Internet penetration in Montenegro stands at 83%, while analysis indicates that internet usage increased by 10,000 users (+2%) from 2021 to 2022. [x] As an EU candidate country, Montenegro has strived to align itself with the EU’s cyber priorities and recent strategic documents like the 2018-2021 Cybersecurity Strategy and its 2013-2017 predecessor represent a firm indication of this ambition. In the past five years, however, the Montenegrin government and media outlets have increasingly seen themselves sitting at the bullseye of numerous malicious cyberattacks, suggesting “synchronised action” on the part of several state and non-state actors. [x] A 2022 digital maturity assessment commissioned by the European Bank for Reconstruction and Development and conducted by e-Governance Academy found Montenegro to have only a “basic” level of digital maturity in seven dimensions, including “financing digitalisation, level of digital skill, and access to services”. The same assessment found that the “right conditions” had been generated for the purposes of digitalisation, but implementation fell short. These conditions included “political will and support, the legal framework, digital infrastructure and interoperability, digital identity/signature and security”. Montenegrin policymakers now perceive an increased need to transform their stated strategic goals into concrete action.

The United Kingdom ranks 10^th in the 2021 Network Readiness Index (NRI), 9^th in the 2021 Digital Skills Gap Index and 14^th in the 2021 IMD World Digital Competitiveness Ranking. The British digital sector contributes roughly £149 billion each year to the economy and employs more than 1.5 million people [x]. The country also remains Europe’s unofficial ‘start-up capital’, with British tech startups attracting more than $15 billion in venture capital investment in the midst of a global pandemic. Nevertheless, new and emerging challenges to peace and security in cyberspace represent pressing concerns for the UK [x]. Over the course of 2021, the UK’s National Cyber Security Centre dealt with 777 significant incidents, with around 20% of supported organisations being linked to the health sector and Covid vaccines [x]. In the face of ever-increasing cyber vulnerabilities, the UK government has recently adopted a strategy of ‘levelling up’ protection for British cyberspace. This has brought international collaboration on cyber issues to the forefront of Britain’s diplomatic agenda. British diplomacy has traditionally championed the rules-based international system both online and offline, placing great emphasis on human rights, democratic values and free trade.

Nigeria is Africa’s most populous country with a population of 211 million people. Nigeria also has the continent’s largest economy, with a total GDP of $440 billion. Nigeria only emerged as Africa’s largest economy in 2014, overtaking South Africa after a GDP rebasing exercise which accounted for the contribution of emerging sectors of the economy, such as the Information and Communication Technology (ICT) sector. Nigeria’s economy had hitherto been petroleum dominated. In Q4 2021, the ICT sector of the economy contributed 15% to GDP, compared to 5% for the oil and gas sector. The percentage of people who use the Internet in Nigeria is 28%, largely through mobile networks. 91% of the population is covered by a mobile network (i.e. 74% by at least a 3G network and 41% by at least a 4G network). Huawei and ZTE have been responsible for constructing major parts of Nigeria’s broadband network (4G, LTE and 5G). Mobile phone subscription coverage is 99% of the population. Active mobile broadband subscription is 42% of the population, while fixed broadband connection is negligible, under 1%. Nigeria has 6 international submarine cables bringing at least 40TB capacity to its shores. There are 7 Internet Exchange Points (IXPs) in Nigeria with 71 peering networks. NigComSat-1, a communications satellite, made possible by cooperation between Nigeria and China, was launched in May 2007. Nigeria has plans to purchase 2 more communications satellites by 2025. Nigeria banned cryptocurrencies in 2021, but floated perhaps Africa’s largest digital currency the e-naira the same year. Despite the cryptocurrency ban, it is still in use in the country although hosted in foreign accounts.
The European Union is a significant partner in Nigeria’s cyberspace. For example, through its EU-Nigeria Digital Economy Package (Global Gateway Initiative), the EU plans a 820 million Euros investment to support Nigeria’s digitalisation strategy through digital infrastructure investments, digitalisation of public services, digital entrepreneurship, digital skills, and digital governance. However, the EU faces strong competition from China, whose investment in Nigeria’s telecommunications sectors is estimated to be $US 16 billion. China also helped manufacture and launch Nigeria’s Communications Satellite and has an equity stake in the parent satellite communications company. Huawei has been an important partner of the Nigerian government in building smart cities and e-government applications in an effort to improve government public services. Nigeria’s cyberspace is governed by several agencies including the Nigerian Communications Commission (NCC) and the National Information Technology Development Agency (NITDA).

Recalling its EU candidate status, the first substantive session of the 2021-2025 UN Group of Governmental exports (UNGGE) saw Montenegro aligning itself with the EU’s statement that the existing corpus of international law, notably the UN Charter, international humanitarian law, and international human rights law, apply in cyberspace in its entirety. In particular, this includes the principle of state sovereignty, sovereign equality, the settlement of disputes by peaceful means, the provision of the use of force non-intervention in the internal affairs of other states, and the respect for human rights and fundamental freedoms as principles of international law that are applicable to states use of ICTs in cyberspace. [x] Montenegro has also consistently aligned itself with the EU position in a number of key resolutions at the United Nations, including resolutions A/73/27 and A/74/29.

The UK views international law as “a critical tool for ensuring stability and security in cyberspace”. In accordance with the 2013, 2015 and 2021 UNGGE reports as well the 2021 OEWG report, the UK has affirmed that international law, including the UN Charter in its entirety, applies in cyberspace; a position paper notably states that “we do not consider it is for States to pick and choose which international law instruments are applicable”. This includes the prohibition of the use of force (Article 2(4)), the peaceful settlement of disputes (Article 33) and the inherent right of states to act in self-defence in response to an armed attack (Article 51). The law of state responsibility applies to cyber operations in peacetime, including the doctrine of countermeasures in response to internationally wrongful acts. Meanwhile, the country has professed a strong commitment to the respect of human rights law in cyberspace, co-sponsoring the 2012, 2014, 2016, 2018 and 2021 UN Human Rights Council resolutions on the protection, promotion and enjoyment of human rights on the Internet. Likewise, the UK believes in the application of international humanitarian law (IHL) to cyber operations in armed conflict. In response to concerns expressed by other states that this might lead to an undue ‘militarisation’ of cyberspace, the UK has responded that the application of IHL does not encourage armed conflict but only serves to limit humanitarian consequences in the event of such conflict. In addition, the country has stated and that there are ways for cyber capabilities to be developed in a manner “consistent with international law” and called on states to be transparent about the existence of their own capabilities. Those statements do not entirely dismiss the idea of cyberspace as a new military domain, with the British position at the OEWG being that “the use of ICTs in military contexts may be preferable to use of kinetic weapons and can be de-escalatory”. The UK is against the establishment of new, binding international instruments to regulate state behaviour in cyberspace, arguing that “pursuing […] the development of new treaties is only likely to entrench existing divides in this area and will progress us no further on the question of how International Law applies”.

Nigeria’s stance on international law in cyberspace is primarily shaped by its traditional concern over the growing proliferation of global cybercrime. Nigerian diplomats have emphasised the need for a proper legal framework that reflects the ideals and current trends within the African region. Nigeria has neither signed nor ratified the African Union (UN) Convention on Cybersecurity and Personal Data Protection. Less has been said, however, about the application of international law in cyberspace more generally. However, On 6 July 2022, Nigeria acceded to the Council of Europe Convention on cybercrime. The Convention entered into force in Nigeria on 1 November 2022.

At the first substantive session of the 2021-2025 UNGGE, Montenegro aligned itself with the EU’s position that the “previous UNGGE and OEWG reports, including corresponding UNGA resolutions adopted by consensus” form the unequivocal basis for “any further discussions on the position, role, and implementation of the voluntary non-binding norms, rules and principles of state behaviour in cyberspace (norms)” [x].

The UK regards voluntary, non-binding norms of responsible state behaviour as one of the three key pillars upon which the framework for international stability in cyberspace is currently built, the other two being international law and confidence-building measures (CBMs). The British have argued that “stronger awareness and understanding by all countries of the framework in general” is necessary and stated that they “remain concerned that the elaboration of new norms could undermine the existing norms by weakening the overarching protection they provide, or their technology neutral and ‘future-proofed’ nature”. The focus should instead be on the universalisation, operationalisation and implementation of existing norms, with regional organisations and capacity-building efforts playing a central role in this endeavour.

Nigeria has been an active participant in the OEWG, contributing to the 2021 consensus report. Nigeria’s position acknowledges the applicability of existing international laws in cyberspace and supports the call for the operationalisation of the 11 Norms of responsible behaviour in cyberspace to address its current challenges. Nigeria also upheld the conclusions of the final report of the GGE: that the precedence set by the 2021 OEWG should be a baseline for international cooperation because of the inclusive nature of stakeholder participation.

The new Cybersecurity Strategy 2022-2026 aims to improve effective mechanism for responding to cyber incidents and response to cybercrime. The new strategy recognises the establishment of a new body Cyber Security Agency which will be umbrella institution when it comes to cyber security. The CIRT team will be transferred to the new Agency. The 2018-2021 Cybersecurity Strategy explicitly establishes a “reliance” on European and Euro-Atlantic conceptualisations of cybersecurity and resilience. The Strategy points to the EU’s 2016 NIS Directive as the primary source of inspiration, notably in its requirements for the adoption of a national cybersecurity strategy, the definition of relevant authorities, and the creation of a Computer Incident Response Team (CIRT). Indeed, since 2012, the Montenegrin CIRT represents “a central point for coordinating prevention and protection against computer security incidents on the Internet and other IT security risk for the area of Montenegro”. The Strategy also features a dedicated section on cyber defence, highlighting the country’s alignment with NATO targets (E 6202 N). In expanding cyber defence capabilities, the document notes that “special attention will be paid to harmonisation with regard to the standardisation of concepts, methods, policies, and procedures in line with the accepted European and international standards”. It also pledges the country to a set of goals: (1) definition and protection of critical information infrastructure; (2) strengthening the resilience of information systems to incidents; and (3) performing analysis of threats to IT infrastructure. Montenegro completed a bilateral ICT cooperation agreement with Thailand in 2013, while it is also a member of the CAMP initiative, the platform where members “prepare themselves with collective actions to keep cyberspace safe” through training, joint exercises, and dialogues.

The July 2021 policy paper on Global Britain in a Competitive Age makes extensive reference to resilience in the post-Covid ICT environment, pledging that the UK will “strengthen global resilience” and “ensur[e] that more resilient countries worldwide can come together through stronger international institutions to act on the most pressing shared challenges”. In the cyber domain, this pledge has been further operationalised by the 2022 National Cyber Strategy, which frames cyber resilience in terms of risk awareness, system security and preparedness. The Strategy prioritises capacity building, adopting a whole-of-government approach and focusing on three elements: protecting critical international supply chains and infrastructure, advancing the secure use of digital technologies and working with industry partners and academia. Since 2016, the UK has worked through the National Cyber Security Centre (NCSC) to adopt an integrated approach to cyber incident management, streamlining across the public and private sectors. Meanwhile, Britain has championed
capacity-building assistance efforts abroad by providing advice, training and exercises and enabling the creation and maintenance of national Computer Security Incident Response Teams (CSIRTs). It has also provided funding to international capacity-building platforms, such as the Forum of Incident Response & Security Teams (FIRST) and the Americas CSIRT network. The UK has been working with partners within the OSCE to encourage the implementation of confidence-building measures (CBMs).

In the International Telecommunication Union (ITU) Cybersecurity Index 2020 which measures commitment to cybersecurity amongst its members , Nigeria ranked 47^th in the world, and 4^th within the African region. In 2021, Nigeria published the updated National Cybersecurity Policy and Strategy, which lays out detailed cybersecurity obligations for different private sector and public sector actors in critical national information infrastructure (CNII) protection and resilience within a context of multiple stakeholders. The National Cybersecurity Policy and Strategy, together with the Cybercrime Act, are the major policy instruments governing cybersecurity in the country.
The Global Cyber Security Capacity Centre (GCSCC) at Oxford University, in 2018, reviewed the maturity of cybersecurity capacity in Nigeria at the behest of the Office of the National Security Adviser (ONSA), using the Cybersecurity Maturity Model (CMM). Nigeria’s CMM report indicated a maturity stage of either start-up or formative stage (maturity stages 1 and 2 out of 5 stages) for the majority of factors, suggesting opportunities for investment. The United Kingdom has pledged some of this necessary investment, with Nigeria set to benefit from a £22 million investment package which aims to support resilience in Africa and the Indo-Pacific region.

Montenegro is a party to the Council of Europe-sponsored Budapest Convention, ratifying it in 2010. In February 2013, Montenegro signed the regional Declaration on Strategic Priorities against Cybercrime, which “identified strategic priorities” that largely reflect the spirit and content of the Budapest provisions. [x] The 2018-2021 Strategy lists several developments that have contributed towards strengthening the capabilities of law enforcement authorities in dealing with cybercrime: these include the establishment of a dedicated High-Tech Crime Group within the Ministry of Interior, while the National Security Agency is making “significant efforts aimed at creating normative and operational mechanisms for fighting against cybercrime and espionage”. [x]

Many thanks to Ms Ana Minevski for her valuable comments.

According to the 2022 National Cyber Strategy, the UK is committed to promoting the Council of Europe’s Budapest Convention on cybercrime as the primary international instrument for inter-state cooperation, while simultaneously engaging constructively with the UN process to develop a new international cybercrime treaty that will sit comfortably alongside the Budapest regime. In terms of law enforcement, the UK has developed well established mechanisms through the National Cyber Crime Unit (NCCU), operating under the umbrella of the National Crime Agency (NCA). The NCCU is tasked with leading the operational response, coordinating activity across different stakeholders and providing specialist cyber support across the law enforcement domain. The NCA has also developed a network of international liaison officers, which regularly cooperate with Interpol and Europol. Bilateral cooperation with international partners occurs on the basis of the Budapest Convention and associated Mutual Legal Assistance Treaties (MLATs), which facilitate information sharing amongst signatory states. The UK has been an active participant – and has provided voluntary contributions – in the context of discussions for developing a Second Additional Protocol to the Convention to enhance the speed and efficiency of international evidence sharing; the Protocol will be opened for signature in May 2022. The UK has also provided capacity-building assistance to over 100 partner countries, especially in Eastern Europe, Southeast Asia and Africa.

The Nigerian 2020-2030 National Digital Strategy, which is in line with the African Union Digital Transformation Strategy 2020-2030, emphasises the significance of adopting ‘collaborating approaches’ to fighting cybercrime; it specifically notes that ‘cybersecurity is not a local issue and it requires collaboration with relevant institutions around the globe’. In 2019, the country voted in favour of UNGA resolution 74/247, which established an Ad Hoc Committee to draw up an international convention on cybercrime. The Nigerian position paper prior to the launch of the first substantive session noted the ‘urgent need to define and sanction criminal conduct in cyberspace, improve synergy in trans-national policing capabilities, improve procedural tools and reform/enhance international cooperation, whilst respecting human rights’. In its capacity as a member of ECOWAS, Nigeria has participated in several socialisation-based capacity-building initiatives, including the OCWAR-C project, the GLACY+ workshops and the African Forum on Cybercrime (organised by the African Union).