Over the past decade, Australia has been a frontrunner in terms of digital transformation; the country ranked 11^th globally on the 2020 Global Connectivity Index and 2^nd in the Indo-Pacific. Australia’s better-than-expected economic performance in 2021 was largely owed to increased government efforts at promoting the digitalisation of businesses and government services, with significant investment being poured into the ICT sector under the Digital Economy Strategy and the Regional Connectivity Program. Meanwhile, however, self-reported losses from cybercrime amounted to more than $33 billion during the 2020-2021 financial year (E), while roughly a quarter of cyber incidents reported during the same period involved Australia’s critical infrastructure or essential services (E). In the cyber diplomacy realm, Australia has traditionally been a prominent member of the ‘like-minded’ group, promoting a vision of a free, open, and secure cyberspace that is very much in line with EU values and efforts.

An EU candidate country since 2012, Serbia is an important partner in the Western Balkans. The 2020 iteration of the Digital Evolution Scorecard characterised Serbia as a ‘break out’ economy, meaning that despite a relative lack of digital infrastructure the country is rapidly digitalising; internet penetration is one of the highest across the region, standing at 79%. Over the past decade, Serbia’s digital policy has been focused on attracting foreign investment, deepening the digital transformation across the public and private sectors, and promoting economic growth in line with EU targets. These objectives have been operationalised through a series of strategies, notably the Strategy for the Development of Information Security for the period 2017-2020 and the Strategy for combat against cyber crime 2019-2023. The ITU notes, however, that “while innovative, internet-based e-commerce is expected to bring significant growth and development, obsolete legislation and a lack of harmonisation with EU standards and best practice persist, hampering progress”. As the country becomes increasingly more digitalised, the challenge for Serbian cyber diplomacy will be to develop and enhance avenues of European, regional, and international cooperation.

An EU candidate country since 2014, Albania has been eagerly embracing its digital revolution with the government ushering in an array of cyber and digital policy initiatives. In recent years, Albania has worked on adapting its legal framework to comply with the EU’s acquis communautaire and further approach the Digital Single Market. The Albanian policy framework ranks 1^st across the Western Balkans region in fostering the inclusivity and competitiveness of digital society [x], while the country currently ranks 80^th in the Global Security Index [x]. An OECD report praised Albania for enhancing intragovernmental cooperation, emphasising the cross-cutting character of ICT in its development strategies, and allocating resources towards the implementation of its digital strategy. Despite the proliferation of such policies, however, the country is currently the 5^th largest source of cybercrime in Europe, suffering at least 1.3 million cyberattacks yearly [x]. As such, modernising cybercrime legislation and upgrading critical infrastructure protection constitute key priorities for Albanian policymakers.

Australia believes that “the foundation for responsible state behaviour in cyberspace is our mutual commitment to existing international law” and that, as per the 2021 report of the Open-Ended Working Group (OEWG), international law is “essential to maintaining peace and stability and promoting an open, secure, […] stable, accessible and peaceful ICT environment.” In particular, Australia has affirmed that the UN Charter applies in its entirety to state actions in cyberspace, including the prohibition on the use of force, the peaceful settlement of disputes, the right to self-defence in response to an armed attack, the law of state responsibility during peacetime, and the doctrine of countermeasures in response to internationally wrongful acts. International legal obligations also include the respect for human rights and fundamental freedoms (especially the right to privacy and freedom of expression), as well as the application of international humanitarian law (IHL) to cyber operations in armed conflict. On the application of IHL, Australia echoes the position taken by the ICRC that “recognition of the application of IHL neither encourages militarisation, nor legitimises resort to conflict in any domain”.

The country has not assumed a firm stance on the application of international law in cyberspace. Serbia’s position paper concerning the Open-Ended Working Group (OEWG) highlighted that multilateral dialogue on “information security” must occur “with strict respect for the Charter of the United Nations”. Echoing the stance of states such as China, Russia, and Cuba, Serbia also raised the alarm about the “danger of developing offensive ICT and militarising the digital space”.

At the first substantive session of the 2021-2025 UN Group of Governmental exports (UNGGE), Albania aligned itself with the EU’s statement that the existing corpus of international law, notably the UN Charter, international humanitarian law, and international human rights law, apply in cyberspace in its entirety. In particular, this includes the principle of state sovereignty, sovereign equality, the settlement of disputes by peaceful means, the provision of the use of force non-intervention in the internal affairs of other states, and the respect for human rights and fundamental freedoms as principles of international law that are applicable to states use of ICTs in cyberspace. [x] Albania has also consistently aligned itself with the EU position in a number of key resolutions at the United Nations, including resolutions A/73/27 and A/74/29. A 2015 policy paper notes that cybersecurity will only be “efficient” if it is “based on the fundamental human rights and freedoms, pursuant to the Charter of Fundamental Rights of the European Union and the universal values of the EU”. In the same vein, the 2020-2025 National Cybersecurity Strategy includes “improving the legal framework providing norms and regulating cybersecurity in the country, and aligning this framework with European Union directives and regulation” as a stated objective.

Australia has been actively involved in both norm-building processes that have been occurring under the auspices of the UN, namely the UN Open-Ended Working Group (GGE) and the OEWG. The country’s 2021 International Cyber and Critical Tech Engagement Strategy notes that the 11 voluntary, non-binding norms on responsible state behaviour agreed under the 2015 UN GGE consensus reports serve to “promote predictability, stability, and security” in cyberspace and should be seen as the “point of departure” for any constructive norm-building discussion. Australian diplomats have consistently reiterated the complementarity between international law and norms of responsible state behaviour, stating that “norms are not a panacea” and that they should not be understood as a standalone “normative framework”, since they do not replace existing state obligations under international law. For this reason, Australia stands against the establishment of binding norms or agreements. The country is not prima facie opposed to discussing other states’ proposals for the development of new norms, but Australia’s own “proactive priority” is reaching agreement of guidance on the implementation of the existing norms. In the current environment, Australia believes that “we will have the biggest impact on international peace and stability if we translate norms ‘on paper’ into norms ‘in practice’”. While not discounting the value of “norms agreed among friends”, it has also highlighted that the framework will only be effective when it is any proposals for new norms would first need to be negotiated, agreed upon, and endorsed by universal consensus.

Serbia was represented in the 2016-2017 UN Group of Governmental Experts (UNGGE). Despite its EU candidate status, Serbia does not typically vote in alignment with the EU on key cybersecurity resolutions presented before the UN First Committee. Notable examples include UNGA resolution 73/27, which first established the Open-Ended Working Group (OEWG), as well as later resolutions 74/29 and 75/240.

At the first substantive session of the 2021-2025 UNGGE, Albania aligned itself with the EU’s position that the previous UNGGE and OEWG reports, including corresponding UNGA resolutions adopted by consensus” form the unequivocal basis for “any further discussions on the position, role, and implementation of the voluntary non-binding norms, rules and principles of state behaviour in cyberspace (norms)” [x]. In 2018, Albania voted against the Russian-sponsored resolution A/73/27, which launched the Open-Ended Working Group (OEWG) format.

In recent years, Australia has emerged as a regional leader in conversations surrounding cyber resilience in the Indo-Pacific as well as globally. The new 2021 International Cyber and Critical Tech Strategy constitutes one of the most comprehensive documents of its kind, with “secure, resilient, and trusted technology” representing a crucial objective. Key initiatives include enhanced protections for critical infrastructure
and systems of national significance, as well as greater support for businesses
and individuals to develop their cybersecurity resilience. In the past three years, Australian cyber diplomats have brokered a series of bilateral partnerships in the form of cyber Memoranda of Understanding (MOUs); currently there are agreements with India (2020), Indonesia (2018), Papua New Guinea (2018), Singapore (2020), and Thailand (2019), all of which include capacity-building and information-sharing elements. On a regional level, the country is chairing the Asia-Pacific CERT community and the Asia-Pacific cybersecurity operations network. Australians have also significantly extended their regional outreach through their flagship capacity-building initiative, the Cyber and Critical Technology Cooperation Program. Meanwhile, Australia participates in several multipartite initiatives with a strong cyber component such as the Structured Quadrilateral Security Dialogue (the eponymous Quad) along with India, Japan, and the US, and the tripartite AUKUS coalition along with the US and the UK. In international fora, Australia has been a vocal champion of increased international collaboration in cyber capacity building (CCB), welcoming references to further cooperation within the 2021 OEWG report but cautioning against limiting such cooperation to the protection of national, translational and supranational infrastructure. Australia has also argued that CCB should be mainstreamed into the larger development agenda of the UN, specifically the Sustainable Development Goals.

Serbia’s legislative framework on cybersecurity is structured upon the 2016 Law on Information Security and its bylaws. The Law ushered in several institutional developments, including the creation of a national CERT in the regulatory agency for electronic communications and postal services (RATEL). The national CERT “monitors the status of incidents on national level, provides early warnings, alerts and announcements, and reacts on incidents by providing the information on affected entities and persons”. [x] It also holds seminars and technical trainings for operators of special importance (critical infrastructure) [x]. 
Meanwhile, the 2021 Cyber Tesla drill (organised in collaboration with the US state of Ohio) constitutes only one example of Serbia’s increased emphasis on critical infrastructure through the prism of cyber defence; the stated objectives included the “construction of military defence system capacities and the National CERT’s capacities for the protection from high-tech attacks, as well as an enhanced cooperation with relevant government and private sector organisations and academic institutions for the purpose of protection of the IT systems”. 
In its UNGGE position paper in 2016, Serbia emphasised the importance of interstate cooperation in “maintaining effective and responsive mechanisms for information exchange, alerts and announcements on cybersecurity incidents”. The paper goes on to posit that “the special focus should be on the protection of critical infrastructure”, especially in the case of transnational attacks. In 2021, Norway donated a platform worth €1.2 million which will “[serve] to hold cyber exercises at the national level enables the real situation of different attack scenarios, and will contribute to capacity building and training of officials in various state institutions”, according to State Secretary of the Ministry of Trade, Tourism and Telecommunications Milos Cvetanovic [x].

In recent years, Albania has significantly expanded its capacity-building activities, modernising both the relevant institutional apparatus and the diplomatic outreach accompanying it. Since 2017, ALCIRT, Albania’s national CSIRT, has been given an expanded mandate and merged with the National Authority for Electronic Certification and Cyber Security (AKCESK). AKCESK is responsible for preparing strategic documents relating to cybersecurity, drafting legislation, collaborating with relevant stakeholders (international organisations, civil society organisations, the private sector) and providing training. [x] Through AKCESK, Albania has signed Memoranda of Understanding (MOU) with several regional national CERTs (Kosovo, North Macedonia, Romania) and is currently negotiating similar MoUs with Serbia, Montenegro, Cyprus, and Slovenia. [x] AKCESK also frequently collaborates with the Council of Europe in relation to incident response and awareness training. [x] As a member of NATO, Albania signed the MoU with the NATO Cyber Incident Response Centre (NCIRC) on enhancing cyber defence in 2013 [x] and has participated in numerous NATO-led training initiatives, including the flagship Cyber Coalition exercise. Meanwhile, increased emphasis has been placed on the protection of critical infrastructure, with a 2015 government paper stating that future actions will be focused on “the protection and resilience capacity of critical infrastructure” and on “encouraging operators that own them to implement a full security architecture (including risk management and emergencies)”. [x] In 2020, Albania adopted its first-ever cybersecurity regulation for the electricity sector, which establishes incident reporting and assessment criteria for electricity operators. [x] This was reportedly only the first of many planned initiatives intended to reduce the country’s cyber vulnerabilities and increase trust in digital services.

The 2021 International Cyber and Critical Tech Engagement Strategy recognises that Australia, and the Indo-Pacific region more widely, faces a “worsening” cybercrime landscape characterized by “expanding threats, low barriers to entry, and increasingly resourceful actors”. Australia acceded to the Council of Europe’s Budapest Convention in 2013 and has since been vocal about the Convention’s status as the “most comprehensive and effective basis upon which to pursue a common international approach”. The country voted against the Russia-sponsored UN resolution on the establishment of a new cybercrime treaty; however, upon the passage of the resolution and the subsequent creation of a dedicated Ad Hoc Committee, Australia has been active in advocating for a “transparent, inclusive, and consensus-based process with multi-stakeholder participation”. More specifically, it has stated that the new Convention should “draw heavily” from existing international instruments such as the UN Convention against Transnational Organized Crime (UNTOC), the UN Convention against Corruption (UNCAC), and especially the Budapest Convention, so as to avoid undermining these regimes and ensure the protection of human rights. Australia has additionally placed great emphasis on the need for international cooperation, with the 2021 Strategy noting that “information sharing, discussion and capacity building are vital to any meaningful response to the threat posed by cybercrime”. The country has launched numerous regional cooperation and capacity-building initiatives, partnering with Pacific Island countries (Tonga, Fiji, Samoa, Vanuatu, Solomon Islands, Niue, Tuvalu) to advance cybercrime law reform and ensure alignment with Budapest provisions.

The Information Society and Information Security Development Strategy for the period 2021-2026 provides a comprehensive approach to the field of information security, which includes both (a) information security of ICT systems of special importance and security of the Republic of Serbia, and (b) security of citizens and businesses, which is particularly reflected through the fight against cybercrime. Its predecessor, the 2017 Strategy for the Development of Information Security, in turn, indicates the fight against cybercrime as one of the government’s five key priorities. 
In light of EU accession negotiations, Serbia has signed and ratified the Council of Europe Convention on Cybercrime (Budapest Convention), including its Additional Protocol on Xenophobia and Racism Committed Through Computer Systems. Nevertheless, the country also voted in favour of UNGA resolution 74/247 calling for an international legal instrument to govern this domain. Domestically, the national legislative framework has been developed in accordance with the Budapest Convention and EU legislation. A High-Tech Crime Unit has recently been established within the special prosecutor’s office, along with three specialised units: crime analysis; terrorism and extremism; and drug prevention, addiction and repression. 
Serbia is a member of Interpol, with which the country has discussed ways to enhance cooperation with regard to combatting cybercrime. Serbia is also gradually developing its own bilateral cooperation network, signing a Cooperation Memoranda with India in 2016 [x] and Romania in 2017 [x] as well as receiving assistance from Russian experts [x].

Special thanks to Ms Maja Lakusic for her valuable comments.

Albania is a party to the Budapest Convention on Cybercrime, with the Albanian Parliament ratifying the Convention in 2002 [x]. Since then, however, national strategic documents have been acknowledging the incomplete harmonisation of national legislation with Budapest provisions. The most recent five-year National Cybersecurity Strategy states that “legislation in the cybersecurity field should be harmonised with EU legislation, thus creating a complete and codified mechanism to adequately address and resolve issues. Besides, where possible, international internet security mechanisms should be accessed, signed, ratified, and implemented”. The Strategy also places special emphasis on children’s online protection, elevating it into a key priority [x]. Aiming to implement the policy goals listed within the National Cybersecurity Strategy, the Strategy for Investigation of Cybercrime (2021-2025) lays out a number of objectives for law enforcement [x]: (1) extending the cybercrime investigation structure throughout the country and building technological and legal capacity; (2) presenting a prompt and efficient response to cybercrime, raising public awareness, taking legislative initiatives, and building professional capacity; (3) presenting a rapid and professional response to the prevention, prosecution, and investigation of cybercrime against children; and (4) increasing national and international cooperation in the field of cybercrime investigation with strategic partners. Albanian police forces have also collaborated with Europol in coordinated action against cyber fraud and through the launch of the Sell Safe awareness campaign. [x]