destruction of property, as well as those permanently disabling operating systems controlling critical infrastructure, such as an electrical grid or a water and sanitation station. 37. A prohibited threat or use of force must be distinguished from an armed attack. In accordance with Article 51 of the UN Charter and customary international law, an armed attack triggers the right of States to exercise individual or collective self-defense.73 In Costa Rica’s view, to give rise to the right of self-defense, an armed attack must be attributable to a State, in cyberspace as in any other context.74 As noted by the ICJ, armed attacks are the ‘most grave’ forms of use of force.75 For Costa Rica, this assessment is to be carried out on the basis of a comparison between the scale and effects of a cyber operation and those of an operation by conventional weapons that would constitute an armed attack.76 Examples of cyber operations potentially constituting armed attacks are those causing significant loss of life and destruction of critical infrastructure.77 International humanitarian law Applicability of international humanitarian law 38. Costa Rica joins the global consensus of States that international humanitarian law (IHL) is applicable in cyberspace and to cyber operations during armed conflicts. As noted earlier, the International Court of Justice observed that IHL applies to ‘all forms of warfare and to all kinds of weapons’.78 In Costa Rica’s perspective, there is no doubt that this extends to all uses of ICTs in situations of and connected to armed conflicts. 39. Costa Rica is also of the view that affirming the application of IHL to the use of ICTs during armed conflict does not legitimize cyber warfare or encourage the militarization of cyberspace in any way. IHL is a body of law that is restrictive in nature, and therefore it acts as a constraint, not an enabler of conflict. In addition, IHL imposes important limits on the militarization of cyberspace by prohibiting the development of new weapons or other military cyber capabilities that would be inconsistent with IHL, as detailed later in this position (see para. 56). Cyber operations and armed conflicts 40. IHL applies only in situations of armed conflict.79 During peacetime, certain additional measures must be taken to ensure respect for IHL in the event an armed conflict occurs. Those relevant in the ICT context include the duties to disseminate and train IHL, to adopt 73 Nicaragua case (n 11), para. 191; Tallinn Manual 2.0 (n 4), Rule 71, para. 6, at 341. Armed Activities on the Territory of the Congo, Congo, the Democratic Republic of the v Uganda, Judgment, Merits, [2005] ICJ Rep 168, paras 146-147; Legal Consequences of the Construction of a Wall in the Occupied Palestinian Territory, Advisory Opinion, [2004] ICJ Rep 136, para. 139. 75 Nicaragua case (n 11), para. 191. 76 Ibid, para. 195; Tallinn Manual 2.0 (n 4), Rule 71, paras 6-7, at 341. 77 Ibid, para. 8, at 341. 78 Nuclear Weapons case (n 6), para. 86. 79 GGE 2021 Report (n 1), para. 71(f). 74 11

Select target paragraph3