Governing Crime Without Borders: The Budapest Legacy, the Hanoi Convention, and the Future of Cross-Border Cybercrime Cooperation

Cybercrime is the paradigm case of an offence that ignores the territorial premise on which
criminal law is built. A phishing operation can be authored in one country, hosted in a
second, monetised through accounts in a third, and felt by victims in a hundred more, while
the police who must respond remain creatures of national jurisdiction. This paper examines
how the international community has tried to close that gap, from the Council of Europe's
Budapest Convention of 2001 to the United Nations Convention against Cybercrime adopted
in December 2024 and opened for signature in Hanoi in October 2025. Drawing on legal
analysis and the political science of regime formation, we trace the persistent trilemma at the
heart of cross-border cybercrime governance: states want investigative speed, insist on
sovereignty over data and process, and are pressed, unevenly, to preserve rights safeguards,
and no existing instrument secures all three at once. We analyse the mutual legal assistance
bottleneck, the rise of unilateral and provider-based alternatives such as the US CLOUD Act,
and the negotiating cleavages that shaped the UN convention, including the human-rights
objections that accompanied its adoption. A regional lens on Latin America and the Global
South examines why formal accession has not translated into operational capacity, and what
the new convention's technical-assistance provisions would have to deliver to change that.
We argue that the coming decade of cybercrime cooperation will be decided less by treaty
text than by three quieter variables: the practical throughput of cooperation channels, the
credibility of safeguards oversight, and investment in forensic and judicial capacity outside
the wealthy world.