Internet penetration in Montenegro stands at 83%, while analysis indicates that internet usage increased by 10,000 users (+2%) from 2021 to 2022. [x] As an EU candidate country, Montenegro has strived to align itself with the EU’s cyber priorities and recent strategic documents like the 2018-2021 Cybersecurity Strategy and its 2013-2017 predecessor represent a firm indication of this ambition. In the past five years, however, the Montenegrin government and media outlets have increasingly seen themselves sitting at the bullseye of numerous malicious cyberattacks, suggesting “synchronised action” on the part of several state and non-state actors. [x] A 2022 digital maturity assessment commissioned by the European Bank for Reconstruction and Development and conducted by e-Governance Academy found Montenegro to have only a “basic” level of digital maturity in seven dimensions, including “financing digitalisation, level of digital skill, and access to services”. The same assessment found that the “right conditions” had been generated for the purposes of digitalisation, but implementation fell short. These conditions included “political will and support, the legal framework, digital infrastructure and interoperability, digital identity/signature and security”. Montenegrin policymakers now perceive an increased need to transform their stated strategic goals into concrete action.

The digital economy is amongst the most powerful loci of Canadian economic growth; over the past decade, the digital economy grew roughly 40 per cent faster than – and generated almost four times as many jobs as – the overall economy. However, this spurt has also led to increased vulnerabilities in relation to cybersecurity; in 2020, successful cyber attacks affected 78% of Canadian companies. Canada has quietly developed a robust cyber diplomacy approach aiming at promoting a rules-based international order in cyberspace, in line with the goals of other ‘like-minded’ states (including European Union countries). Both the EU and Canada share a vision of cyberspace as a domain of human activity that is open, free, and secure, and which is characterized by due regard for fundamental rights and democratic values. As such, Canada is an important strategic partner for Europe.

According to the International Telecommunications Union (ITU), as of 2021, Peru had an internet penetration rate of around 71.1 %. However other indexes place this number in the mid 60’s. Although many improvements were made in the past few years, Peru still possesses low network coverage, especially in rural areas and a relatively low network performance.
The government of Peru has been implementing initiatives to increase connectivity in rural areas, including a national broadband plan and a program to deploy free Wi-Fi hotspots in public spaces, with a year-on-year increase of almost 100 %.
Peru ranked 86 out of 182 countries surveyed in the ITU’s Global Cybersecurity Index in 2020.

Recalling its EU candidate status, the first substantive session of the 2021-2025 UN Group of Governmental exports (UNGGE) saw Montenegro aligning itself with the EU’s statement that the existing corpus of international law, notably the UN Charter, international humanitarian law, and international human rights law, apply in cyberspace in its entirety. In particular, this includes the principle of state sovereignty, sovereign equality, the settlement of disputes by peaceful means, the provision of the use of force non-intervention in the internal affairs of other states, and the respect for human rights and fundamental freedoms as principles of international law that are applicable to states use of ICTs in cyberspace. [x] Montenegro has also consistently aligned itself with the EU position in a number of key resolutions at the United Nations, including resolutions A/73/27 and A/74/29.

As per the conclusions of the 2013, 2015, and 2021 UN GGE (Group of Governmental Experts) reports, Canada believes that international law applies in cyberspace and is “essential to maintaining peace and stability” as well as “promoting an open, secure, peaceful, and accessible ICT environment”; according to Canada, the applicability of international law “puts guardrails on states’ behaviour in cyberspace”. Applicable legal instruments include the UN Charter, the law on state responsibility (including countermeasures), International Human Rights Law, and International Human Rights Law (IHL). Canada does not favour the establishment of a treaty or binding legal instrument on cyber issues, arguing that it would undermine existing international law and norms of responsible state behaviour. Instead, Canada believes that existing international law and agreed-upon norms are sufficient to guide State behaviour in cyberspace.

Peru is one of the Latin American countries to have signed and ratified the Council of Europe’s Convention 108+.
The country has also participated in the United Nations Open-ended Working Group (OEWG) on Developments in the Field of Information and Telecommunications in the Context of International Security. As a matter of fact, after the third substantive session of the OEWG, Peru issued a statement supporting the primacy of the UN Charter and the application of international law in the use of ICTs and in cyberspace, as well as the future establishment of legally binding obligations.
On the other hand, Peru along with Chile and the United States of America, has a divergent view on the notion of cyber attack and the applicability of international law. Peru states that in order for a cyber operation to be considered an attack, it results in direct death, injury or physical harm.

At the first substantive session of the 2021-2025 UNGGE, Montenegro aligned itself with the EU’s position that the “previous UNGGE and OEWG reports, including corresponding UNGA resolutions adopted by consensus” form the unequivocal basis for “any further discussions on the position, role, and implementation of the voluntary non-binding norms, rules and principles of state behaviour in cyberspace (norms)” [x].

Canada regards the applicability of norms of responsible state behaviour in cyberspace, together with existing international law, as the “foundation of sustaining international peace and security […] in cyberspace”. This is why it has strongly promoted the adoption and implementation of the UN GGE norms in various fora, including the G7, G20, North American Leaders’ Summit, NATO, ASEAN, and the OSCE. From Canada’s perspective, there is no need to develop new norms; international cooperation efforts should instead focus on fostering States’ capacity-building abilities, as well as the implementation and operationalization of existing norms. Canada has also been the biggest proponent of taking gender considerations into account when discussing the implementation of cyber norms, advocating for greater women’s participation and gender equality in the field of cybersecurity.

Peru stresses the need to make a distinction between 'cyber attacks' (which involve 'damage being caused to a militarily relevant target, which may be totally or partially destroyed, even captured or neutralised') and an 'abrupt disruption of communications in cyberspace', i.e. cyber operations that cause inconvenience, even extreme inconvenience, but not direct injury or death, or destruction of property. Accordingly, Peru emphasises the determination of the legality of cyber operations in the context of the use of force by taking into account whether they may result in death or injury to persons or property.
Peru has noted the difficulty of attribution in cyberspace. Coinciding with other American states, Peru has focused on the state's duty to ensure that its territory is not used by non-state actors to launch attacks. In this regard, Peru states that the inertia of a state towards a non-state actor that could unleash a cyber-attack on another state and that it was in a position to control could make its behaviour attributable to the state.
In any case, Peru highlights the validity of various human rights in cyberspace, including 'the right to privacy and intimacy, freedom of information, freedom of expression, free and equal access to information, bridging the digital divide, intellectual property rights, free flow of information, the right to secrecy of communications'.

The new Cybersecurity Strategy 2022-2026 aims to improve effective mechanism for responding to cyber incidents and response to cybercrime. The new strategy recognises the establishment of a new body Cyber Security Agency which will be umbrella institution when it comes to cyber security. The CIRT team will be transferred to the new Agency. The 2018-2021 Cybersecurity Strategy explicitly establishes a “reliance” on European and Euro-Atlantic conceptualisations of cybersecurity and resilience. The Strategy points to the EU’s 2016 NIS Directive as the primary source of inspiration, notably in its requirements for the adoption of a national cybersecurity strategy, the definition of relevant authorities, and the creation of a Computer Incident Response Team (CIRT). Indeed, since 2012, the Montenegrin CIRT represents “a central point for coordinating prevention and protection against computer security incidents on the Internet and other IT security risk for the area of Montenegro”. The Strategy also features a dedicated section on cyber defence, highlighting the country’s alignment with NATO targets (E 6202 N). In expanding cyber defence capabilities, the document notes that “special attention will be paid to harmonisation with regard to the standardisation of concepts, methods, policies, and procedures in line with the accepted European and international standards”. It also pledges the country to a set of goals: (1) definition and protection of critical information infrastructure; (2) strengthening the resilience of information systems to incidents; and (3) performing analysis of threats to IT infrastructure. Montenegro completed a bilateral ICT cooperation agreement with Thailand in 2013, while it is also a member of the CAMP initiative, the platform where members “prepare themselves with collective actions to keep cyberspace safe” through training, joint exercises, and dialogues.

The Canadian National Cyber Security Strategy puts an emphasis on “secure and resilient Canadian systems”, specifically critical infrastructure such as electricity grids, communications networks, and financial institutions. The ambition to help other countries expand their capacity building activities has been a key aspect of Canada’s cyber engagement strategy and its concurrent aim of promoting an “open, secure, and multistakeholder-led Internet”. Under the auspices of the OEWG, Canada has argued that “member States must make cyber security capacity development a priority at the highest level” and that “it is […] important to analyze and assess the capacity building needs collaboratively and agree on a collective approach”. Through the Anti-Crime Capacity Building Program (ACCBP), Canada has committed $27.7M to cyber capacity building, primarily in Latin America. ACCBP also assists countries in developing their own national cyber strategies and cybersecurity standards while also ensuring respect for human rights and privacy for all citizens. Meanwhile, Canada has been cooperating with several international and regional organizations on the development and implementation of Confidence-Building Measures (CBMs); for instance, there have been several Canadian initiatives at the OSCE, including workshops on international law and cyber operations as well as scenario-based discussions on CBM 5 (information sharing about national responses to regional cyber incidents). Canada believes that capacity-building should be multistakeholder and integrate the insights of the technical community as much as possible. The Canadian representative at the OEWG has also highlighted the importance of gender balance and the participation of women in capacity-building efforts.

The Personal Data Protection Law N° 29733 (PDPL) was enacted in June 2011. In March 2013, the Supreme Decree N° 003-2013-JUS-Regulation of the PDLP (Regulation) was published in order to develop, clarify and expand on the requirements of the PDPL and set forth specific rules, terms and provisions regarding data protection.
Together, the PDLP and its Regulation are the primary data protection laws in Peru.
As of 2021, Peru approved the Bill that creates the National Authority for Transparency, Access to Public Information and Protection of Personal Data.
Peru possesses a Digital Trust Framework, as a means to establish certain obligations for public or private entities acting as digital service providers. These include reporting when a digital security incident involving personal data occurs, as well as implementing technical, organisational, and legal security measures to guarantee the confidentiality of information transmitted through its communications services.
Over the last decades, the Peruvian state has made efforts to promote digital transformation, both within its institutions and in the services it offers to citizens and has outlined a Digital Agenda in 2021 for Digital Transformation.

Montenegro is a party to the Council of Europe-sponsored Budapest Convention, ratifying it in 2010. In February 2013, Montenegro signed the regional Declaration on Strategic Priorities against Cybercrime, which “identified strategic priorities” that largely reflect the spirit and content of the Budapest provisions. [x] The 2018-2021 Strategy lists several developments that have contributed towards strengthening the capabilities of law enforcement authorities in dealing with cybercrime: these include the establishment of a dedicated High-Tech Crime Group within the Ministry of Interior, while the National Security Agency is making “significant efforts aimed at creating normative and operational mechanisms for fighting against cybercrime and espionage”. [x]

Many thanks to Ms Ana Minevski for her valuable comments.

Canada’s National Cyber Security Strategy identifies the activities of malicious cyber actors as a “growing challenge”. Following the adoption of the ‘Protecting Canadians from Online Crime’ Act, Canada acceded to the Council of Europe’s Budapest Convention in 2015 and has since consistently promoted the instrument as the “best tool to fight cybercrime at the international level”. Canada has specifically “encourage[d] countries to bolster their anti-cybercrime efforts by becoming Parties to the Convention, or using it as a model to implement their own cybercrime laws”. Moreover, upon Canada’s initiative, the Quintet of Attorneys General (which brings together Attorneys General from Canada, the US, Australia, New Zealand and the UK) issued a public statement at their July 2019 meeting, expressing their support for the Budapest Convention as a “necessary basic framework for fighting cybercrime” and for the work of the United Nations Open-Ended Intergovernmental Expert Group on Cybercrime (UNIEG). Being part of the ‘like-minded’ group of states, Canada voted against the Russian-sponsored UNGA Resolution 74/247 aiming at establishing an alternative cybercrime instrument; upon the passage of 74/247 and its follow-up UNGA Resolution 75/282, however, Canada has been a vocal member of the Ad Hoc Committee on Cybercrime. Prior to the Committee’s May 2021 organizational session, the Canadian position paper on the Implementation of 74/247 noted that the Committee must “ensure consistency with existing UN treaties in the field of crime prevention and criminal justice, in particular the United Nations Convention against Transnational Organized Crime, the United Nations Convention against Corruption and take into account multilateral instruments that have already proven their usefulness in the fight against cybercrime, in particular the Council of Europe Convention on Cybercrime”. In the same document, Canada emphasized the need for an “inclusive, transparent, constructive, and consensus-based process that will lead to a fair outcome to the benefit of all”. The first session of the Ad Hoc Committee will be held in New York from 17 to 28 January 2022. Canada’s perspective on the scope, objectives, and structure of the convention was submitted to the Ad Hoc Committee in advance of the start of the first negotiation session (E).

Peru’s signature and ratification of the Budapest Convention on Cybercrime, which is the only binding international instrument dealing with cybercrime, was a great step towards advancing a cyber agenda.
In 2019, Peru passed a Cyber Defence Act, with the objectives of defending and protecting sovereignty, national interests, critical national assets and key resources to maintain national capabilities against threats or attacks in and through cyberspace, when these affect national security.Peru has also passed a Cybersecurity Framework for the private sector, with the objective of identifying and protecting information assets, detecting security events, and providing for response and recovery from cybersecurity incidents.
In this context, there are more and more reports of cybercrime in the country. According to data from the Public Prosecutor's Office, in 2021 they received 18,596 reports of cybercrime cases, which represents a percentage increase of 92.9% compared to 2020, with phishing and ransomware being the most common attacks.