Governing Crime Without Borders: The Budapest Legacy, the Hanoi Convention, and the Future of Cross-Border Cybercrime Cooperation

Abstract

Cybercrime is the paradigm case of an offence that ignores the territorial premise on which criminal law is built. A phishing operation can be authored in one country, hosted in a second, monetised through accounts in a third, and felt by victims in a hundred more, while the police who must respond remain creatures of national jurisdiction. This paper examines how the international community has tried to close that gap, from the Council of Europe's Budapest Convention of 2001 to the United Nations Convention against Cybercrime adopted in December 2024 and opened for signature in Hanoi in October 2025. Drawing on legal analysis and the political science of regime formation, we trace the persistent trilemma at the heart of cross-border cybercrime governance: states want investigative speed, insist on sovereignty over data and process, and are pressed, unevenly, to preserve rights safeguards, and no existing instrument secures all three at once. We analyse the mutual legal assistance bottleneck, the rise of unilateral and provider-based alternatives such as the US CLOUD Act, and the negotiating cleavages that shaped the UN convention, including the human-rights objections that accompanied its adoption. A regional lens on Latin America and the Global South examines why formal accession has not translated into operational capacity, and what the new convention's technical-assistance provisions would have to deliver to change that. We argue that the coming decade of cybercrime cooperation will be decided less by treaty text than by three quieter variables: the practical throughput of cooperation channels, the credibility of safeguards oversight, and investment in forensic and judicial capacity outside the wealthy world.