as well as the power to regulate the conduct of certain persons and events abroad. 31 Sovereign rights also have corollary duties, in particular, the obligation of a State to respect other States’ sovereign rights and protect them within its territory.32 19. Sovereignty also applies to cyberspace, including its physical and non-physical components. After all, in the digital age, a State’s sovereign powers over its territory and other objects or subjects are increasingly exercised through and dependent on the use of ICTs. In Costa Rica’s view, sovereignty is also a self-standing right accompanied by a binding international legal obligation33 that can be breached by both cyber and noncyber activities.34 20. Such breaches may occur when cyber operations cause physical damage35 or loss of functionality of cyber infrastructure located in the victim State, regardless of ownership.36 Examples range from personal computers to programmable logic controllers or industrial computers that control energy, water, and sanitation facilities. For Costa Rica, a loss of functionality of these devices may occur in two ways. First, when the cyber operation attributable to another State entails the need to repair or replace physical components of the targeted cyber infrastructure or compromises physical equipment reliant on such infrastructure.37 Second, loss of functionality may occur if the operating system or database upon which the targeted cyber infrastructure relies stops functioning as intended, as may be the case, for instance, as a result of ransomware.38 21. Breaches of sovereignty may also occur when a State engages in cyber operations that constitute a usurpation of inherently governmental functions, irrespective of any physical or non-physical effects on hardware or software located in the territory of the victim State. 39 Examples of cyber operations amounting to this type of violation are those interfering with a State’s democratic processes, such as elections, responses to a national security or health emergency, such as the COVID-19 pandemic, and its choice of foreign policy. 22. It is important to note that it is often difficult to technically distinguish between a mere datagathering operation from an operation penetrating a governmental system in order to interfere with a State’s sovereign functions. Real-world examples show that, once a piece of malware successfully enters a system or network, it remains a latent threat to its integrity. This may damage software or hardware and thus interfere with the conduct of State affairs. Furthermore, surveillance operations may be carried out in ways that lead to breaches of State 31 S.S. 'Lotus', France v Turkey, Judgment No 9, PCIJ Series A No 10, ICGJ 248 (PCIJ 1927), (1935), paras 38-45. 32 Island of Palmas Case (or Miangas), United States v Netherlands, Award, 4 April 1928, II RIAA 829 (1928), ICGJ 392 (PCA 1928), at 839. 33 Nicaragua case (n 11), paras 15 and 292. 34 Tallinn Manual 2.0 (n 4), Rule 4, at 17ff. 35 Ibid, at 18, para. 5. 36 Ibid, at 21, para. 13. 37 Ibid. 38 Ibid, at 21, paras 13-14. 39 Ibid, at 21-27, paras 15-32. 6