On 25 September, on the sidelines of the General Assembly’s 81st session in New York, EAM S. Jaishankar signed the United Nations Convention against Cybercrime, saying it ‘strengthens international cooperation for a safer digital future’.
A pen, a page, a few minutes in a hall full of flags. On 25 September, on the sidelines of the General Assembly’s 81st session in New York, External Affairs Minister S. Jaishankar signed the United Nations Convention against Cybercrime, saying it “strengthens international cooperation for a safer digital future”, and India’s name went into the register of the first global treaty written for crime that moves through wires and servers. Follow that moment down the long corridor of “implementation” to a police station in Pune or Patna, and the question waiting at the end is plain: will it help bring the money back?
Why would it? Because evidence will move faster. Why would evidence move faster? Because the treaty says it should. And what turns the treaty’s saying so into a magistrate’s order, a frozen account, a server log handed across an ocean… that is where the real work begins, and almost all of it still lies ahead.
The signature didn’t come in a hurry, and that matters. India sat through the drafting, shaped the text, and then, when 72 states lined up to sign at the opening ceremony in Hanoi in October 2025, it held back. It cited privacy, data sovereignty and governance, the same concerns it had carried into the negotiating room. It took a year to weigh the text against its own constitutional grain before signing, by which time the list of signatories had grown to some 95. That isn’t hesitation. It’s a state reading the fine print before putting its name to a promise. And the promise has a particular weight given where India stands on these questions. New Delhi never joined the Council of Europe’s Budapest Convention, for two decades the main international framework on cybercrime. It objected that it had no hand in writing the text, and it was wary of Article 32(b), which lets a foreign authority reach data on servers in another country with the consent of a private party, without passing through the host state at all. The UN convention was a different creature, negotiated where India sat as an equal rather than a latecomer, and signing it follows a conviction India has held for years: that the rules of the digital world should be written together, multilaterally, not inherited from a regional club.
A signature, though, is intent, a direction set, a promise in the conditional tense. Under the Law of Treaties, it obliges India not to defeat the convention’s object and purpose, but it binds India to none of its substantive provisions, opens no channel for evidence, and rewrites not one section of law. That comes only with ratification. The convention itself enters into force 90 days after the 40th state ratifies, and it is not yet in force; signature stays open at UN Headquarters until 31 December.
You see why eve r y gate matters once you’ve watched a cyber fraud case file spread across the map like ink in water: the victim in Indore, the call centre somewhere in Southeast Asia, the server in a third country, the cryptocurrency exchange registered in a fourth, the mule accounts that receive-layer-scatter the money strewn across a dozen Indian districts. Every border the money crosses is a border the evidence must cross too, and the evidence travels a slower road. Take a request for account data from an American platform. It goes from the Ministry of Home Affairs into diplomatic channels, to the US Department of Justice, to a US court, and only then to the platform itself, five handoffs for something that can vanish in an afternoon. The money moves at the speed of a click. The evidence moves at the speed of paper.
The convention was built for exactly this gap. The General Assembly adopted it unanimously in December 2024 after three years of negotiation. It gives states a common vocabulary for offences committed through information systems, procedures for preserving and sharing electronic evidence, and provisions for tracing, freezing and returning the proceeds of crime. That last part may matter most to India, where the real wound of online fraud is the near impossibility of recovering money once it has slipped across the frontier.
So what does it take to get from signature to a working instrument? The first gate is formal. Ratification in India is an executive act: the government approves it and deposits an instrument with the UN Secretary-General, along with whatever declarations the text permits. Treaties don’t enforce themselves here, though. Where a commitment needs a change in domestic law, Parliament has to legislate, and this convention needs it in at least three layers.
The first layer is the offences, and the arithmetic of punishment. The convention asks states to criminalise illegal access, illegal interception, interference with data and systems, misuse of devices, computer-related forgery and fraud, child sexual abuse material, the nonconsensual sharing of intimate images, and the laundering of proceeds, along with attempt, participation and corporate liability. Most of this already exists, spread across the Information Technology Act of 2000, the Bharatiya Nyaya Sanhita and the Prevention of Money-Laundering Act. The subtler work is in the numbers. Offences the convention itself establishes are covered by its cooperation machinery. Its wider reach, gathering electronic evidence of any “serious crime”, switches on only for offences that carry a maximum of at least four years in prison. Many IT Act offences stop at three. So the definitions need matching, and so does the grading of penalties, one by one, so that the cooperation India has signed up for reaches every case it was meant to reach.
The second layer is procedure, the powers themselves. The convention expects investigators to be able to order expedited preservation of stored data before it disappears, preserve and partially disclose traffic data to trace a communication’s path, compel production of subscriber information, search and seize digital evidence, collect traffic data in real time, intercept content in serious cases, and freeze, seize and confiscate proceeds. India has much of this already: production and search powers in the Bharatiya Nagarik Suraksha Sanhita, interception and trafficdata provisions in the IT Act, and CERT-In’s 2022 direction that service providers keep logs for 180 days. What’s needed now is speed and fit. That means a dedicated preservation order, issued in hours and honoured as a response to a foreign request, because data evaporates faster than paperwork moves.
Every one of these powers also has to come with the conditions and safeguards the convention requires, and here India’s own law sets the bar. The Supreme Court’s 2017 Puttaswamy judgment made privacy a fundamental right and laid down legality, necessity and proportionality as the tests every intrusion must pass. The Digital Personal Data Protection Act of 2023 governs how personal data is processed and moved, and the convention’s own article on personal data allows transfers only in line with domestic law. Building those tests into procedure from the start keeps the powers lawful and gives India a principled reason for every request it grants or declines.
The third layer is the plumbing between states. That means a 24/7 point of contact who picks up at three in the morning when a server in another time zone is about to be wiped. It means a central authority for mutual assistance, which the Ministry of Home Affairs already is, now running treaty-based channels alongside the old ones. It means updated extradition procedure, arrangements for joint investigations, and a legal route for receiving confiscated proceeds and returning them to the people they were taken from. Sovereignty belongs in this layer too. The convention lets a state refuse requests that would prejudice its sovereignty, security or essential interests, and India’s implementing law should say clearly who makes that call and how. That matters most for requests from states whose interests diverge sharply from India’s, and for data held by Indian intermediaries or relating to Indian citizens. The safeguards India can lean on are written into the text itself, in the articles on human rights, on conditions and safeguards, and on refusal where a request is discriminatory, and attempts to strip them out in the final negotiating session were voted down.
Then there is the gate no statute opens on its own: capacity. Police is a State subject, so every new power has to reach state cyber cells as rules, standard procedures, training, and forensic labs whose evidence a foreign court will accept. The base to build on is already there. The Indian Cyber Crime Coordination Centre coordinates the states. Its Threat Analytics Unit reads patterns across cases. The National Cybercrime Reporting Portal and the 1930 helpline give citizens a single door to knock on. The Citizen Financial Cyber Fraud Reporting and Management System freezes money in transit within hours. The Sahyog platform connects agencies to intermediaries. Taken together, the architecture already lines up closely with the convention’s own pillars of offences, evidence, cooperation and victim support. Until ratification, it carries the load, alongside the bilateral mutual legal assistance treaties, the letters rogatory and the police-to-police channels.
Even after ratification the gains will come corridor by corridor, because the convention binds only those who ratify, covers only what it names, and reaches only as far as each partner’s law allows. That is a reason to move early rather than wait. A treaty is shaped less by its text than by its first parties: how they write it into law, which safeguards they make standard, which requests they honour and which they let lapse. An India that ratifies early, and builds carefully, helps set those norms instead of inheriting them a second time. The pen has moved. What’s left is the slower work of statute, rule and practice, carried all the way down to the district cyber cell.
*Brijesh Singh is a senior IPS officer and an author (@ brijeshbsingh on X). His latest book on ancient India, “The Cloud Chariot” (Penguin) is out on stands. Views are personal
