objects. Before the digital revolution, such data was stored in the form of paper files that were protected under IHL. Therefore, in Costa Rica’s view, the protection of civilian objects under IHL extends to civilian data. Prohibition of indiscriminate attacks 51. Under IHL, indiscriminate attacks, i.e., those of a nature to strike military objectives and civilians or civilian objects without distinction, are prohibited, including when carried out by cyber operations.90 For example, releasing a computer virus that is designed to spread and cause harmful effects uncontrollably constitutes a prohibited indiscriminate attack, because such capability would be unable to distinguish between military and civilian systems as is required under IHL. Precautions 52. States must put in place effective measures to prevent or mitigate the risk of civilian harm posed by the use of military cyber capabilities (“active precautions”). In the conduct of cyber operations, IHL requires that parties to an armed conflict take constant care to spare the civilian population, individual civilians, and civilian objects.91 To avoid unintended consequences, cyber operators must have a thorough understanding of the degree to which the target networks and systems are interconnected and of the risks of unintended spread of malware or other cyber operations, including any indirect effects. In Costa Rica’s view, this must include a consideration of the differentiated impacts that cyber operations may have on women, girls, members of the LGBTQ+ community and other vulnerable groups. At every stage, States must involve expertise from a wide range of sources and ensure that this is put into straightforward language for the relevant decision makers. 53. In relation to those cyber operations that qualify as attacks, parties to an armed conflict must, among other measures, take all feasible precautions to verify that the objectives to be attacked qualify as military objectives, as well as to avoid or at least minimize incidental civilian harm, including harm caused by indirect or reverberating effects, from such attacks.92 A variety of technical measures can be considered, such as system-fencing, geo-fencing, or kill switches. Furthermore, if a party to an armed conflict determines that a planned cyber operation would shut down enemy command systems, but also incidentally disrupt civilian public services like water supply, it must suspend the attack until it can satisfy itself that the attack would be consistent with the applicable rules of IHL, including the prohibition of disproportionate attacks. 90 Additional Protocol I, Article 51(4); ICRC, Customary International Humanitarian Law Study, Rules 1112. Indiscriminate attacks are those: (a) which are not directed at a specific military objective; (b) which employ a method or means of combat which cannot be directed at a specific military objective; or (c) which employ a method or means of combat the effects of which cannot be limited as required by international humanitarian law; and consequently, in each such case, are of a nature to strike military objectives and civilians or civilian objects without distinction. 91 Additional Protocol I, Article 57(1); ICRC, Customary International Humanitarian Law Study, Rule 15. 92 Additional Protocol I, Article 57(2) and (3); ICRC, Customary International Humanitarian Law Study, Rules 15–21. 14