“63. The law of neutrality is applicable to cyber operations carried out during an international armed conflict, and it protects the populations and the cyber infrastructure in neutral States from the effects of such conflicts. Costa Rica understands the term \u201cneutral State\u201d as referring to any State which is not a party to an ongoing international armed conflict.\n <\/p>\n

64. Parties to an international armed conflict are prohibited from carrying out cyber operations against and from cyber infrastructure located in the territory, and under the exclusive control of, neutral States. In Costa Rica\u2019s perspective, they must also refrain from engaging in cyber operations that are reasonably expected to cause incidental harm to cyber infrastructure situated on the territory of neutral States.\n <\/p>\n

“Cyberoperations carried out in the context of an international armed conflict, or which trigger such a conflict, are subject to the law of neutrality. As such, the States party to an IAC may neither carry out cyberoperations linked to the conflict from installations situated on the territory of a neutral State or under the exclusive control of a neutral State, nor take control of computer systems of the neutral State in order to carry out such operations. The neutral State must prevent any use by belligerent States of ICT infrastructure situated on its territory or under its exclusive control. However, it is not required to prevent belligerent States from using its ICT networks for communication purposes.\n <\/p>\n

“The law of neutrality applies in cyberspace in the context of an international armed conflict on the basis of existing international customary law. According to the law of neutrality, parties to an international armed conflict may not launch wrongful cyber operations from ICT infrastructure located in the territory or under the exclusive control of a neutral State.\n <\/p>\n

“As a matter of principle, Switzerland considers the rights and obligations of neutral countries in international armed conflicts to be applicable to cyberspace as well. If such an international armed conflict arises, a neutral country has a duty to prevent any infringements of its neutrality, such as the use of its territory by one of the conflicting parties. Parties to the conflict are obliged in turn to respect the territorial integrity of the neutral country. Therefore they may not conduct related cyber operations from installations that are either on the territory or under the exclusive control of the neutral country. Parties to the conflict are also prohibited from taking control of a neutral country’s computer systems in order to carry out such operations.\n <\/p>\n

Because of the global cross border nature of cyberspace, there are also limits to the rights and duties of a neutral country in terms of territoriality \u2013 airspace can be closed for certain flying objects, for example, but the same targeted approach cannot be used for data traffic oncthe internet. Another issue is that data are not only transmitted via terrestrial and cable channels but also via satellites located in outer space, which puts them outside the scope of application of the law of neutrality. Such factors must be taken into consideration when it comes to applying the rights and duties of neutral countries in cyberspace.\n <\/p>\n