Reconciling cross-border access to stored electronic evidence with sovereignty under the UN Cybercrime Convention
Abstract
Background. This study addresses the tension between efficient cross-border access to stored electronic evidence and state sovereignty, procedural safeguards, and personal-data protection.
Purpose. The objective is to develop and justify a sovereignty-compatible decision sequence under the United Nations Convention against Cybercrime and to identify the limits of Budapest and European Union mechanisms as implementation comparators.
Materials and methods. The study applies doctrinal treaty interpretation under Articles 31 and 32 of the Vienna Convention on the Law of Treaties, functional comparative analysis, and an E/P/N framework across ten categories. Official legal texts and relevant scholarship were reviewed and mapped.
Results. Of the ten categories, preservation is the only E-coded category; eight other categories are P-coded, while the endpoint category comprises three P-coded subfunctions: request response, provider or affected-person remedies, and interstate dispute settlement. Article 40(7) is pivotal because an applicable mutual-assistance treaty ordinarily governs procedure. The proposed sequence separates preservation from disclosure, addresses uncertain data location through Articles 41 and 42, and incorporates the Article 43 traffic-data route.
Conclusions. The Convention supplies the core legal architecture but leaves substantial procedural detail to applicable treaties, reservations, and domestic law; the proposed sequence therefore provides an ex ante implementation framework that preserves sovereign legal functions while maintaining review, proportionality, and data-protection safeguards.
Keywords
cross-border electronic evidence, UN Cybercrime Convention, state sovereignty, stored electronic data, mutual legal assistance, proportionality, personal data protection, international cooperation, E/P/N Model, functional comparative study, extraterritorial jurisdiction, discretionary powers of the state
Согласование трансграничного доступа к хранящимся электронным доказательствам с принципом суверенитета в рамках Конвенции ООН о киберпреступности
Аннотация
Обоснование. Настоящее исследование посвящено противоречию между эффективным трансграничным доступом к хранимым электронным доказательствам и государственным суверенитетом, процессуальными гарантиями и защитой персональных данных.
Цель. Цель исследования состоит в разработке и обосновании совместимой с принципом государственного суверенитета последовательности принятия решений в рамках Конвенции Организации Объединенных Наций против киберпреступности, а также в определении пределов применимости механизмов Будапештской конвенции и Европейского союза в качестве сравнительных ориентиров для имплементации.
Материалы и методы. В исследовании применяются доктринальное толкование международных договоров в соответствии со статьями 31 и 32 Венской конвенции о праве международных договоров, функционально-сравнительный анализ и модель E/P/N, охватывающая десять категорий. Были проанализированы и систематизированы официальные правовые тексты и соответствующая научная литература.
Результаты. Из десяти категорий обеспечение сохранности данных является единственной категорией, классифицированной как E; восемь других категорий классифицированы как P, тогда как категория конечных функций включает три подфункции, классифицированные как P: реагирование на запрос, средства правовой защиты поставщика услуг или затронутого лица и урегулирование межгосударственных споров. Статья 40(7) имеет ключевое значение, поскольку применимый договор о взаимной правовой помощи, как правило, регулирует соответствующую процедуру. Предлагаемая последовательность разграничивает обеспечение сохранности данных и их раскрытие, учитывает неопределенность местонахождения данных посредством механизмов статей 41 и 42 и включает предусмотренный статьей 43 механизм в отношении данных о трафике.
Выводы. Конвенция устанавливает основную правовую архитектуру, однако оставляет существенный объем процессуального регулирования применимым договорам, оговоркам и внутреннему законодательству; поэтому предлагаемая последовательность представляет собой модель имплементации ex ante, обеспечивающую сохранение суверенных правовых функций государства при одновременном сохранении гарантий проверки, пропорциональности и защиты персональных данных.
Ключевые слова
трансграничные электронные доказательства, Конвенция ООН против киберпреступности, государственный суверенитет, хранимые электронные данные, взаимная правовая помощь, пропорциональность, защита персональных данных, международное сотрудничество, модель E/P/N, функционально-сравнительное исследование, экстерриториальная юрисдикция, дискреционные полномочия государства
Список литературы
1. Abraha, H. H. (2020). Regulating law enforcement access to electronic evidence across borders: The United States approach. Information & Communications Technology Law, 29(3), 324–353. https://doi.org/10.1080/13600834.2020.1794617. EDN: https://elibrary.ru/AXPXAA
2. Abraha, H. H. (2021). Law enforcement access to electronic evidence across borders: Mapping policy approaches and emerging reform initiatives. International Journal of Law and Information Technology, 29(2), 118–153. https://doi.org/10.1093/ijlit/eaab001. EDN: https://elibrary.ru/XVNEUR
3. African Union. (2014). African Union Convention on Cyber Security and Personal Data Protection. https://au.int/en/treaties/african-union-convention-cyber-security-and-personal-data-protection
4. Barber, I. A., & Kumar, S. (2024). Learning from the ground up: Lessons from civil society engagement in addressing the human rights implications of cybercrime legislation. Journal of Cyber Policy, 9(2), 131–148. https://doi.org/10.1080/23738871.2023.2240331. EDN: https://elibrary.ru/PHJMOC
5. Carrera, S., Stefan, M., & Mitsilegas, V. (2020). Cross-border data access in criminal proceedings and the future of digital justice: Navigating the current legal framework and exploring ways forward within the EU and across the Atlantic. Centre for European Policy Studies. https://www.ceps.eu/ceps-publications/cross-border-data-access-in-criminal-proceedings-and-the-future-of-digital-justice
6. Christakis, T., & Terpan, F. (2021). EU-US negotiations on law enforcement access to data: Divergences, challenges and EU law procedures and options. International Data Privacy Law, 11(2), 81–106. https://doi.org/10.1093/idpl/ipaa022. EDN: https://elibrary.ru/YULNZE
7. Council of Europe. (2001). Convention on Cybercrime (ETS No. 185). https://www.coe.int/en/web/conventions/full-list?module=treaty-detail&treatynum=185
8. Council of Europe. (2021). Explanatory report to the Second Additional Protocol to the Convention on Cybercrime on enhanced co-operation and disclosure of electronic evidence (CETS No. 224). https://rm.coe.int/second-additional-protocol-to-the-convention-on-cybercrime-explanatory/1680a2aef1
9. Council of Europe. (2022). Second Additional Protocol to the Convention on Cybercrime on enhanced co-operation and disclosure of electronic evidence (CETS No. 224). https://www.coe.int/en/web/conventions/full-list?module=treaty-detail&treatynum=224
10. Cybersecurity Tech Accord. (2024, August 8). Open letter from civil society and industry stakeholders on the final draft of the Convention on Cybercrime. https://cybertechaccord.org/uploads/prod/Final-Draft-Cybercrime-Convention-Multistakeholder-Statement.pdf
11. European Commission. (2018, April 17). Frequently asked questions: New EU rules to obtain electronic evidence (MEMO/18/3345). https://ec.europa.eu/commission/presscorner/detail/en/MEMO_18_3345
12. European Parliament & Council of the European Union. (2014). Directive 2014/41/EU regarding the European Investigation Order in criminal matters. Official Journal of the European Union, L 130, 1–36. https://eur-lex.europa.eu/eli/dir/2014/41/oj
13. European Parliament & Council of the European Union. (2016a). Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for law-enforcement purposes. Official Journal of the European Union, L 119, 89–131. https://eur-lex.europa.eu/eli/dir/2016/680/oj
14. European Parliament & Council of the European Union. (2016b). Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. Official Journal of the European Union, L 119, 1–88. https://eur-lex.europa.eu/eli/reg/2016/679/oj
15. European Parliament & Council of the European Union. (2023a). Directive (EU) 2023/1544 laying down harmonised rules on designated establishments and legal representatives for gathering electronic evidence in criminal proceedings. Official Journal of the European Union, L 191, 181–190. https://eur-lex.europa.eu/eli/dir/2023/1544/oj
16. European Parliament & Council of the European Union. (2023b). Regulation (EU) 2023/1543 on European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings. Official Journal of the European Union, L 191, 118–180. https://eur-lex.europa.eu/eli/reg/2023/1543/oj
17. Global Privacy Assembly. (2021). Resolution on government access to data, privacy and the rule of law: Principles for governmental access to personal data held by the private sector for national security and public safety purposes. https://globalprivacyassembly.org/wp-content/uploads/2021/10/20211025-GPA-Resolution-Government-Access-Final-Adopted_.pdf
18. Hakmeh, J. (2024). The UN convention on cybercrime: A milestone in cybercrime cooperation? Journal of Cyber Policy, 9(2), 125–130. https://doi.org/10.1080/23738871.2024.2441549. EDN: https://elibrary.ru/AHHJXQ
19. Human Rights Watch. (2024, October 21). EU: Member states should vote ‘No’ on UN Cybercrime Treaty. https://www.hrw.org/news/2024/10/21/eu-member-states-should-vote-no-un-cybercrime-treaty
20. Kuckartz, U., & Rädiker, S. (2023). Qualitative content analysis: Methods, practice and using software. SAGE. https://uk.sagepub.com/en-gb/eur/qualitative-content-analysis/book279751
21. Mason, S., & Seng, D. (2021). The foundations of evidence in electronic form. In S. Mason & D. Seng (Eds.), Electronic evidence and electronic signatures (5th ed., pp. 51–84). University of London Press. https://doi.org/10.14296/2108.9781911507246
22. Organisation for Economic Co-operation and Development. (2022). OECD Declaration on Government Access to Personal Data Held by Private Sector Entities (OECD/LEGAL/0487). https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0487
23. Scher-Zagier, E. (2024). Jurisdictional creep: The UN Cybercrime Convention and the expansion of passive personality jurisdiction. SSRN. https://doi.org/10.2139/ssrn.4957176
24. Sukumar, A., & Basu, A. (2024). Back to the territorial state: China and Russia’s use of UN cybercrime negotiations to challenge the liberal cyber order. Journal of Cyber Policy, 9(2), 256–287. https://doi.org/10.1080/23738871.2024.2436591
25. United Nations. (1969). Vienna Convention on the Law of Treaties. United Nations Treaty Series, 1155, 331. https://legal.un.org/ilc/texts/instruments/english/conventions/1_1_1969.pdf
26. United Nations. (2020). Countering the use of information and communications technologies for criminal purposes (A/RES/74/247). https://docs.un.org/en/A/RES/74/247
27. United Nations. (2024). United Nations Convention against Cybercrime; Strengthening international cooperation for combating certain crimes committed by means of information and communications technology systems and for the sharing of evidence in electronic form of serious crimes (A/RES/79/243, annex). https://www.unodc.org/unodc/en/cybercrime/convention/text/convention-full-text.html
28. United Nations Counter-Terrorism Committee Executive Directorate. (2022). The state of international cooperation for lawful access to digital evidence. https://www.un.org/securitycouncil/ctc/sites/www.un.org.securitycouncil.ctc/files/files/documents/2022/Jan/cted_trends_report_lawful_access_to_digital_data_.pdf
29. United Nations Treaty Collection. (n.d.). United Nations Convention against Cybercrime: Status of treaties. Retrieved August 7, 2026, from https://treaties.un.org/Pages/ViewDetails.aspx?src=TREATY&mtdsg_no=XVIII-16&chapter=18&clang=_en
30. United States Congress. (2018). Clarifying Lawful Overseas Use of Data Act, Pub. L. No. 115-141, div. V, 132 Stat. 1213. https://www.congress.gov/115/plaws/publ141/PLAW-115publ141.pdf
31. Vardanyan, L., & Kocharyan, H. (2022). Critical views on the phenomenon of EU digital sovereignty through the prism of global data governance reality: Main obstacles and challenges. European Studies, 9(2), 110–132. https://doi.org/10.2478/eustu-2022-0016. EDN: https://elibrary.ru/FZGOYT
32. Vardanyan, L., Kocharyan, H., Hamuľák, O., & Kerikmäe, T. (2023). Digital sovereignty in the EU: Searching for legal mechanisms for marking the borders. In D. Ramiro Troitiño, T. Kerikmäe, & O. Hamuľák (Eds.), Digital development of the European Union (pp. 219–234). Springer, Cham. https://doi.org/10.1007/978-3-031-27312-4_14
References
1. Abraha, H. H. (2020). Regulating law enforcement access to electronic evidence across borders: The United States approach. Information & Communications Technology Law, 29(3), 324–353. https://doi.org/10.1080/13600834.2020.1794617. EDN: https://elibrary.ru/AXPXAA
2. Abraha, H. H. (2021). Law enforcement access to electronic evidence across borders: Mapping policy approaches and emerging reform initiatives. International Journal of Law and Information Technology, 29(2), 118–153. https://doi.org/10.1093/ijlit/eaab001. EDN: https://elibrary.ru/XVNEUR
3. African Union. (2014). African Union Convention on Cyber Security and Personal Data Protection. https://au.int/en/treaties/african-union-convention-cyber-security-and-personal-data-protection
4. Barber, I. A., & Kumar, S. (2024). Learning from the ground up: Lessons from civil society engagement in addressing the human rights implications of cybercrime legislation. Journal of Cyber Policy, 9(2), 131–148. https://doi.org/10.1080/23738871.2023.2240331. EDN: https://elibrary.ru/PHJMOC
5. Carrera, S., Stefan, M., & Mitsilegas, V. (2020). Cross-border data access in criminal proceedings and the future of digital justice: Navigating the current legal framework and exploring ways forward within the EU and across the Atlantic. Centre for European Policy Studies. https://www.ceps.eu/ceps-publications/cross-border-data-access-in-criminal-proceedings-and-the-future-of-digital-justice
6. Christakis, T., & Terpan, F. (2021). EU-US negotiations on law enforcement access to data: Divergences, challenges and EU law procedures and options. International Data Privacy Law, 11(2), 81–106. https://doi.org/10.1093/idpl/ipaa022. EDN: https://elibrary.ru/YULNZE
7. Council of Europe. (2001). Convention on Cybercrime (ETS No. 185). https://www.coe.int/en/web/conventions/full-list?module=treaty-detail&treatynum=185
8. Council of Europe. (2021). Explanatory report to the Second Additional Protocol to the Convention on Cybercrime on enhanced co-operation and disclosure of electronic evidence (CETS No. 224). https://rm.coe.int/second-additional-protocol-to-the-convention-on-cybercrime-explanatory/1680a2aef1
9. Council of Europe. (2022). Second Additional Protocol to the Convention on Cybercrime on enhanced co-operation and disclosure of electronic evidence (CETS No. 224). https://www.coe.int/en/web/conventions/full-list?module=treaty-detail&treatynum=224
10. Cybersecurity Tech Accord. (2024, August 8). Open letter from civil society and industry stakeholders on the final draft of the Convention on Cybercrime. https://cybertechaccord.org/uploads/prod/Final-Draft-Cybercrime-Convention-Multistakeholder-Statement.pdf
11. European Commission. (2018, April 17). Frequently asked questions: New EU rules to obtain electronic evidence (MEMO/18/3345). https://ec.europa.eu/commission/presscorner/detail/en/MEMO_18_3345
12. European Parliament & Council of the European Union. (2014). Directive 2014/41/EU regarding the European Investigation Order in criminal matters. Official Journal of the European Union, L 130, 1–36. https://eur-lex.europa.eu/eli/dir/2014/41/oj
13. European Parliament & Council of the European Union. (2016a). Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for law-enforcement purposes. Official Journal of the European Union, L 119, 89–131. https://eur-lex.europa.eu/eli/dir/2016/680/oj
14. European Parliament & Council of the European Union. (2016b). Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. Official Journal of the European Union, L 119, 1–88. https://eur-lex.europa.eu/eli/reg/2016/679/oj
15. European Parliament & Council of the European Union. (2023a). Directive (EU) 2023/1544 laying down harmonised rules on designated establishments and legal representatives for gathering electronic evidence in criminal proceedings. Official Journal of the European Union, L 191, 181–190. https://eur-lex.europa.eu/eli/dir/2023/1544/oj
16. European Parliament & Council of the European Union. (2023b). Regulation (EU) 2023/1543 on European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings. Official Journal of the European Union, L 191, 118–180. https://eur-lex.europa.eu/eli/reg/2023/1543/oj
17. Global Privacy Assembly. (2021). Resolution on government access to data, privacy and the rule of law: Principles for governmental access to personal data held by the private sector for national security and public safety purposes. https://globalprivacyassembly.org/wp-content/uploads/2021/10/20211025-GPA-Resolution-Government-Access-Final-Adopted_.pdf
18. Hakmeh, J. (2024). The UN convention on cybercrime: A milestone in cybercrime cooperation? Journal of Cyber Policy, 9(2), 125–130. https://doi.org/10.1080/23738871.2024.2441549. EDN: https://elibrary.ru/AHHJXQ
19. Human Rights Watch. (2024, October 21). EU: Member states should vote ‘No’ on UN Cybercrime Treaty. https://www.hrw.org/news/2024/10/21/eu-member-states-should-vote-no-un-cybercrime-treaty
20. Kuckartz, U., & Rädiker, S. (2023). Qualitative content analysis: Methods, practice and using software. SAGE. https://uk.sagepub.com/en-gb/eur/qualitative-content-analysis/book279751
21. Mason, S., & Seng, D. (2021). The foundations of evidence in electronic form. In S. Mason & D. Seng (Eds.), Electronic evidence and electronic signatures (5th ed., pp. 51–84). University of London Press. https://doi.org/10.14296/2108.9781911507246
22. Organisation for Economic Co-operation and Development. (2022). OECD Declaration on Government Access to Personal Data Held by Private Sector Entities (OECD/LEGAL/0487). https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0487
23. Scher-Zagier, E. (2024). Jurisdictional creep: The UN Cybercrime Convention and the expansion of passive personality jurisdiction. SSRN. https://doi.org/10.2139/ssrn.4957176
24. Sukumar, A., & Basu, A. (2024). Back to the territorial state: China and Russia’s use of UN cybercrime negotiations to challenge the liberal cyber order. Journal of Cyber Policy, 9(2), 256–287. https://doi.org/10.1080/23738871.2024.2436591
25. United Nations. (1969). Vienna Convention on the Law of Treaties. United Nations Treaty Series, 1155, 331. https://legal.un.org/ilc/texts/instruments/english/conventions/1_1_1969.pdf
26. United Nations. (2020). Countering the use of information and communications technologies for criminal purposes (A/RES/74/247). https://docs.un.org/en/A/RES/74/247
27. United Nations. (2024). United Nations Convention against Cybercrime; Strengthening international cooperation for combating certain crimes committed by means of information and communications technology systems and for the sharing of evidence in electronic form of serious crimes (A/RES/79/243, annex). https://www.unodc.org/unodc/en/cybercrime/convention/text/convention-full-text.html
28. United Nations Counter-Terrorism Committee Executive Directorate. (2022). The state of international cooperation for lawful access to digital evidence. https://www.un.org/securitycouncil/ctc/sites/www.un.org.securitycouncil.ctc/files/files/documents/2022/Jan/cted_trends_report_lawful_access_to_digital_data_.pdf
29. United Nations Treaty Collection. (n.d.). United Nations Convention against Cybercrime: Status of treaties. Retrieved August 7, 2026, from https://treaties.un.org/Pages/ViewDetails.aspx?src=TREATY&mtdsg_no=XVIII-16&chapter=18&clang=_en
30. United States Congress. (2018). Clarifying Lawful Overseas Use of Data Act, Pub. L. No. 115-141, div. V, 132 Stat. 1213. https://www.congress.gov/115/plaws/publ141/PLAW-115publ141.pdf
31. Vardanyan, L., & Kocharyan, H. (2022). Critical views on the phenomenon of EU digital sovereignty through the prism of global data governance reality: Main obstacles and challenges. European Studies, 9(2), 110–132. https://doi.org/10.2478/eustu-2022-0016. EDN: https://elibrary.ru/FZGOYT
32. Vardanyan, L., Kocharyan, H., Hamuľák, O., & Kerikmäe, T. (2023). Digital sovereignty in the EU: Searching for legal mechanisms for marking the borders. In D. Ramiro Troitiño, T. Kerikmäe, & O. Hamuľák (Eds.), Digital development of the European Union (pp. 219–234). Springer, Cham. https://doi.org/10.1007/978-3-031-27312-4_14