Compare
Compare
Thanks to its regulatory powers, robust digital economy, and active foreign and security policy, the European Union is one of the key players in cyberspace. The EU strongly promotes the position that international law, and in particular the United Nations (UN) Charter, applies in cyberspace. As a complement to binding international law, the EU endorses the voluntary non-binding norms, rules and principles of responsible State behaviour that have been articulated by the UN Group of Governmental Experts. It also encourages the development and implementation of regional confidence building measures, both in the Organisation for Security and Co-operation in Europe and other regions. On a bilateral level, the EU has established cyber dialogues with strategic partners to reinforce the exchange of good practices, lessons learnt and further the idea of responsible state behaviour in cyberspace.
Over the past decade, Australia has been a frontrunner in terms of digital transformation; the country ranked 11th globally on the 2020 Global Connectivity Index and 2nd in the Indo-Pacific. Australia’s better-than-expected economic performance in 2021 was largely owed to increased government efforts at promoting the digitalisation of businesses and government services, with significant investment being poured into the ICT sector under the Digital Economy Strategy and the Regional Connectivity Program. Meanwhile, however, self-reported losses from cybercrime amounted to more than $33 billion during the 2020-2021 financial year (E), while roughly a quarter of cyber incidents reported during the same period involved Australia’s critical infrastructure or essential services (E). In the cyber diplomacy realm, Australia has traditionally been a prominent member of the ‘like-minded’ group, promoting a vision of a free, open, and secure cyberspace that is very much in line with EU values and efforts.
India and the European Union share many values and principles, such as inclusiveness, democracy, and multilateralism. With 1.4 billion people, India is the largest democracy in the world and considers itself as a leader among the Global South. India and the EU share common visions of a rules-based global order and are aligned on their commitment to an open, free, secure, stable, peaceful, and accessible cyberspace, enabling economic growth and innovation. In light of India’s rapid digitization and connectivity, the EU-India Strategic Partnership & Roadmap to 2025 includes commitments to cooperate on new and emerging technologies, norms and regulatory frameworks, and international standards.
Under the auspices of the UN, the EU and its Member States have consistently reaffirmed that a universal cyber security framework can only be grounded in existing international law, including the Charter of the United Nations in its entirety, international humanitarian law, and international human rights law.
Addressing issues as to how existing international law and international humanitarian law, including the principles of humanity, necessity, proportionality and distinction, apply to the use ICTs by States is necessary to increase accountability and transparency. International humanitarian law is fully applicable in cyberspace and this should not be misunderstood as legitimising the use of force between states in the cyber domain. The EU has typically opposed calls for the need to adapt existing international law as a means to develop a new legal instrument for cyber issues. Australia believes that “the foundation for responsible state behaviour in cyberspace is our mutual commitment to existing international law” and that, as per the 2021 report of the Open-Ended Working Group (OEWG), international law is “essential to maintaining peace and stability and promoting an open, secure, […] stable, accessible and peaceful ICT environment.” In particular, Australia has affirmed that the UN Charter applies in its entirety to state actions in cyberspace, including the prohibition on the use of force, the peaceful settlement of disputes, the right to self-defence in response to an armed attack, the law of state responsibility during peacetime, and the doctrine of countermeasures in response to internationally wrongful acts. International legal obligations also include the respect for human rights and fundamental freedoms (especially the right to privacy and freedom of expression), as well as the application of international humanitarian law (IHL) to cyber operations in armed conflict. On the application of IHL, Australia echoes the position taken by the ICRC that “recognition of the application of IHL neither encourages militarisation, nor legitimises resort to conflict in any domain”. As a member of the 2015 UNGGE group, India accepts that international law and specifically the UN Charter applies in its entirety in the cyber domain. India has noted the need to develop common understandings as to how international law should be interpreted, especially on the issues of what constitutes force and/or an armed attack in cyberspace and what the threshold of cyber-attacks should be to invoke Article 51 of the UN Charter.
In statements at the UN General Assembly, India has also specifically called for further elaboration on peacetime rules of international law, the law concerning the right of self-defence and international humanitarian law.
Apart from these calls for clarification and elaboration, however, India’s stance on specific aspects of international law and their interpretation remains unclear. This seems consistent with India’s recent reorientation of its foreign policy; since 2019, India’s wider approach has been marked by a shift from traditional non-alignment to issue-based ‘multi-alignment’ that reflects national priorities and interests.
Addressing issues as to how existing international law and international humanitarian law, including the principles of humanity, necessity, proportionality and distinction, apply to the use ICTs by States is necessary to increase accountability and transparency. International humanitarian law is fully applicable in cyberspace and this should not be misunderstood as legitimising the use of force between states in the cyber domain. The EU has typically opposed calls for the need to adapt existing international law as a means to develop a new legal instrument for cyber issues. Australia believes that “the foundation for responsible state behaviour in cyberspace is our mutual commitment to existing international law” and that, as per the 2021 report of the Open-Ended Working Group (OEWG), international law is “essential to maintaining peace and stability and promoting an open, secure, […] stable, accessible and peaceful ICT environment.” In particular, Australia has affirmed that the UN Charter applies in its entirety to state actions in cyberspace, including the prohibition on the use of force, the peaceful settlement of disputes, the right to self-defence in response to an armed attack, the law of state responsibility during peacetime, and the doctrine of countermeasures in response to internationally wrongful acts. International legal obligations also include the respect for human rights and fundamental freedoms (especially the right to privacy and freedom of expression), as well as the application of international humanitarian law (IHL) to cyber operations in armed conflict. On the application of IHL, Australia echoes the position taken by the ICRC that “recognition of the application of IHL neither encourages militarisation, nor legitimises resort to conflict in any domain”. As a member of the 2015 UNGGE group, India accepts that international law and specifically the UN Charter applies in its entirety in the cyber domain. India has noted the need to develop common understandings as to how international law should be interpreted, especially on the issues of what constitutes force and/or an armed attack in cyberspace and what the threshold of cyber-attacks should be to invoke Article 51 of the UN Charter.
In statements at the UN General Assembly, India has also specifically called for further elaboration on peacetime rules of international law, the law concerning the right of self-defence and international humanitarian law.
Apart from these calls for clarification and elaboration, however, India’s stance on specific aspects of international law and their interpretation remains unclear. This seems consistent with India’s recent reorientation of its foreign policy; since 2019, India’s wider approach has been marked by a shift from traditional non-alignment to issue-based ‘multi-alignment’ that reflects national priorities and interests.
Since 2014, the EU’s ambition has been to act as an ‘honest broker’ on multilateral discussions surrounding issues of cyber governance and norms of responsible state behaviour, aiming to ensure the support and partnership of proactive players in the context of the global debate. The EU has long promoted the need for voluntary, non-binding norms. It believes that norms crystallised under the UN GGE process should generally not be revisited and that progress should be made on matters relating to their implementation.
Within the OEWG, the EU advanced a suggestion to develop a global repository of existing practice within the United Nations, which would enable UN member states to showcase how they are implementing the voluntary norms of responsible state behaviour, confidence building and other measures. Australia has been actively involved in both norm-building processes that have been occurring under the auspices of the UN, namely the UN Open-Ended Working Group (GGE) and the OEWG. The country’s 2021 International Cyber and Critical Tech Engagement Strategy notes that the 11 voluntary, non-binding norms on responsible state behaviour agreed under the 2015 UN GGE consensus reports serve to “promote predictability, stability, and security” in cyberspace and should be seen as the “point of departure” for any constructive norm-building discussion. Australian diplomats have consistently reiterated the complementarity between international law and norms of responsible state behaviour, stating that “norms are not a panacea” and that they should not be understood as a standalone “normative framework”, since they do not replace existing state obligations under international law. For this reason, Australia stands against the establishment of binding norms or agreements. The country is not prima facie opposed to discussing other states’ proposals for the development of new norms, but Australia’s own “proactive priority” is reaching agreement of guidance on the implementation of the existing norms. In the current environment, Australia believes that “we will have the biggest impact on international peace and stability if we translate norms ‘on paper’ into norms ‘in practice’”. While not discounting the value of “norms agreed among friends”, it has also highlighted that the framework will only be effective when it is any proposals for new norms would first need to be negotiated, agreed upon, and endorsed by universal consensus. India has assumed a stance of strategic ambiguity on the proliferation of norms for responsible state behaviour in cyberspace, positioning itself as a ‘bridge builder’ between the two camps that have emerged during multilateral cyber norm negotiations.
Its insistence on an enhanced role for intergovernmental institutions (such as the ITU) and its oscillating allegiance to the two polarised factions largely reflect the country’s long-standing focus on Westphalian sovereignty and the consequent belief in the primacy of the state as an actor in international affairs. This brings India to a certain degree of alignment with sovereignty-focused countries like China and Russia in the context of norm-building debates.
At the second substantive session of the Open-Ended Working Group (OEWG), India argued that voluntary norms do not necessarily increase the predictability of state behaviour within the ICT environment, but was not openly against the adoption of new voluntary norms; for instance, the country proposed the adoption of a new norm on refraining from weaponisation and offensive uses of ICTs along with countries like Iran, Cuba, and Nigeria.
Within the OEWG, the EU advanced a suggestion to develop a global repository of existing practice within the United Nations, which would enable UN member states to showcase how they are implementing the voluntary norms of responsible state behaviour, confidence building and other measures. Australia has been actively involved in both norm-building processes that have been occurring under the auspices of the UN, namely the UN Open-Ended Working Group (GGE) and the OEWG. The country’s 2021 International Cyber and Critical Tech Engagement Strategy notes that the 11 voluntary, non-binding norms on responsible state behaviour agreed under the 2015 UN GGE consensus reports serve to “promote predictability, stability, and security” in cyberspace and should be seen as the “point of departure” for any constructive norm-building discussion. Australian diplomats have consistently reiterated the complementarity between international law and norms of responsible state behaviour, stating that “norms are not a panacea” and that they should not be understood as a standalone “normative framework”, since they do not replace existing state obligations under international law. For this reason, Australia stands against the establishment of binding norms or agreements. The country is not prima facie opposed to discussing other states’ proposals for the development of new norms, but Australia’s own “proactive priority” is reaching agreement of guidance on the implementation of the existing norms. In the current environment, Australia believes that “we will have the biggest impact on international peace and stability if we translate norms ‘on paper’ into norms ‘in practice’”. While not discounting the value of “norms agreed among friends”, it has also highlighted that the framework will only be effective when it is any proposals for new norms would first need to be negotiated, agreed upon, and endorsed by universal consensus. India has assumed a stance of strategic ambiguity on the proliferation of norms for responsible state behaviour in cyberspace, positioning itself as a ‘bridge builder’ between the two camps that have emerged during multilateral cyber norm negotiations.
Its insistence on an enhanced role for intergovernmental institutions (such as the ITU) and its oscillating allegiance to the two polarised factions largely reflect the country’s long-standing focus on Westphalian sovereignty and the consequent belief in the primacy of the state as an actor in international affairs. This brings India to a certain degree of alignment with sovereignty-focused countries like China and Russia in the context of norm-building debates.
At the second substantive session of the Open-Ended Working Group (OEWG), India argued that voluntary norms do not necessarily increase the predictability of state behaviour within the ICT environment, but was not openly against the adoption of new voluntary norms; for instance, the country proposed the adoption of a new norm on refraining from weaponisation and offensive uses of ICTs along with countries like Iran, Cuba, and Nigeria.
The EU places great importance on cyber resilience and capacity building. Internally, the Union has built a robust legal acquis in relation to the resilience of critical infrastructures, the cornerstone of which rests upon the 2016 Network and Information Security (NIS) Directive and the 2013 and 2019 Cybersecurity Acts. This legal meshwork seeks to integrate cybersecurity into all elements of the supply chain and introduce soft law mechanisms like the EU cybersecurity certification scheme. In doing so, it harmonises national cybersecurity capabilities, cross-border collaboration and the supervision of critical sectors across the EU.
In the coming months, the Commission intends to add upon the existing cyber-acquis by introducing an array of new initiatives, such as the updated NIS Directive (the so-called NIS2), a proposal on a Critical Entities Resilience (CER) Directive, and a plan to launch a network of Security Operations Centres across the Union. The aim is to create a Union-wide ‘cybersecurity shield’ that will facilitate the detection of cyberattacks and provide an impetus for proactive action.
This internal buildup of capabilities is supplemented by the development of a specialised ‘cyber diplomacy toolbox’ that allows the Union and its Member States to address cyber incidents through various joint policies, from cooperation and stabilisation measures to restrictive measures and attribution. In recent years, Australia has emerged as a regional leader in conversations surrounding cyber resilience in the Indo-Pacific as well as globally. The new 2021 International Cyber and Critical Tech Strategy constitutes one of the most comprehensive documents of its kind, with “secure, resilient, and trusted technology” representing a crucial objective. Key initiatives include enhanced protections for critical infrastructure and systems of national significance, as well as greater support for businesses and individuals to develop their cybersecurity resilience. In the past three years, Australian cyber diplomats have brokered a series of bilateral partnerships in the form of cyber Memoranda of Understanding (MOUs); currently there are agreements with India (2020), Indonesia (2018), Papua New Guinea (2018), Singapore (2020), and Thailand (2019), all of which include capacity-building and information-sharing elements. On a regional level, the country is chairing the Asia-Pacific CERT community and the Asia-Pacific cybersecurity operations network. Australians have also significantly extended their regional outreach through their flagship capacity-building initiative, the Cyber and Critical Technology Cooperation Program. Meanwhile, Australia participates in several multipartite initiatives with a strong cyber component such as the Structured Quadrilateral Security Dialogue (the eponymous Quad) along with India, Japan, and the US, and the tripartite AUKUS coalition along with the US and the UK. In international fora, Australia has been a vocal champion of increased international collaboration in cyber capacity building (CCB), welcoming references to further cooperation within the 2021 OEWG report but cautioning against limiting such cooperation to the protection of national, translational and supranational infrastructure. Australia has also argued that CCB should be mainstreamed into the larger development agenda of the UN, specifically the Sustainable Development Goals. In matters related to cyber resilience, India has proven to be an active proponent of bilateralism. It has initiated cyber dialogues with actors like the US, the UK, Russia, Malaysia, the EU, and ASEAN, all of which include capacity-building elements. Internationally, the country has also been especially vocal on the need to establish cooperative mechanisms for developing and implementing bilateral, regional, and global confidence-building measures (CBMs).
In the context of multilateral fora, India has many a time reiterated that the issue of supply chain protection enjoys particular significance for them, especially in relation to ‘trust and trusted sources’ when it comes to preferring suppliers of ICT products and systems. It has also noted that capacity building actually goes beyond what is being dealt with under international security and is inherently tied to discussions on international legal instruments on cyberspace, where all states are equal and have the capacity to discuss legitimate matters under the auspices of the UN.
In the coming months, the Commission intends to add upon the existing cyber-acquis by introducing an array of new initiatives, such as the updated NIS Directive (the so-called NIS2), a proposal on a Critical Entities Resilience (CER) Directive, and a plan to launch a network of Security Operations Centres across the Union. The aim is to create a Union-wide ‘cybersecurity shield’ that will facilitate the detection of cyberattacks and provide an impetus for proactive action.
This internal buildup of capabilities is supplemented by the development of a specialised ‘cyber diplomacy toolbox’ that allows the Union and its Member States to address cyber incidents through various joint policies, from cooperation and stabilisation measures to restrictive measures and attribution. In recent years, Australia has emerged as a regional leader in conversations surrounding cyber resilience in the Indo-Pacific as well as globally. The new 2021 International Cyber and Critical Tech Strategy constitutes one of the most comprehensive documents of its kind, with “secure, resilient, and trusted technology” representing a crucial objective. Key initiatives include enhanced protections for critical infrastructure and systems of national significance, as well as greater support for businesses and individuals to develop their cybersecurity resilience. In the past three years, Australian cyber diplomats have brokered a series of bilateral partnerships in the form of cyber Memoranda of Understanding (MOUs); currently there are agreements with India (2020), Indonesia (2018), Papua New Guinea (2018), Singapore (2020), and Thailand (2019), all of which include capacity-building and information-sharing elements. On a regional level, the country is chairing the Asia-Pacific CERT community and the Asia-Pacific cybersecurity operations network. Australians have also significantly extended their regional outreach through their flagship capacity-building initiative, the Cyber and Critical Technology Cooperation Program. Meanwhile, Australia participates in several multipartite initiatives with a strong cyber component such as the Structured Quadrilateral Security Dialogue (the eponymous Quad) along with India, Japan, and the US, and the tripartite AUKUS coalition along with the US and the UK. In international fora, Australia has been a vocal champion of increased international collaboration in cyber capacity building (CCB), welcoming references to further cooperation within the 2021 OEWG report but cautioning against limiting such cooperation to the protection of national, translational and supranational infrastructure. Australia has also argued that CCB should be mainstreamed into the larger development agenda of the UN, specifically the Sustainable Development Goals. In matters related to cyber resilience, India has proven to be an active proponent of bilateralism. It has initiated cyber dialogues with actors like the US, the UK, Russia, Malaysia, the EU, and ASEAN, all of which include capacity-building elements. Internationally, the country has also been especially vocal on the need to establish cooperative mechanisms for developing and implementing bilateral, regional, and global confidence-building measures (CBMs).
In the context of multilateral fora, India has many a time reiterated that the issue of supply chain protection enjoys particular significance for them, especially in relation to ‘trust and trusted sources’ when it comes to preferring suppliers of ICT products and systems. It has also noted that capacity building actually goes beyond what is being dealt with under international security and is inherently tied to discussions on international legal instruments on cyberspace, where all states are equal and have the capacity to discuss legitimate matters under the auspices of the UN.
The EU has been an early champion of the Budapest Convention signed under the auspices of the Council of Europe, given the overlapping membership of the two organisations. Much of the EU’s cyber diplomatic efforts have focused on promoting the Convention as the main instrument of choice for fighting cybercrime on a global level. EU member states have consistently opposed Russian bids for replacing this regime with another legal framework.
The Union is represented in the recently constituted Ad Hoc Committee established by UNGA resolution 74/247 by its Member States and is currently focused on ensuring that the process is inclusive, transparent, consistent with the progress of the UNGGE and OEWG processes, and committed to legal consistency. The 2021 International Cyber and Critical Tech Engagement Strategy recognises that Australia, and the Indo-Pacific region more widely, faces a “worsening” cybercrime landscape characterized by “expanding threats, low barriers to entry, and increasingly resourceful actors”. Australia acceded to the Council of Europe’s Budapest Convention in 2013 and has since been vocal about the Convention’s status as the “most comprehensive and effective basis upon which to pursue a common international approach”. The country voted against the Russia-sponsored UN resolution on the establishment of a new cybercrime treaty; however, upon the passage of the resolution and the subsequent creation of a dedicated Ad Hoc Committee, Australia has been active in advocating for a “transparent, inclusive, and consensus-based process with multi-stakeholder participation”. More specifically, it has stated that the new Convention should “draw heavily” from existing international instruments such as the UN Convention against Transnational Organized Crime (UNTOC), the UN Convention against Corruption (UNCAC), and especially the Budapest Convention, so as to avoid undermining these regimes and ensure the protection of human rights. Australia has additionally placed great emphasis on the need for international cooperation, with the 2021 Strategy noting that “information sharing, discussion and capacity building are vital to any meaningful response to the threat posed by cybercrime”. The country has launched numerous regional cooperation and capacity-building initiatives, partnering with Pacific Island countries (Tonga, Fiji, Samoa, Vanuatu, Solomon Islands, Niue, Tuvalu) to advance cybercrime law reform and ensure alignment with Budapest provisions. Under the auspices of the OEWG, India has highlighted the need for “real-time cooperation between government agencies” in combatting cybercrime, cyberterrorism, and cyber threats more widely. To date, however, India has not signed any international cybercrime agreement. It voted in favour of a Russia-sponsored UNGA Resolution calling for the establishment of a separate cybercrime treaty.
Despite having brought its legal framework largely in alignment with the Budapest Convention, India remains a non-party because the document was drafted without the country’s participation, thus rending the treaty discriminatory. Another big objection has been raised on the basis of section 32.b, which gives intelligence agencies trans-border access to data for the purposes of criminal investigations with lawful and voluntary consent - a concern shared by Russia.
It has also been argued that the Mutual Legal Assistance (MLA) regime under Budapest is not effective, as it does not commit states to a firm promise of cooperation; from the perspective of the Indians, it would be preferable to replace this regime with a UN-driven process.
The Union is represented in the recently constituted Ad Hoc Committee established by UNGA resolution 74/247 by its Member States and is currently focused on ensuring that the process is inclusive, transparent, consistent with the progress of the UNGGE and OEWG processes, and committed to legal consistency. The 2021 International Cyber and Critical Tech Engagement Strategy recognises that Australia, and the Indo-Pacific region more widely, faces a “worsening” cybercrime landscape characterized by “expanding threats, low barriers to entry, and increasingly resourceful actors”. Australia acceded to the Council of Europe’s Budapest Convention in 2013 and has since been vocal about the Convention’s status as the “most comprehensive and effective basis upon which to pursue a common international approach”. The country voted against the Russia-sponsored UN resolution on the establishment of a new cybercrime treaty; however, upon the passage of the resolution and the subsequent creation of a dedicated Ad Hoc Committee, Australia has been active in advocating for a “transparent, inclusive, and consensus-based process with multi-stakeholder participation”. More specifically, it has stated that the new Convention should “draw heavily” from existing international instruments such as the UN Convention against Transnational Organized Crime (UNTOC), the UN Convention against Corruption (UNCAC), and especially the Budapest Convention, so as to avoid undermining these regimes and ensure the protection of human rights. Australia has additionally placed great emphasis on the need for international cooperation, with the 2021 Strategy noting that “information sharing, discussion and capacity building are vital to any meaningful response to the threat posed by cybercrime”. The country has launched numerous regional cooperation and capacity-building initiatives, partnering with Pacific Island countries (Tonga, Fiji, Samoa, Vanuatu, Solomon Islands, Niue, Tuvalu) to advance cybercrime law reform and ensure alignment with Budapest provisions. Under the auspices of the OEWG, India has highlighted the need for “real-time cooperation between government agencies” in combatting cybercrime, cyberterrorism, and cyber threats more widely. To date, however, India has not signed any international cybercrime agreement. It voted in favour of a Russia-sponsored UNGA Resolution calling for the establishment of a separate cybercrime treaty.
Despite having brought its legal framework largely in alignment with the Budapest Convention, India remains a non-party because the document was drafted without the country’s participation, thus rending the treaty discriminatory. Another big objection has been raised on the basis of section 32.b, which gives intelligence agencies trans-border access to data for the purposes of criminal investigations with lawful and voluntary consent - a concern shared by Russia.
It has also been argued that the Mutual Legal Assistance (MLA) regime under Budapest is not effective, as it does not commit states to a firm promise of cooperation; from the perspective of the Indians, it would be preferable to replace this regime with a UN-driven process.
