferred alternative. It has its own domestic complications – stemming no less from the fact that several scam syndicates targeting people in the West, especially English-speaking US and UK, are based in India.
At the operational level, the Convention builds a faster and more predictable rail for cross-border criminal cooperation. Under the current system, if Indian police want account data from a US platform — messages, phone numbers, account-holder details — they file what is called a mutual legal assistance treaty request. That request is routed through the ministry of home affairs, then diplomatic channels, then to the US Department of Justice, then to a US court that decides whether to compel the platform to hand over the data.
The US President's Review Group estimated in 2013 that such requests take about ten months on average. In cybercrime, where server logs can be deleted in days, ten months is functionally useless.
Also read: Traditional crime offenders take to cyber frauds
The convention shortens this process. Article 41 obliges every party to run a 24-hour, seven-day-a-week contact point for urgent requests. Article 42 requires states to preserve digital evidence on request without waiting for the requesting country to prove the offence is criminal in both jurisdictions — a critical carve-out at the stage when server logs and account data are most likely to be deleted. Articles 45 and 46 extend the framework to real-time interception of traffic and content data. Articles 31, 49 and 52 build out an asset-recovery architecture: freezing bank records, tracing proceeds, and returning confiscated money.
This is the mechanism India would need to retrieve money that flowed from an Indian victim’s account to a wallet in Sihanoukville in Cambodia.
Three specific problems complicate ratification for India.
The first is definitional. The Information Technology Act, 2000 punishes most cybercrimes with less than three years of imprisonment. The convention’s international-cooperation mechanisms only trigger for what it calls "serious crimes", defined as offences carrying at least four years of jail. Most Indian cybercrimes would therefore not qualify for extradition assistance under the treaty. The draft bill on digital arrests and deepfakes that the solicitor general told the Supreme Court in July was “coming up”. No such bill has yet been tabled, and would need to raise sentences substantially for that gap to close.
The second is reciprocity. The same channels that would let India request data from a foreign platform would also let a foreign state request data from India. Shukla’s paper flags the specific concern that India has not publicly indicated how it would handle requests from Pakistan, or from China. The convention’s human-rights safeguards — Article 6.2 on general protection, Article 24 on surveillance oversight, Article 40(22) on grounds for refusing assistance — are provisions that Russia, China and Iran tried and failed to weaken in the final draft, and that several states have signalled they intend to treat as optional through reservations.
The third is execution. The convention's capacity-building provisions are largely voluntary. If the US and major European Union (EU) member states do not ratify, or ratify without contributing to the UNODC’s implementation budget, the practical leverage for a state like India is limited. Google, WhatsApp and Microsoft are all headquartered in jurisdictions whose participation is still uncertain.
In a 2024 case in Gurugram, when Haryana Police sought account information from WhatsApp on an active investigation, the company did not respond at all. That is the enforcement gap the convention is aiming to address but it also exemplifies that from the Indian perspective, at least, the mechanism only works if a country like US – home to all Big Tech firms – signs on.
The Brics endorsement in paragraph 47 comes with a caveat — "in accordance with domestic laws, processes and procedures" — inserted at the drafting stage. New Delhi can read the paragraph as backing for signing. It can equally read it as cover for the delay it has kept up so far.
