Compare
Compare
India and the European Union share many values and principles, such as inclusiveness, democracy, and multilateralism. With 1.4 billion people, India is the largest democracy in the world and considers itself as a leader among the Global South. India and the EU share common visions of a rules-based global order and are aligned on their commitment to an open, free, secure, stable, peaceful, and accessible cyberspace, enabling economic growth and innovation. In light of India’s rapid digitization and connectivity, the EU-India Strategic Partnership & Roadmap to 2025 includes commitments to cooperate on new and emerging technologies, norms and regulatory frameworks, and international standards.
In recent years, Bosnia and Herzegovina has seen a consistent increase in the rate of Internet absorption along with a continuous extension of broadband access across urban and rural areas. As a potential EU candidate country, Bosnia has recently developed a burgeoning drive to advance the country’s digital and cyber capabilities in line with those of the European Union; ‘smart growth’ is notably included as one of the national priorities under the 2015 Strategic Framework. That said, the institutional, regulatory, and operational framework that would enable the realisation of this ambition is still nascent and the progress in many policy areas is undermined by the complexity of the distribution of powers between the central government and two entities: the Federation of Bosnia and Herzegovina and the Republika Srpska. In 2017, Bosnia formally adopted the Policy of Electronic Communications of Bosnia and Herzegovina 2017-2021, which is largely aligned with the Digital Agenda of Europe [x]. This vision of a Bosnian digital society is a key milestone for the country’s emerging cyber diplomatic apparatus as it clearly identifies the foundational pillars of the country’s ICT ecosystem, which in turn will assist in bringing it into closer alignment with European cyber priorities.
As of 2020, 86 % of Uruguayans are active internet users, second in South America, only behind Chile. 9 out of 10 individuals in Uruguay are social media users. This provides a fabric for efficient digital policies and strategies that have transformed Uruguay since the 2010s. Uruguay is ranked first in Latin America and 35th place in the world on Digital Government Development, according to the UNDESA index, which measures dimensions related to technological infrastructure, availability of online services, and ability of citizens to take advantage of those resources. Uruguay also ranks first in Latin America and 42nd in the world on ICT Development, according to the 2017 IDI, published by the International Telecommunications Union. In all, this South American country has positioned itself at the forefront as a regional and world benchmark in Digital Government.
As a member of the 2015 UNGGE group, India accepts that international law and specifically the UN Charter applies in its entirety in the cyber domain. India has noted the need to develop common understandings as to how international law should be interpreted, especially on the issues of what constitutes force and/or an armed attack in cyberspace and what the threshold of cyber-attacks should be to invoke Article 51 of the UN Charter.
In statements at the UN General Assembly, India has also specifically called for further elaboration on peacetime rules of international law, the law concerning the right of self-defence and international humanitarian law.
Apart from these calls for clarification and elaboration, however, India’s stance on specific aspects of international law and their interpretation remains unclear. This seems consistent with India’s recent reorientation of its foreign policy; since 2019, India’s wider approach has been marked by a shift from traditional non-alignment to issue-based ‘multi-alignment’ that reflects national priorities and interests. At the first substantive session of the 2021-2025 UNGGE, recalling its status as a potential candidate of the EU, Bosnia and Herzegovina aligned itself with the EU’s statement that the existing corpus of international law, notably the UN Charter, international humanitarian law, and international human rights law, apply in cyberspace in its entirety. In particular, this includes the principle of state sovereignty, sovereign equality, the settlement of disputes by peaceful means, the provision of the use of force non-intervention in the internal affairs of other states, and the respect for human rights and fundamental freedoms as principles of international law that are applicable to states use of ICTs in cyberspace. [x] Nevertheless, it has consistently refrained from aligning itself with the EU position in a number of key resolutions at the United Nations, including resolutions A/73/27 and A/74/29. As a member state of the UNGA, Uruguay expressed their views at the OEWG in 2021, considering cybersecurity an essential element in the prevention of international conflicts. Uruguay provides a rather humanitarian approach to international law and its application on cyber issues. The country is a member of international organisations that promote the development and compliance with standards of transparency and access to information, such as the Open Government Partnership, the Electronic Government Network of Latin America and the Caribbean (GEALC) and Digital Nations.
Uruguay was the first Latin American country, in 2013, to sign the only existing binding, international document concerning the Automatic Processing of Personal Data (known as Convention 108). Its signature and membership have been ratified in 2021.
Uruguay’s Digital initiatives at the national level are also in compliance with the Digital Agenda for Latin America and the Caribbean (eLAC by CEPAL). In particular, Uruguay’s Cybersecurity goal is in line with CEPAL’s framework for confidence-building measures such as combating digital crime by formulating public policies and strategies for cybersecurity and critical infrastructure protection.
In statements at the UN General Assembly, India has also specifically called for further elaboration on peacetime rules of international law, the law concerning the right of self-defence and international humanitarian law.
Apart from these calls for clarification and elaboration, however, India’s stance on specific aspects of international law and their interpretation remains unclear. This seems consistent with India’s recent reorientation of its foreign policy; since 2019, India’s wider approach has been marked by a shift from traditional non-alignment to issue-based ‘multi-alignment’ that reflects national priorities and interests. At the first substantive session of the 2021-2025 UNGGE, recalling its status as a potential candidate of the EU, Bosnia and Herzegovina aligned itself with the EU’s statement that the existing corpus of international law, notably the UN Charter, international humanitarian law, and international human rights law, apply in cyberspace in its entirety. In particular, this includes the principle of state sovereignty, sovereign equality, the settlement of disputes by peaceful means, the provision of the use of force non-intervention in the internal affairs of other states, and the respect for human rights and fundamental freedoms as principles of international law that are applicable to states use of ICTs in cyberspace. [x] Nevertheless, it has consistently refrained from aligning itself with the EU position in a number of key resolutions at the United Nations, including resolutions A/73/27 and A/74/29. As a member state of the UNGA, Uruguay expressed their views at the OEWG in 2021, considering cybersecurity an essential element in the prevention of international conflicts. Uruguay provides a rather humanitarian approach to international law and its application on cyber issues. The country is a member of international organisations that promote the development and compliance with standards of transparency and access to information, such as the Open Government Partnership, the Electronic Government Network of Latin America and the Caribbean (GEALC) and Digital Nations.
Uruguay was the first Latin American country, in 2013, to sign the only existing binding, international document concerning the Automatic Processing of Personal Data (known as Convention 108). Its signature and membership have been ratified in 2021.
Uruguay’s Digital initiatives at the national level are also in compliance with the Digital Agenda for Latin America and the Caribbean (eLAC by CEPAL). In particular, Uruguay’s Cybersecurity goal is in line with CEPAL’s framework for confidence-building measures such as combating digital crime by formulating public policies and strategies for cybersecurity and critical infrastructure protection.
India has assumed a stance of strategic ambiguity on the proliferation of norms for responsible state behaviour in cyberspace, positioning itself as a ‘bridge builder’ between the two camps that have emerged during multilateral cyber norm negotiations.
Its insistence on an enhanced role for intergovernmental institutions (such as the ITU) and its oscillating allegiance to the two polarised factions largely reflect the country’s long-standing focus on Westphalian sovereignty and the consequent belief in the primacy of the state as an actor in international affairs. This brings India to a certain degree of alignment with sovereignty-focused countries like China and Russia in the context of norm-building debates.
At the second substantive session of the Open-Ended Working Group (OEWG), India argued that voluntary norms do not necessarily increase the predictability of state behaviour within the ICT environment, but was not openly against the adoption of new voluntary norms; for instance, the country proposed the adoption of a new norm on refraining from weaponisation and offensive uses of ICTs along with countries like Iran, Cuba, and Nigeria. At the first substantive session of the 2021-2025 UNGGE, Bosnia and Herzegovina aligned itself with the EU’s position that the previous UNGGE and OEWG reports, including corresponding UNGA resolutions adopted by consensus, form the unequivocal basis for “any further discussions on the position, role, and implementation of the voluntary non-binding norms, rules and principles of state behaviour in cyberspace (norms)” [x]. In 2018, however, it voted in favour of Russian-sponsored resolution A/73/27, which launched the Open-Ended Working Group (OEWG) format. Uruguay is a represented member in the Group of Governmental Experts (GGE) on Advancing responsible State behaviour in cyberspace. The South American country has openly stated that the voluntary norms included in the Report of the Group of Experts (GGE) represent an inescapable guide for the responsible behaviour of States in cyberspace. In session 5 of the second substantive session of the OEWG 2021-2025, Uruguay along with seven other States pointed out the importance of the protection of critical infrastructure, according to norm 13(f).
Its insistence on an enhanced role for intergovernmental institutions (such as the ITU) and its oscillating allegiance to the two polarised factions largely reflect the country’s long-standing focus on Westphalian sovereignty and the consequent belief in the primacy of the state as an actor in international affairs. This brings India to a certain degree of alignment with sovereignty-focused countries like China and Russia in the context of norm-building debates.
At the second substantive session of the Open-Ended Working Group (OEWG), India argued that voluntary norms do not necessarily increase the predictability of state behaviour within the ICT environment, but was not openly against the adoption of new voluntary norms; for instance, the country proposed the adoption of a new norm on refraining from weaponisation and offensive uses of ICTs along with countries like Iran, Cuba, and Nigeria. At the first substantive session of the 2021-2025 UNGGE, Bosnia and Herzegovina aligned itself with the EU’s position that the previous UNGGE and OEWG reports, including corresponding UNGA resolutions adopted by consensus, form the unequivocal basis for “any further discussions on the position, role, and implementation of the voluntary non-binding norms, rules and principles of state behaviour in cyberspace (norms)” [x]. In 2018, however, it voted in favour of Russian-sponsored resolution A/73/27, which launched the Open-Ended Working Group (OEWG) format. Uruguay is a represented member in the Group of Governmental Experts (GGE) on Advancing responsible State behaviour in cyberspace. The South American country has openly stated that the voluntary norms included in the Report of the Group of Experts (GGE) represent an inescapable guide for the responsible behaviour of States in cyberspace. In session 5 of the second substantive session of the OEWG 2021-2025, Uruguay along with seven other States pointed out the importance of the protection of critical infrastructure, according to norm 13(f).
In matters related to cyber resilience, India has proven to be an active proponent of bilateralism. It has initiated cyber dialogues with actors like the US, the UK, Russia, Malaysia, the EU, and ASEAN, all of which include capacity-building elements. Internationally, the country has also been especially vocal on the need to establish cooperative mechanisms for developing and implementing bilateral, regional, and global confidence-building measures (CBMs).
In the context of multilateral fora, India has many a time reiterated that the issue of supply chain protection enjoys particular significance for them, especially in relation to ‘trust and trusted sources’ when it comes to preferring suppliers of ICT products and systems. It has also noted that capacity building actually goes beyond what is being dealt with under international security and is inherently tied to discussions on international legal instruments on cyberspace, where all states are equal and have the capacity to discuss legitimate matters under the auspices of the UN. The country has no overarching cybersecurity strategy. Elements of strategic contemplation over cybersecurity can be found within the Criminal Code, which criminalises critical infrastructure damage (including that of information systems) as an act of terrorism. The 2015-2020 Strategy for Prevention and Combating Terrorism reiterates an objective laid out in earlier documents regarding the setup of a dedicated national CERT that will develop and implement monitoring and response mechanisms vis-a-vis the misuse of the Internet for terrorist purposes. Bosnia and Herzegovina has been exploring potential avenues of cooperation with NATO, especially in relation to common solutions to security challenges in the area of cyber defence [x], while Bosnian scientists have also participated in the NATO SPS Programme. Finally, as a member state of the OSCE, Bosnia and Herzegovina is required to implement the OSCE’s 16 Confidence Building Measures (CBMs) as adopted by the OSCE Permanent Council. Objective 10 of Uruguay’s Digital Agenda for 2025 provides a clear guideline for resilience measures in cybersecurity and ICT. Uruguay is focused on enhancing cybersecurity to prevent and mitigate risks in cyberspace, advancing compliance with the national cyber-security framework, based on public-private cooperation and ensuring the availability of critical information assets. Uruguay intends to achieve this goal by improving efficiency in detecting and responding to cyber incidents by implementing new technologies that allow for predictive analytics and response automation, among others.
In the context of multilateral fora, India has many a time reiterated that the issue of supply chain protection enjoys particular significance for them, especially in relation to ‘trust and trusted sources’ when it comes to preferring suppliers of ICT products and systems. It has also noted that capacity building actually goes beyond what is being dealt with under international security and is inherently tied to discussions on international legal instruments on cyberspace, where all states are equal and have the capacity to discuss legitimate matters under the auspices of the UN. The country has no overarching cybersecurity strategy. Elements of strategic contemplation over cybersecurity can be found within the Criminal Code, which criminalises critical infrastructure damage (including that of information systems) as an act of terrorism. The 2015-2020 Strategy for Prevention and Combating Terrorism reiterates an objective laid out in earlier documents regarding the setup of a dedicated national CERT that will develop and implement monitoring and response mechanisms vis-a-vis the misuse of the Internet for terrorist purposes. Bosnia and Herzegovina has been exploring potential avenues of cooperation with NATO, especially in relation to common solutions to security challenges in the area of cyber defence [x], while Bosnian scientists have also participated in the NATO SPS Programme. Finally, as a member state of the OSCE, Bosnia and Herzegovina is required to implement the OSCE’s 16 Confidence Building Measures (CBMs) as adopted by the OSCE Permanent Council. Objective 10 of Uruguay’s Digital Agenda for 2025 provides a clear guideline for resilience measures in cybersecurity and ICT. Uruguay is focused on enhancing cybersecurity to prevent and mitigate risks in cyberspace, advancing compliance with the national cyber-security framework, based on public-private cooperation and ensuring the availability of critical information assets. Uruguay intends to achieve this goal by improving efficiency in detecting and responding to cyber incidents by implementing new technologies that allow for predictive analytics and response automation, among others.
Under the auspices of the OEWG, India has highlighted the need for “real-time cooperation between government agencies” in combatting cybercrime, cyberterrorism, and cyber threats more widely. To date, however, India has not signed any international cybercrime agreement. It voted in favour of a Russia-sponsored UNGA Resolution calling for the establishment of a separate cybercrime treaty.
Despite having brought its legal framework largely in alignment with the Budapest Convention, India remains a non-party because the document was drafted without the country’s participation, thus rending the treaty discriminatory. Another big objection has been raised on the basis of section 32.b, which gives intelligence agencies trans-border access to data for the purposes of criminal investigations with lawful and voluntary consent - a concern shared by Russia.
It has also been argued that the Mutual Legal Assistance (MLA) regime under Budapest is not effective, as it does not commit states to a firm promise of cooperation; from the perspective of the Indians, it would be preferable to replace this regime with a UN-driven process. Bosnia and Herzegovina is a party to the Budapest Convention on Cybercrime, officially acceding in 2006. As of 2019, however, domestic legislation at the state level had only been partially harmonised with Budapest provisions [x]. The country voted against the Russian-sponsored UN resolution that launched the institutional procedure for a new legal instrument on international cybercrime cooperation. Bosnian law enforcement regularly cooperates with Europol and is due to open negotiations for a cooperation agreement with Eurojust [x]. Uruguay is not a signatory State of the Budapest Convention on Cybercrime, cooperating in international affairs outside of the framework established by the Council of Europe. However, it has a relatively low rate of cybercrime compared to other countries in the region, staking its position as one of the most advanced countries in Latin America and the Caribbean in terms of cybersecurity. Much of its success relies on the Cybersecurity Framework published in 2021, which is allowing Uruguay to start using artificial intelligence to automate incident response and pattern detection, as well as incorporating data analytics to make projections and anticipate incidents.
Regarding Data Protection, Uruguay has adapted its national framework to the European GDPR, despite its latest Data Protection Law dating back to 2008.
Despite having brought its legal framework largely in alignment with the Budapest Convention, India remains a non-party because the document was drafted without the country’s participation, thus rending the treaty discriminatory. Another big objection has been raised on the basis of section 32.b, which gives intelligence agencies trans-border access to data for the purposes of criminal investigations with lawful and voluntary consent - a concern shared by Russia.
It has also been argued that the Mutual Legal Assistance (MLA) regime under Budapest is not effective, as it does not commit states to a firm promise of cooperation; from the perspective of the Indians, it would be preferable to replace this regime with a UN-driven process. Bosnia and Herzegovina is a party to the Budapest Convention on Cybercrime, officially acceding in 2006. As of 2019, however, domestic legislation at the state level had only been partially harmonised with Budapest provisions [x]. The country voted against the Russian-sponsored UN resolution that launched the institutional procedure for a new legal instrument on international cybercrime cooperation. Bosnian law enforcement regularly cooperates with Europol and is due to open negotiations for a cooperation agreement with Eurojust [x]. Uruguay is not a signatory State of the Budapest Convention on Cybercrime, cooperating in international affairs outside of the framework established by the Council of Europe. However, it has a relatively low rate of cybercrime compared to other countries in the region, staking its position as one of the most advanced countries in Latin America and the Caribbean in terms of cybersecurity. Much of its success relies on the Cybersecurity Framework published in 2021, which is allowing Uruguay to start using artificial intelligence to automate incident response and pattern detection, as well as incorporating data analytics to make projections and anticipate incidents.
Regarding Data Protection, Uruguay has adapted its national framework to the European GDPR, despite its latest Data Protection Law dating back to 2008.
