The principle of proportionality, based on the ‘weighing’ of the cost of civilian lives with the military advantage anticipated does not appear explicitly in any IHL treaty.

The linkage between justified ends, means and effects instituted by the principle can be found in AP I article 51 (5) (b), ruling that indiscriminate is an ‘an attack which may be expected to cause incidental loss of civilian life, injury to civilians, damage to civilian objects, or a combination thereof, which would be excessive in relation to the concrete and direct military advantage anticipated’, and also in AP I article 57 (2) (b) which declares that

‘an attack shall be cancelled or suspended if it becomes apparent that the objective is not a military one or is subject to special protection or that the attack may be expected to cause incidental loss of civilian life, injury to civilians, damage to civilian objects, or a combination thereof, which would be excessive in relation to the concrete and direct military advantage anticipated’.

How can a prohibition against disproportionate attacks be applied in computer network attacks?

The majority of international lawyers maintain that the same difficulties arise as with the application of the principle of distinction. Collateral, disproportionate damage and ‘reverberating effects’ are almost ‘guaranteed’ in cyber attacks, given the almost total interconnectivity of modern information networks.

Others, such as Graham, are of a more positive opinion, asserting that cyber weapons

greatly reduce collateral damage relative to that which would result from the use of kinetic weaponry, thus helping to achieve proportionality; distinguish the attacking system (the military objective) from protected places, property, and civilians; and minimize the unnecessary suffering that would be the probable result of a kinetic use of force.

In the same direction, Davidson believes that

‘the use of DCNAs may be the best option to comply with the principles of LOAC, as they mitigate the damage that would have otherwise been inflicted by the use of kinetic weapons. Furthermore, certain attacks deemed unlawful if executed with kinetic weapons because of excessive damage to civilians may be lawful if conducted by way of DCNA’.

The truth might be found somewhere in the middle. On the one hand, neither all civilian and military networks are interconnected, nor all collateral damage can be excluded when computer attacks are used instead of kinetic. On the other, apart from the ‘mainstream’ non-discriminatory hacking methods mentioned above, such as self-replicating viruses or mass-distributed DoS attacks, certain other hacking techniques of surgical accuracy can be used instead, in order to strike with precision and without any disproportionate collateral damage, but these is by no means within the scope of this paper to describe.