specific rules, including in the ICT environment.86 In Costa Rica’s view, this means that even if a cyber operation during an armed conflict is not specifically prohibited by a rule of IHL, to be lawful it must nonetheless comply with the principles of military necessity and humanity. 46. The principle of distinction requires that parties to an armed conflict distinguish at all times between civilians and combatants and between civilian objects and military objectives, including in the ICT environment. Cyber operations may only be directed against combatants or military objectives. Cyber operations must not be directed against civilians or civilian objects.87 With respect to cyber infrastructure, the assessment of whether an object qualifies as a military objective must be done at the lowest level practically possible, i.e, at the level of each particular computer, cable, router, or other specific device that can be separated from a network or a system as a whole. 47. The principle of proportionality prohibits parties to armed conflicts from launching a cyberattack against a military objective, which may be expected to cause incidental civilian harm that would be excessive in relation to the concrete and direct military advantage anticipated.88 In Costa Rica’s view, the incidental harm to be taken into consideration includes any incidental loss of functionality of civilian computers, systems or networks. For Costa Rica’s understanding of the notion of loss of functionality, refer to para. 20 of this position. Prohibition of attacks against civilian objects 48. Under IHL, direct attacks against civilian objects are prohibited.89 In Costa Rica’s view, this prohibition also governs the use of cyber means and methods of warfare. 49. Costa Rica defines a cyber-attack under IHL as any conduct initiated in or through cyberspace that is designed or can be reasonably expected to cause injury or death to persons or damage or destruction to objects. For these purposes, Costa Rica understands damage to include the disabling – temporary or permanent, reversible or not – of the targeted computer, system, or network. For the avoidance of doubt, this means that the existence of physical damage to objects or injury or death to persons is not required for an operation to constitute an attack under IHL. Conversely, mere network intrusion and exfiltration of data falls below the threshold of attack under IHL. In Costa Rica’s perspective, encrypting data through ransomware, despite being temporary and reversible, would be considered an attack under IHL and therefore must not be directed against civilian systems. 50. Costa Rica endorses the view that civilian data constitute civilian objects under IHL and must be protected accordingly. Civilian datasets, including medical data, social security data, tax records, corporate and financial data, or electoral lists, are critical components of digitalized societies and play a vital role in the functioning of many aspects of civilian life. Deleting or damaging such data can have severe consequences for government services and private businesses, potentially causing more harm to civilians than the destruction of physical ICRC, ‘The Principles of Humanity and Necessity’ (March 2023). ICRC, ‘The Principle of Distinction’ (March 2023). 88 ICRC, ‘The Principle of Proportionality’ (March 2023). 89 Additional Protocol I, Article 52; ICRC, Customary International Humanitarian Law Study, Rule 7. 86 87 13