Faced with spiking computer crime, the United Nations adopted a global cybercrime convention in December 2024. This watershed moment was the result of rushed, combative negotiations that involved a wide range of stakeholders. Occupied with contentious fights over overbroad substantive provisions, negotiating states paid little attention to the jurisdictional provisions of the convention.
Yet a provision granting states jurisdiction over crimes committed anywhere in the world against their nationals, known as passive personality jurisdiction, represents a major expansion of jurisdiction under international and domestic law. Adoption of this type of jurisdiction in the treaty consummates a rise that has taken it from spurned to ubiquitous in a few short decades.
Passive personality jurisdiction threatens sovereignty, due process, and human rights. It remains both ill-advised and unnecessary. Other jurisdictional bases better address the jurisdictional challenges posed by cybercrime. But if passive personality jurisdiction is here to stay, states can take steps to mitigate its harm: from limiting it to violent, universal offenses to taking unilateral measures that impose costs on abusive passive personality prosecutions.
