that these facilities were used for command and control and thus were in fact military objectives.230 Though this is a fine line, the widespread and wholly indiscriminate nature of this broad cyber attack is inconsistent with this ICTY precedent. Given that the internet is essential to the functioning of Estonian society, from banking and shopping to voting, and that the purpose of the attacks was to terrorize the populace, in an armed conflict these attacks ran afoul of the laws of war. Recognizing this nature of cyber attacks, the DOD has stated that targeting analysis must be conducted for CNAs just as it traditionally has been conducted for attacks using traditional weapons.231 This distinction did not occur in Estonia.
Third, IHL prohibits disproportionate attacks. The law of war places much of the responsibility for collateral damage on a defending force that has failed to properly separate military targets from noncombatants and civilian property.232 The law of proportionality is codified in Protocol I, Article 51 in which “An attack which may be expected to cause incidental loss of civilian life, injury to civilians, damage to civilian objects … which would be excessive in relation to the concrete and direct military advantage anticipated [is to be considered indiscriminate].”233 Implicit in this principle then is the balancing act that occurs, measuring military advantage against the harm to civilians. Invoking the case study, the fact that Estonia did not attack any other armed force signifies that any aggressive act against the state would be inherently disproportionate. However, if an actual armed conflict had been waged, the entirely
230 Final Report to the Prosecutor by the Committee Established to Review the NATO Bombing Campaign Against the Federal Republic of Yugoslavia. The Attack on the RTS (Serbian Radio and TV Station) in Belgrade on 23/4/99. Available at: . Last visited: 06/12/2008.
231 DOD, supra note 33.
233 Protocol I, Art. 54.