Draft Law on Accession to the Budapest Convention on Cybercrime

First — Current international position of Iraq and the Convention

The Convention on Cybercrime opened for signature in Budapest on 23 November 2001 and entered into force on 1 July 2004. Although a Council of Europe treaty, it is not confined to member states: Article (37) permits non-members to accede following a formal invitation. The Council of Europe presents it today as a global framework combining criminalization standards, electronic-evidence procedures and international cooperation, with 83 states parties in 2026.[4][5]

Iraq does not appear in the latest published register of parties or invited states. This matters legally: accession is not an immediately available unilateral act for Iraq, but must be preceded by an invitation decision from the Committee of Ministers. Under Treaty Office guidance, a state's request is generally sent in a letter from the foreign minister or an authorized diplomatic representative to the Secretary General. Consultations with relevant states follow, and the request goes before the Rapporteur Group on Legal Co-operation and then the Committee of Ministers. Once invited, Iraq has a five-year window to complete accession.[6]

This sequence offers Iraq a practical benefit: the invitation and consultation period can be used to complete domestic information technology crime and digital evidence law, adopt expedited data-preservation arrangements, designate the central judicial-cooperation authority, test the round-the-clock contact point and train judges, investigators and public prosecutors. Accession then becomes more than a political declaration preceding operational readiness: international status coincides with actual institutional capacity to meet obligations.

Second — Constitutional framework and accession process

The Iraqi Constitution clearly allocates treaty-related powers. The Council of Ministers negotiates and signs international treaties and agreements, or authorizes others to do so; the federal authority handles foreign policy and treaty negotiation; and the Council of Representatives regulates ratification by law. The President of the Republic ratifies treaties and agreements following Council approval under the relevant constitutional powers.[1]

Recent constitutional precedent resolves the voting-majority issue. In its 2023 ruling on the law ratifying the Agreement Regulating Maritime Navigation in Khor Abdullah, the Federal Supreme Court declared the ratification law unconstitutional for failing to achieve the two-thirds majority of Council members required by Article (61/Fourth). The POL-93 process must therefore be designed on the basis that the Budapest accession law requires a two-thirds majority, regardless of differing readings of lower-ranking legislative provisions.[2]

Treaty Conclusion Law No. (35) of 2015 provides the domestic procedural framework for concluding and acceding to treaties, including negotiations, instruments of full powers, expression of consent to be bound, deposit of accession instruments and publication. It must be applied consistently with the Constitution and the Federal Supreme Court's binding interpretation.[3]

Requesting an invitation should not be conditional on completing every legislative amendment in advance, because technical dialogue with the Council of Europe may help identify gaps. Deposit must, however, follow sufficient alignment so Iraq does not commit to powers and procedures its judicial and executive bodies cannot lawfully and safely apply.

Third — What does the Budapest Convention require?

The Convention comprises four connected chapters. The first defines computer systems, data, service providers and traffic data. The second requires domestic measures on substantive offences, procedures, evidence and jurisdiction. The third governs international cooperation, including extradition, mutual legal assistance, expedited data preservation and the 24/7 contact point. The fourth contains final provisions on signature, accession, declarations, reservations, entry into force and follow-up.[4][7]

The Convention's principal value for Iraq is not its offence list alone. Domestic law can establish offences, but electronic evidence often sits with a service provider, server or platform abroad and may disappear within hours. This is where urgent preservation, direct contact-point channels and an agreed mutual-assistance framework matter. The Convention's procedural and cooperative instruments are also not confined to computer offences: they extend to electronic evidence relating to other offences within its procedural scope, important for terrorism, corruption, trafficking, extortion and financial crime cases involving digital evidence.[9]

Conversely, the Convention grants no general surveillance licence. Article (15) subjects powers and procedures to domestic conditions and safeguards, protection of rights and freedoms, and proportionality. This aligns with Iraq's constitutional privacy, communications and expression protections. Iraqi alignment must therefore reject blanket searches, unspecified surveillance and unnecessary mass data retention, and subject interception of communications content to judicial authorization under stringent conditions.

Fourth — Gaps to close before deposit

The first problem is that Iraq is still developing a specialized, comprehensive law on information technology crime and digital evidence. The proposed law's first reading was completed in July 2026, its second reading postponed in September, and Security and Defence Committee deliberations continued on 4 October. Budapest accession should therefore improve the legislation in progress, rather than proceed separately from it.[11][12]

The second problem is digital procedure. The Code of Criminal Procedure was drafted before cloud computing, smartphones and volatile data. Iraq needs express provisions distinguishing preservation of existing data against deletion from obtaining it, searching a system or storage medium, collecting traffic data in real time and intercepting communications content. Each level requires corresponding judicial scrutiny and temporal and substantive limits.

The third problem is international judicial cooperation. Iraq has a foundation to build on, including the National Centre for International Judicial Cooperation within the Supreme Judicial Council, which expanded cooperation with Eurojust during 2026, alongside the roles of public prosecution, the Ministry of Foreign Affairs and security bodies. Budapest nevertheless requires specific formal designations at deposit and a contact point operating in practice twenty-four hours a day, seven days a week, not merely an administrative address.[13][14]

The fourth problem is digital evidence chain of custody and verification standards. Supreme Judicial Council work in 2026 showed growing attention to digital evidence in extortion and deepfake offences and how to handle it. This should become uniform legislative and procedural rules covering forensic copies, digital hashing, evidence access logs, source verification and the ability of an independent expert to re-examine evidence.[15]

The fifth problem is personal data protection and professional confidentiality. Data production or international sharing orders must not create a channel bypassing data protection and privacy law, lawyer, doctor or journalist confidentiality, or defence privileges. Personal data protection law must therefore be aligned with digital evidence law and Budapest, with clear rules for foreign authorities' retention, use, deletion or return of received data when no longer needed.

The sixth problem is the federal–regional relationship. Article (41) permits a special arrangement for federal states where certain matters fall within constituent units' authority and the federal government cannot legislate binding rules for them. This option should not be automatic. Iraq should preferably achieve national alignment through coordination with the Kurdistan Region, because digital investigations, networks and service providers do not stop at administrative borders. A federal-state reservation should be used only after a detailed constitutional opinion establishes a specific necessity, and in the narrowest scope possible.

Fifth — Proposed policy on reservations, declarations and competent authorities

1. Principle of full accession

The default is accession without reservations reducing obligations. Article (42) exhaustively lists permitted reservations; none may be invented outside it. Greater domestic alignment before deposit reduces the need for exceptions and improves Iraq's ability to request reciprocal cooperation from other states.

2. Preventing executive reservations without legislative approval

The accession law should not authorize government to add broad reservations after the parliamentary vote. The draft therefore requires any reservation or optional declaration reducing Iraq's obligations to appear in an annex to the Law or a subsequent law. Technical details identifying authorities, addresses and communication channels may be updated administratively where substantive obligations remain unchanged.

3. Central authority for legal assistance

Existing Supreme Judicial Council structures, particularly the National Centre for International Judicial Cooperation, should inform designation of the Article (27) central authority, because evidence, search, seizure and execution requests affect judicial procedures and fundamental rights. This is complemented by the Ministry of Foreign Affairs' diplomatic role and coordination with the Ministry of Justice and security bodies under the law. The final text should name the authority only after a joint national decision and workflow testing, avoiding a nominal or overlapping jurisdiction.

4. The 24/7 contact point

The contact point must be an operational unit with real shifts, secure communications, ability to use English in urgent correspondence, and direct authority or immediate access to coordination with the judge or public prosecution and the implementing technical body. It must receive preservation requests at any time, verify the foreign authority's identity, log requests, secure the information custody chain and refer formal assistance requests promptly to the central authority.

5. Authorities competent for extradition

On deposit, designations required by Article (24) for authorities responsible for extradition and provisional arrest requests must be submitted. These must reflect Iraq's existing extradition and judicial cooperation system, rather than create a route bypassing courts or safeguards for the person sought.

6. Additional protocols

This Law covers neither the First Protocol concerning racist and xenophobic acts nor the Second Additional Protocol concerning enhanced cooperation and disclosure of electronic evidence. The Council of Europe Treaty Office confirms that a state party to the original Convention may later join the protocols under their terms without a new Committee of Ministers invitation. Iraq's decision on either protocol must nevertheless be independent and preceded by constitutional and legislative assessment of its implications.[6][8]

Sixth — Text of the draft accession law

Seventh — Reasons for enactment

Eighth — Explanatory memorandum

1. Why does Iraq need to accede?

Digital crime is inherently transborder: an extortion account may originate in one state, the platform be in another, the server in a third and the victim in Iraq. Domestic jurisdiction is insufficient without rapid preservation and cooperation channels. A slow traditional assistance request may arrive after deletion or expiry of the provider's retention period. Budapest therefore adds practical value domestic law alone cannot supply.

Accession also matters for electronic evidence where the offence is not narrowly 'cybercrime'. Digital correspondence, location records, accounts, traffic data and cloud logs now provide evidence in murder, terrorism, corruption, money laundering, trafficking, kidnapping and extortion cases. Urgent preservation and judicial cooperation capacity therefore strengthens the criminal justice system as a whole.

2. Why link accession to domestic legal reform?

The Convention does not replace Iraqi law; it obliges each state to take legislative and other domestic measures. Accession without clear preservation, production, search, seizure and interception rules would create a gap between international obligations and implementing instruments. Filling that gap through broad administrative instructions instead of law would increase risks to rights and admissibility of evidence.

Information technology crime and digital evidence law should therefore progress alongside accession. It must precisely criminalize conduct such as unlawful access, data and system interference and technical fraud, rather than use vague language criminalizing 'offence', 'damage to prestige' or unwelcome expression. It must clearly distinguish unlawful content from merely using the internet as a medium, with judicial safeguards proportionate to each procedure's intrusiveness.

3. Expedited preservation is not mass retention

Expedited preservation of stored data is one of the Convention's most important instruments: a person holding existing data is ordered to prevent deletion or alteration for a specified period while procedures to obtain it are completed. This differs from general, advance retention of all users' data unrelated to a case. Iraq can therefore implement preservation without mass surveillance through orders specifying the target, duration and data.

4. The 24/7 contact point does not replace the courts

The urgent contact point accelerates communication, preservation and technical and legal information; it does not give a security agency independent judicial power. Requests requiring search, seizure, interception or other interference with rights go to the competent authority and judge under Iraqi law. All incoming and outgoing requests must be logged and reviewable, with an electronic record of every step.

5. Article (32) and sovereignty

Article (32) is particularly sensitive because it permits transborder access to stored data without requesting assistance from the other state in two narrow cases: publicly available data, or data lawfully and voluntarily disclosed by a person legally authorized to do so. It must not be expanded into a basis for intruding into foreign servers or accounts or violating another state's sovereignty. This reading also serves Iraq by protecting its systems from similarly expansive interpretations by others.[9]

6. Privacy and freedom of expression

Combating cybercrime need not conflict with constitutional rights when powers are precisely designed. Preserving a specified suspect's account data for a limited period is less intrusive than intercepting content, so authorization conditions should differ. Confidential communications, journalistic sources and professional secrets must be protected, and cybercrime law must not become an alternative route for criminalizing criticism or lawful political activity.

Article (15) provides a basis for this balance through human rights, freedoms and proportionality requirements. Iraq must translate this into enforceable safeguards: reasoned judicial orders specifying data types, accounts or systems and duration; appeal where possible; subsequent notification in appropriate cases; deletion of unnecessary data; and independent audit of interception and real-time data collection.

7. Relationship with the Kurdistan Region

Iraq's federal character requires a practical approach to regional implementation. The aim is not two separate international-cooperation tracks within one state, but shared mechanisms ensuring a unified response to preservation and legal-assistance requests. A federal–regional coordination protocol before deposit is therefore preferable, identifying judicial and technical contact arrangements and involving the Region's competent bodies in training and contact-point testing. A federal-state reservation should be used only if a genuine constitutional conflict remains after coordination options are exhausted.

8. Legal authority of the Arabic text

The Council of Europe provides an Arabic translation for convenience, while making clear that its treaties' official languages are English and French and unofficial translations are not authentic original texts. The Ministry of Foreign Affairs should therefore approve an official Arabic translation for domestic publication while retaining both originals in the legislative and accession files.[7]

Ninth — Implementation matrix before deposit of the accession instrument

Meeting these requirements does not require restructuring the state. Existing institutions should be used and gaps between them closed: the National Centre for International Judicial Cooperation for judicial cooperation, public prosecution and courts for judicial supervision, investigative bodies for execution, technical bodies for digital evidence, and the Ministry of Foreign Affairs for treaty and diplomatic procedures.

Tenth — Financial and institutional impact

Accession itself requires no new federal authority. The real cost is upgrading existing institutions' readiness: 24/7 shifts, secure communications, specialized training, licensed forensic tools, evidence laboratory development, legal translation, and management and tracking of international requests. These expenditures should appear in existing bodies' budgets rather than create a parallel agency.

Public data are insufficient for a reliable total national cost figure. The Law therefore requires relevant bodies to prepare establishment and operating estimates before deposit, covering shift positions, communications and backup equipment, tool licences, continuing training and annual operating costs. Estimates must distinguish resources already available from additional accession-related expenditure.

Eleventh — Relationship to the UN Convention and additional protocols

The UN General Assembly adopted the United Nations Convention against Cybercrime on 24 December 2024. It opened for signature in Hanoi on 25 and 26 October 2025, then at UN Headquarters until 31 December 2026. According to the latest published status available when this document was prepared, it had not yet entered into force, and Iraq did not appear among the participants in the published treaty register as of the end of September 2026.[10]

There is no legal incompatibility in Iraq becoming party to both Budapest and the UN Convention upon meeting each instrument's conditions. After the UN Convention opened for signature, the Council of Europe itself described the frameworks as complementary, with Budapest and its Second Protocol remaining an advanced operational system for obtaining electronic evidence and cross-border cooperation.[16]

Iraq should therefore neither wait for the UN Convention to enter into force before seeking Budapest accession nor treat Budapest as a substitute for participating in the UN framework. A policy of 'multiple compatible frameworks' is preferable: use Budapest's established operational network and participate in the global UN framework, while unifying domestic legislation to avoid conflicting systems of orders and safeguards.

Budapest's Second Additional Protocol provides more advanced instruments for direct cooperation with service providers and registries and in emergencies, but adds requirements for data protection, request verification and competent authorities. Studying it should therefore follow establishment of data protection law, an electronic-evidence system and the 24/7 contact point, rather than be a prerequisite to beginning accession to the original Convention.[8]