The D.C. Circuit’s Recent Decision Reinforces the Urgent Need for a Cyberattack Exception to the FSIA

On March 14, 2017, the D.C. Circuit affirmed the district court’s dismissal of a lawsuit against Ethiopia that arose out of an alleged hacking of a computer in the United States.  See Doe v. The Federal Democratic Republic of Ethiopia, — F.3d —, 2017 WL 971831 (D.C. Cir., Mar. 14, 2017, No. 16-7081). You can read the opinion here

The D.C. Circuit’s opinion makes it clear that the FSIA’s tort exception is wholly inadequate as a means to assert jurisdiction over a foreign state in a cyberattack case.  As the D.C. Circuit correctly held, the tort exception is inapplicable in such cases because of the situs requirement: “The tort [the plaintiff] alleges . . . did not occur entirely in the United States; it is a transnational tort over which we lack subject matter jurisdiction.”  Doe, 2017 WL 971831, at *3, citations, quotations and brackets omitted. The D.C. Circuit stated that Congress’s “primary purpose in enacting § 1605(a)(5) was to eliminate a foreign state’s immunity for traffic accidents and other torts committed in the United States,” and that “[i]t is thus unsurprising that transnational cyberespionage should lie beyond section 1605(a)(5)’s reach.”  Ibid., citation and quotations omitted.

The D.C. Circuit’s holding – that the tort exception’s situs requirement bars a claim arising out of a cyberattack originating overseas – corresponds exactly with the point that I made in my prior post. It is the reason why commentators who argue that the tort exception is sufficient to address the growing cyberattack problem are simply wrong.

Sovereign immunity was born centuries ago, and it underwent an important evolution in the 20th century to reflect a changing world. The FSIA now needs to catch up to the modern realities of the Internet Age. Given the prevalence of computer hacking by foreign states, and the resulting harm to American individuals and companies, a new cyberattack exception to the FSIA is urgently needed. However, as I previously explained, such an exception will only work if it has teeth – such as, for example, the ability to collect on judgments against foreign states from the state’s instrumentalities and agencies, even if such entities were not involved in the cyberattack at issue.  Cf. 28 U.S.C. § 1610(g)(1)(A)-(E). Otherwise, a new exception will do little to stem the rising tide of cyberattacks by foreign sovereigns in the United States.

The Tort Exception’s Situs Requirement

The FSIA’s tort exception requires an action “in which money damages are sought against a foreign state for personal injury or death, or damage to or loss of property, occurring in the United States . . . .”  28 U.S.C. § 1605(a)(5).  As exemplified by a recent decision from the United States District Court for the District of Puerto Rico, courts have long held that jurisdiction lies under the tort exception only if the entire tort occurred within the United States.  See Fernandez v. Spain, CIV. 13-1911 PG, 2014 WL 1807069, at *2 (D.P.R. May 7, 2014); see also, e.g., Argentine Republic v. Amerada Hess Shipping Corp., 488 U.S. 428, 441 (1989); In re Terrorist Attacks on September 11, 2001, 714 F.3d 109, 116 (2d Cir. 2013); O’Bryan v. Holy See, 556 F.3d 361, 382 (6th Cir. 2009); Cabiri v. Gov’t of Republic of Ghana, 165 F.3d 193, 200 n.3 (2d Cir. 1999); Wolf v. Fed. Republic of Germany,95 F.3d 536, 542 (7th Cir. 1996); Jones v. Petty-Ray Geophysical Geosource, Inc., 954 F.2d 1061, 1065 (5th Cir. 1992); Asociacion de Reclamantes v. United Mexican States, 735 F.2d 1517, 1524-25 (D.C. Cir. 1984); Abrams v. Societe Nationale des Chemins de Fer Francais, 175 F. Supp. 2d 423, 431 (E.D.N.Y. 2001), vacated on other grounds by 332 F.3d 173 (2d Cir. 2003), cert. granted and vacated, 542 U.S. 901 (2004), aff’d 389 F.3d 61 (2d Cir. 2004); Sampson v. Fed. Republic of Germany, 975 F. Supp. 1108, 1118 (N.D. Ill. 1997); S. Seafood Co. v. Holt Cargo Sys., Inc., No. Civ.A.96-5217, 1997 WL 539763, at *7 (E.D. Pa. Aug. 11, 1997); Cabiri v. Gov’t of Republic of Ghana, 981 F. Supp. 129, 132 (E.D.N.Y. 1997), aff’d in part and rev’d on other grounds in 165 F.3d 193 (2d Cir. 1999); Hirsh v. State of Israel, 962 F. Supp. 377, 383-84 (S.D.N.Y. 1997); Rein v. Rein, No. 95 Civ. 4030 (SHS), 1996 WL 273993, at *3 (S.D.N.Y. May 23, 1996); Coleman v. Alcolac, Inc., 888 F. Supp. 1388, 1403 (S.D. Tex. 1995); Smith v. Socialist People’s Libyan Arab Jamahiriya, 886 F. Supp. 306, 313 (E.D.N.Y. 1995); El-Fadl v. Cent. Bank of Jordan, No. Civ.A. 93-1895 RMU, 1994 WL 1656111, at *4 (D.D.C. Nov. 9, 1994); Velasquez v. Gen. Consulate of Mexico, No. C-92-3745 CFL, 1993 WL 69493, at *3 (N.D. Cal. Mar. 4, 1993); Intercont’l Dictionary Series v. De Gruyter, 822 F. Supp. 662, 677 (C.D. Cal. 1993), disapproved on other grounds in Sun v. Taiwan, 201 F.3d 110 (9th Cir. 2000); Denegri v. Republic of Chile, Civ. A. No. 86-3085, 1992 WL 91914, at *2 (D.D.C. Apr. 6, 1992); Antares Aircraft L.P. v. Fed. Republic of Nigeria, No. 89 Civ. 6513(JSM), 1991 WL 29287, at *4 (S.D.N.Y. Mar. 1, 1991); Polanco v. Dominican Republic, No. 90 Civ. 7089 (WK),1991 WL 146306, at *2 (S.D.N.Y. July 22, 1991); Fickling v. Commw. of Australia, 775 F. Supp. 66, 72 (E.D.N.Y. 1991); Von Dardel v. Union of Soviet Socialist Republics, 736 F. Supp. 1, 7-8 (D.D.C. 1990); Goquiolay v. Philippines Nat’l Bank, No. 90 CIV. 893 (CSH), 1990 WL 144118, at *3 (S.D.N.Y. Sept. 28, 1990); Bennett v. Stephens, CIV. A. No. 88-2610 (RCL), 1989 WL 17751, at *4 (D.D.C. Feb. 23, 1989); Kline v. Kaneko, 685 F. Supp. 386, 391 (S.D.N.Y. 1988); Four Corners Helicopters, Inc. v. Turbomeca S.A., 677 F. Supp. 1096, 1102 (D. Colo. 1988); English v. Thorne, 676 F. Supp. 761, 764 (S.D. Miss. 1987); Ledgerwood v. State of Iran, 617 F. Supp. 311, 314 (D.D.C. 1985); Kline v. Republic of El Salvador, 603 F. Supp. 1313, 1315-16 (D.D.C. 1985); Evans v. Petroleo, Civil Action No. H-83-91, 1984 WL 1887, at *1 (S.D. Tex. Aug. 2, 1984); In re Sedco, Inc., 543 F. Supp. 561, 567 (S.D. Tex. 1982); cf. H.R. Rep. No. 1487, at 21 (1976).

The tort exception’s situs requirement is a critical limitation on jurisdiction over foreign torts under the FSIA.  In light of the recognized importance of such limitations in international law (cf. Kiobel v. Royal Dutch Petroleum Co., — U.S. —, 133 S. Ct. 1659, 1669 (2013)), it should continue to be strongly enforced by courts in the United States.