destruction of property, as well as those permanently disabling operating systems controlling
critical infrastructure, such as an electrical grid or a water and sanitation station.
37. A prohibited threat or use of force must be distinguished from an armed attack. In
accordance with Article 51 of the UN Charter and customary international law, an armed attack
triggers the right of States to exercise individual or collective self-defense.73 In Costa
Rica’s view, to give rise to the right of self-defense, an armed attack must be attributable to a
State, in cyberspace as in any other context.74 As noted by the ICJ, armed attacks are the
‘most grave’ forms of use of force.75 For Costa Rica, this assessment is to be carried out on
the basis of a comparison between the scale and effects of a cyber operation and those of
an operation by conventional weapons that would constitute an armed attack.76 Examples of
cyber operations potentially constituting armed attacks are those causing significant loss of
life and destruction of critical infrastructure.77
International humanitarian law
Applicability of international humanitarian law
38. Costa Rica joins the global consensus of States that international humanitarian law (IHL)
is applicable in cyberspace and to cyber operations during armed conflicts. As noted
earlier, the International Court of Justice observed that IHL applies to ‘all forms of warfare and
to all kinds of weapons’.78 In Costa Rica’s perspective, there is no doubt that this extends to
all uses of ICTs in situations of and connected to armed conflicts.
39. Costa Rica is also of the view that affirming the application of IHL to the use of ICTs during
armed conflict does not legitimize cyber warfare or encourage the militarization of
cyberspace in any way. IHL is a body of law that is restrictive in nature, and therefore it acts
as a constraint, not an enabler of conflict. In addition, IHL imposes important limits on the
militarization of cyberspace by prohibiting the development of new weapons or other military
cyber capabilities that would be inconsistent with IHL, as detailed later in this position (see
para. 56).
Cyber operations and armed conflicts
40. IHL applies only in situations of armed conflict.79 During peacetime, certain additional
measures must be taken to ensure respect for IHL in the event an armed conflict occurs.
Those relevant in the ICT context include the duties to disseminate and train IHL, to adopt
73
Nicaragua case (n 11), para. 191; Tallinn Manual 2.0 (n 4), Rule 71, para. 6, at 341.
Armed Activities on the Territory of the Congo, Congo, the Democratic Republic of the v Uganda,
Judgment, Merits, [2005] ICJ Rep 168, paras 146-147; Legal Consequences of the Construction of a Wall
in the Occupied Palestinian Territory, Advisory Opinion, [2004] ICJ Rep 136, para. 139.
75
Nicaragua case (n 11), para. 191.
76
Ibid, para. 195; Tallinn Manual 2.0 (n 4), Rule 71, paras 6-7, at 341.
77
Ibid, para. 8, at 341.
78
Nuclear Weapons case (n 6), para. 86.
79
GGE 2021 Report (n 1), para. 71(f).
74
11