iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
HackerOne asked the U.S. government to press for explicit safeguards for good-faith security researchers in the UN cybercrime convention, and to promote protections through domestic policy if treaty wording could not be changed. That was the company’s advocacy—not a legal ruling that the convention either protects or criminalizes such research.
What HackerOne asked U.S. officials to do
In a November 14, 2024 letter, Ilona Cohen, HackerOne’s Chief Legal and Policy Officer, wrote to Secretary of State Antony Blinken, Attorney General Merrick Garland, and USAID Administrator Samantha Power. She urged the United States to keep working at the UN to incorporate protections for good-faith research into the treaty “if possible,” and to encourage other countries to protect such work in national law, law-enforcement policies, and practices. HackerOne’s letter set out the company’s request.
The concern behind the appeal
HackerOne argued that the treaty recognized legitimate security research only insofar as domestic law permits it, while its restrictions concerning computer access and use did not, in the company’s view, ensure consistent legal protections. The company warned that countries could model domestic rules on the treaty in ways that expose ethical researchers to prosecution, especially where local safeguards are weak. This is HackerOne’s assessment of the risk, not a court decision or an established interpretation of the convention.
Free tools Windows power users keep installed
One-click scans. No signup required.
Fallback measures if treaty text stayed unchanged
The letter also proposed actions the United States could take outside the treaty text:
#1 Best Overall
- Include protections for good-faith security research in U.S. cybersecurity capacity-building programs.
- Condition digital capacity-building funds on recipient governments refraining from prosecuting good-faith researchers.
- Work with nongovernmental capacity-building organizations and like-minded governments to share implementation practices that distinguish ethical research from cybercrime.
The proposals reflect HackerOne’s preferred policy response; the letter does not establish that these measures were adopted.
Why treaty recognition is not the same as protection
A treaty’s language and a country’s domestic implementation are distinct. The recognition HackerOne pointed to did not, in the company’s reading, amount to a clear, broadly applicable legal safe harbor for researchers. Whether a particular security test is lawful can depend on the applicable national law and facts, including authorization and conduct. The letter raised a concern about how countries might implement the convention; it did not settle how the treaty would apply in any specific case.
After the convention was adopted, HackerOne renewed its appeal in a December 27, 2024 press release. Cohen said, “Good faith security research protects people. The worthy goal of this treaty to combat malicious cyber criminals will be undermined if countries fail to differentiate between ethical hacking and criminal behavior.” She urged member countries to protect beneficial research through national laws, policies, and guidelines. That statement expressed the company’s position; it does not show that such protections were enacted.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Is the UN cybercrime convention in force?
No. The UN Treaty Collection, checked October 4, 2026, reported that the convention had been adopted by General Assembly resolution 79/243 on December 24, 2024. It opened for signature in Hanoi on October 25–26, 2025, and remains open for signature at UN Headquarters in New York through December 31, 2026.
| Term | What it means here |
|---|---|
| Signatory | A state has signed the convention. Signature alone does not make it a party or bring the convention into force. |
| Party | A state has deposited an instrument of ratification, acceptance, approval, or accession, as applicable. |
| In force | The convention has met its entry-into-force requirements and has become operative under its terms. |
As of October 4, 2026, the UN listed 95 signatories and three parties, and said the convention was not yet in force. Article 65(1) requires 40 qualifying instruments; the convention enters into force 90 days after the fortieth is deposited. These status counts can change.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the appeal means for researchers
HackerOne’s November 2024 letter is best understood as a call for policy safeguards, not a statement of what the convention has definitively made lawful or unlawful. Its central distinction is between recognizing beneficial research in principle and ensuring that national laws and enforcement practices give researchers dependable protection. The company urged the United States to pursue both treaty-level safeguards where possible and domestic or capacity-building measures regardless of whether the text changed.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
