India and the European Union share many values and principles, such as inclusiveness, democracy, and multilateralism. With 1.4 billion people, India is the largest democracy in the world and considers itself as a leader among the Global South. India and the EU share common visions of a rules-based global order and are aligned on their commitment to an open, free, secure, stable, peaceful, and accessible cyberspace, enabling economic growth and innovation. In light of India’s rapid digitization and connectivity, the EU-India Strategic Partnership & Roadmap to 2025 includes commitments to cooperate on new and emerging technologies, norms and regulatory frameworks, and international standards.

China has the largest amount of users in the world, a significant digital economy growth potential, and its national Internet giants Alibaba, Didi, Tencent and Baidu are increasingly able to rival the biggest Western competitors in terms of market value and influence on the global tech landscape. China’s cyber diplomacy puts special attention towards equal participation, the principles of non-interference in internal affairs, non-use of force and peaceful settlement of disputes, and support for multilateral institutions to shape normative views on the governance of cyberspace. However, China’s propagation of the cyber-sovereignty approach to international cybersecurity policy and an absolutist reading of sovereignty in cyberspace provide a legal cloak for state practices that often run counter to the core European values of a global, open, and free Internet.

An EU candidate country since 2012, Serbia is an important partner in the Western Balkans. The 2020 iteration of the Digital Evolution Scorecard characterised Serbia as a ‘break out’ economy, meaning that despite a relative lack of digital infrastructure the country is rapidly digitalising; internet penetration is one of the highest across the region, standing at 79%. Over the past decade, Serbia’s digital policy has been focused on attracting foreign investment, deepening the digital transformation across the public and private sectors, and promoting economic growth in line with EU targets. These objectives have been operationalised through a series of strategies, notably the Strategy for the Development of Information Security for the period 2017-2020 and the Strategy for combat against cyber crime 2019-2023. The ITU notes, however, that “while innovative, internet-based e-commerce is expected to bring significant growth and development, obsolete legislation and a lack of harmonisation with EU standards and best practice persist, hampering progress”. As the country becomes increasingly more digitalised, the challenge for Serbian cyber diplomacy will be to develop and enhance avenues of European, regional, and international cooperation.

As a member of the 2015 UNGGE group, India accepts that international law and specifically the UN Charter applies in its entirety in the cyber domain. India has noted the need to develop common understandings as to how international law should be interpreted, especially on the issues of what constitutes force and/or an armed attack in cyberspace and what the threshold of cyber-attacks should be to invoke Article 51 of the UN Charter. 
In statements at the UN General Assembly, India has also specifically called for further elaboration on peacetime rules of international law, the law concerning the right of self-defence and international humanitarian law. 
Apart from these calls for clarification and elaboration, however, India’s stance on specific aspects of international law and their interpretation remains unclear. This seems consistent with India’s recent reorientation of its foreign policy; since 2019, India’s wider approach has been marked by a shift from traditional non-alignment to issue-based ‘multi-alignment’ that reflects national priorities and interests.

In theory, China accepts that the principles enshrined within the UN Charter, including sovereign equality, prohibition on the use of force, settlement of disputes by peaceful means, non-intervention in the affairs of other states and fulfilment of international obligations in good faith, apply in cyberspace. 
Nevertheless, the Chinese position is generally characterized by a reluctance to crystallise the precise ways in which existing customary and international treaty law might govern the cyber domain; the exact application of specific aspects of international law, such as laws on self-defence, state responsibility, and international humanitarian law, is claimed to remain unclear in the absence of international consensus. 
Chinese delegations have also repeatedly cautioned against the “indiscriminate application of the law of armed conflicts”, arguing that the undue emphasis on jus ad bellum undermines stability in cyberspace by presupposing and thus effectively legitimising cyber conflict, consequently turning cyberspace into a “new battlefield”. 
China regards proposals on regional exchanges of views and development of common understanding on the application of international law with particular scepticism, stating that states must work on reaching “universally-accepted consensus” on the application of international law, rather than engage in “self-explanations at regional levels or among a small group of countries”. The Chinese have also consistently favoured the adoption of new international legal instruments tailored to the attributes of cyberspace (lex specialis).

The country has not assumed a firm stance on the application of international law in cyberspace. Serbia’s position paper concerning the Open-Ended Working Group (OEWG) highlighted that multilateral dialogue on “information security” must occur “with strict respect for the Charter of the United Nations”. Echoing the stance of states such as China, Russia, and Cuba, Serbia also raised the alarm about the “danger of developing offensive ICT and militarising the digital space”.

India has assumed a stance of strategic ambiguity on the proliferation of norms for responsible state behaviour in cyberspace, positioning itself as a ‘bridge builder’ between the two camps that have emerged during multilateral cyber norm negotiations. 
Its insistence on an enhanced role for intergovernmental institutions (such as the ITU) and its oscillating allegiance to the two polarised factions largely reflect the country’s long-standing focus on Westphalian sovereignty and the consequent belief in the primacy of the state as an actor in international affairs. This brings India to a certain degree of alignment with sovereignty-focused countries like China and Russia in the context of norm-building debates. 
At the second substantive session of the Open-Ended Working Group (OEWG), India argued that voluntary norms do not necessarily increase the predictability of state behaviour within the ICT environment, but was not openly against the adoption of new voluntary norms; for instance, the country proposed the adoption of a new norm on refraining from weaponisation and offensive uses of ICTs along with countries like Iran, Cuba, and Nigeria.

China’s International Strategy on Cyberspace Cooperation highlights that the country is committed to the maintenance of peace and stability in cyberspace through international cooperation on norms of responsible state behaviour. In 2018, Chinese support for the Russia-sponsored UNGA Resolution A/RES/73/27 was instrumental in establishing the Open-Ended Working Group (OEWG) as an alternative forum to the UN Group of Governmental Experts (UN GGE), whose fifth iteration in 2017 had failed to reach consensus. 
The country is in favour of formulating new norms of responsible state behaviour in light of recent ICT developments; during the latest OEWG discussions, China put forward specific proposals on formulating new rules on data security, in accordance with its own Global Initiative on Data Security. 
China has repeatedly expressed a preference for non-voluntary, binding legal norms, arguing that the best option is to formulate “new international legal instruments consummate with the characteristics of cyberspace, with a view to maintaining peace in cyberspace, instead of using legal instruments as a tool to pursue accountability and punishment unilaterally.”

Serbia was represented in the 2016-2017 UN Group of Governmental Experts (UNGGE). Despite its EU candidate status, Serbia does not typically vote in alignment with the EU on key cybersecurity resolutions presented before the UN First Committee. Notable examples include UNGA resolution 73/27, which first established the Open-Ended Working Group (OEWG), as well as later resolutions 74/29 and 75/240.

In matters related to cyber resilience, India has proven to be an active proponent of bilateralism. It has initiated cyber dialogues with actors like the US, the UK, Russia, Malaysia, the EU, and ASEAN, all of which include capacity-building elements. Internationally, the country has also been especially vocal on the need to establish cooperative mechanisms for developing and implementing bilateral, regional, and global confidence-building measures (CBMs). 
In the context of multilateral fora, India has many a time reiterated that the issue of supply chain protection enjoys particular significance for them, especially in relation to ‘trust and trusted sources’ when it comes to preferring suppliers of ICT products and systems. It has also noted that capacity building actually goes beyond what is being dealt with under international security and is inherently tied to discussions on international legal instruments on cyberspace, where all states are equal and have the capacity to discuss legitimate matters under the auspices of the UN.

The Chinese International Strategy on Cyberspace Cooperation places a large emphasis on the development of confidence-building measures (CBMs) and engagement with partner countries through predictability-increasing practical measures to prevent unintended conflicts, respond to information operations, and ensure supply chain security in network equipment and industrial control systems. 
Another key pillar of China’s cyber strategy is providing capacity-building assistance to developing countries. The Belt and Road Digital Economy International Cooperation Initiative, launched in 2017, and 'the Digital Silk Road' seek to internationalise Chinese technology made by state-owned or affiliated companies, including Huawei and ZTE, and therefore export Chinese technical standards abroad. Chinese outreach in this domain is most active in Africa, South America, and Central and Southeast Asia through projects such as the China-ASEAN Information Harbour and the China-Arabia Digital Silk Road Ningxia Hub. In addition to infrastructure investment, capacity building also focuses on enhancing information-sharing capacities, cyber defence personnel training, and crisis management.

Serbia’s legislative framework on cybersecurity is structured upon the 2016 Law on Information Security and its bylaws. The Law ushered in several institutional developments, including the creation of a national CERT in the regulatory agency for electronic communications and postal services (RATEL). The national CERT “monitors the status of incidents on national level, provides early warnings, alerts and announcements, and reacts on incidents by providing the information on affected entities and persons”. [x] It also holds seminars and technical trainings for operators of special importance (critical infrastructure) [x]. 
Meanwhile, the 2021 Cyber Tesla drill (organised in collaboration with the US state of Ohio) constitutes only one example of Serbia’s increased emphasis on critical infrastructure through the prism of cyber defence; the stated objectives included the “construction of military defence system capacities and the National CERT’s capacities for the protection from high-tech attacks, as well as an enhanced cooperation with relevant government and private sector organisations and academic institutions for the purpose of protection of the IT systems”. 
In its UNGGE position paper in 2016, Serbia emphasised the importance of interstate cooperation in “maintaining effective and responsive mechanisms for information exchange, alerts and announcements on cybersecurity incidents”. The paper goes on to posit that “the special focus should be on the protection of critical infrastructure”, especially in the case of transnational attacks. In 2021, Norway donated a platform worth €1.2 million which will “[serve] to hold cyber exercises at the national level enables the real situation of different attack scenarios, and will contribute to capacity building and training of officials in various state institutions”, according to State Secretary of the Ministry of Trade, Tourism and Telecommunications Milos Cvetanovic [x].

Under the auspices of the OEWG, India has highlighted the need for “real-time cooperation between government agencies” in combatting cybercrime, cyberterrorism, and cyber threats more widely. To date, however, India has not signed any international cybercrime agreement. It voted in favour of a Russia-sponsored UNGA Resolution calling for the establishment of a separate cybercrime treaty. 
Despite having brought its legal framework largely in alignment with the Budapest Convention, India remains a non-party because the document was drafted without the country’s participation, thus rending the treaty discriminatory. Another big objection has been raised on the basis of section 32.b, which gives intelligence agencies trans-border access to data for the purposes of criminal investigations with lawful and voluntary consent - a concern shared by Russia. 
It has also been argued that the Mutual Legal Assistance (MLA) regime under Budapest is not effective, as it does not commit states to a firm promise of cooperation; from the perspective of the Indians, it would be preferable to replace this regime with a UN-driven process.

The Chinese Strategy on Cyberspace Cooperation notes that the country “supports the UN Security Council to play an important part in international cooperation against cyber terrorism” and “supports and contributes to UN effort on fighting cyber crimes”. China is not a party to or observer of the Budapest Convention; instead, it has consistently backed Russian bids in the UN to establish a new cybercrime treaty, with these efforts culminating in Resolution A/74/247 that created an Ad Hoc Committee for that purpose. 
China has also signed the World Intellectual Property Organization Copyright Treaty (WIPO Copyright Treaty) in 1985 as well as the UN Convention Against Transnational Organised Crime and is a member of Interpol. 
In addition, China has pursued regional avenues of cooperative engagement; within the context of the Shanghai Cooperation Organisation, for instance, the country agreed to participate in efforts to fight against terrorism, separatism, extremism, and international cybercrime. 
It also supports joint cybersecurity exercises under the auspices of the Organisation.

The Information Society and Information Security Development Strategy for the period 2021-2026 provides a comprehensive approach to the field of information security, which includes both (a) information security of ICT systems of special importance and security of the Republic of Serbia, and (b) security of citizens and businesses, which is particularly reflected through the fight against cybercrime. Its predecessor, the 2017 Strategy for the Development of Information Security, in turn, indicates the fight against cybercrime as one of the government’s five key priorities. 
In light of EU accession negotiations, Serbia has signed and ratified the Council of Europe Convention on Cybercrime (Budapest Convention), including its Additional Protocol on Xenophobia and Racism Committed Through Computer Systems. Nevertheless, the country also voted in favour of UNGA resolution 74/247 calling for an international legal instrument to govern this domain. Domestically, the national legislative framework has been developed in accordance with the Budapest Convention and EU legislation. A High-Tech Crime Unit has recently been established within the special prosecutor’s office, along with three specialised units: crime analysis; terrorism and extremism; and drug prevention, addiction and repression. 
Serbia is a member of Interpol, with which the country has discussed ways to enhance cooperation with regard to combatting cybercrime. Serbia is also gradually developing its own bilateral cooperation network, signing a Cooperation Memoranda with India in 2016 [x] and Romania in 2017 [x] as well as receiving assistance from Russian experts [x].

Special thanks to Ms Maja Lakusic for her valuable comments.