Sovereign Immunity Archives - Columbia Law Review

Introduction Foreign state actors are increasingly using malware to target U.S. nationals.[footnote]“Malware” is short for “malicious software” and is used to “disrupt a computer’s normal operations, gather sensitive information, or gain access to private computer systems.” What Is Malware?, Univ. of Cent. Ark., https://uca.edu/it/knowledgebase/what-is-malware [https://perma.cc/P2MY-HH4L] (last visited Nov. 1, 2019). Malware is an umbrella term and can be used to refer to “computer viruses, worms, trojan horses, spyware, or adware.” Id.[/footnote] In 2016, the U.S. court system saw its first attempt to sue a foreign state for a cyberattack when an Ethiopian asylee and political dissident—going by the pseudonym “Kidane”—sued Ethiopia for installing and using spyware to monitor his online activity.[footnote]Doe v. Federal Democratic Republic of Ethiopia ( Doe I ), 189 F. Supp. 3d 6, 8–11 (D.D.C. 2016), aff’d, 851 F.3d 7 (D.C. Cir. 2017). “Spyware” grants a hacker the ability to “capture information like Web browsing habits, e-mail messages, usernames and passwords, and credit card information.” Spyware, TechTerms, https://techterms.com/definition/spyware [https://perma.cc/538L-WCVC] (last visited Nov. 2, 2019). Hackers infect their victims’ computers or phones with spyware either by sending it through email attachment or by attaching it to the installation of another program. Id.[/footnote] Kidane claimed jurisdiction under the noncommercial tort exception to the Foreign Sovereign Immunities Act (FSIA).[footnote] Doe I , 189 F. Supp. 3d at 16.[/footnote] The D.C. Circuit rejected this argument, noting that a tort must occur entirely in the United States for the noncommercial tort exception to apply.[footnote]See Doe v. Federal Democratic Republic of Ethiopia ( Doe II ), 851 F.3d 7, 10 (D.C. Cir. 2017) (citing Jerez v. Republic of Cuba, 775 F.3d 419, 424 (D.C. Cir. 2014)).[/footnote] Therefore, because the spyware infecting Kidane’s devices had been emailed to Kidane by somebody outside the United States, the D.C. Circuit deemed that the tort did not entirely occur in the United States.[footnote]See id. at 8, 10 (noting that the person who sent the email likely did so from London).[/footnote] Despite receiving heavy criticism,[footnote]See, e.g., Recent Case, Doe v. Federal Democratic Republic of Ethiopia, 851 F.3d 7 (D.C. Cir. 2017), 131 Harv. L. Rev. 1179, 1184–85 (2018) (“The court’s analysis of the acts that make up the tort has . . . problems.”).[/footnote] the D.C. Circuit’s narrow approach has now been adopted within two additional circuits.[footnote]See DNC v. Russian Federation, 392 F. Supp. 3d 410, 428 (S.D.N.Y. 2019); Broidy Cap. Mgmt., LLC v. Qatar, No. CV 18-2421-JFW(Ex), 2018 WL 6074570, at *5 (C.D. Cal. Aug. 8, 2018).[/footnote] Doe v. Ethiopia raises a troubling question: What happens if a foreign state takes it one step further? What if, instead of simply spying on a U.S. national, a foreign state uses malware to cause that national’s self-driving car to crash?[footnote]See Saheli Roy Choudhury, Malicious Use of A.I. Could Turn Self-Driving Cars and Drones into Weapons, Top Researchers Warn, CNBC (Feb. 21, 2018), https://www.cnbc.com/2018/02/21/malicious-use-of-ai-by-hackers-could-pose-security-risksthreats.html [https://perma.cc/C5SD-ZVTZ] (“Self-driving cars . . . could be tricked into misinterpreting a stop sign that might cause road accidents . . . .”).[/footnote] To cripple the computer system of the hospital where that national is admitted?[footnote]See Alabama Hospital System Halts Admissions amid Malware Attack, Ala. Pub. Radio (Oct. 1, 2019), https://www.apr.org/post/alabama-hospital-system-halts-admissions-amid-malware-attack [https://perma.cc/PJC6-3M5B].[/footnote] To remotely switch off that national’s insulin pump or pacemaker?[footnote]See Olivia Tambini, Life-Saving Pacemakers Could Be Hacked with Malware, TechRadar (Aug. 10, 2018), https://www.techradar.com/news/life-saving-pacemakers-could-be-hacked-with-malware [https://perma.cc/T5Q5-R8TS] (discussing a demonstration where researchers showed that they could “remotely switch[] off an insulin pump” and “tak[e] control of a pacemaker by hacking the program doctors use to monitor a patient’s device”).[/footnote] Moreover, what if a foreign state uses information it obtained with spyware to track down and directly kill a U.S. national?[footnote]Cf. David D. Kirkpatrick, Israeli Software Helped Saudis Spy on Khashoggi, Lawsuit Says, N.Y. Times (Dec. 2, 2018), https://www.nytimes.com/2018/12/02/world/middleeast/saudi-khashoggi-spyware-israel.html (on file with the Columbia Law Review ). Saudi Crown Prince Mohammed bin Salman ordered Jamal Khashoggi, a Saudi national and dissident, to be killed in October 2018. Shane Harris, Greg Miller & Josh Dawsey, CIA Concludes Saudi Crown Prince Ordered Jamal Khashoggi’s Assassination, Wash. Post (Nov. 16, 2018), https://www.washingtonpost.com/world/national-security/cia-concludes-saudi-crownprince-ordered-jamal-khashoggis-assassination/2018/11/16/98c89fe6-e9b2-11e8a9399469f1166f9d_story.html (on file with the Columbia Law Review ).[/footnote] The growth of automated and autonomous technologies presents foreign-state actors nowadays with a myriad of opportunities to harm political rivals and dissidents mostly, if not entirely, from abroad. In the aftermath of Doe v. Ethiopia , concerns arose questioning whether a U.S. national harmed by a state-sponsored cyberattack could ever obtain any redress against the sponsoring state. Nate Cardozo, Kidane’s attorney, went so far as to issue a statement saying that “[u]nder [ Doe v. Ethiopia ], you have no recourse under law if a foreign government . . . targets you for a drone strike . . . as long as the government planned the attack on foreign soil.”[footnote]Nate Cardozo, D.C. Circuit Court Issues Dangerous Decision for Cybersecurity: Ethiopia Is Free to Spy on Americans in Their Own Homes, Elec. Frontier Found. (Mar. 14, 2017), https://www.eff.org/deeplinks/2017/03/dc-circuit-court-issues-dangerous-decision-cybersecurity-ethiopia-free-spy [https://perma.cc/KL5C-CGS6].[/footnote] Consequently, some have pushed to adopt a cyberattack exception to the FSIA,[footnote]See, e.g., Paige C. Anderson, Note, Cyber Attack Exception to the Foreign Sovereign Immunities Act, 102 Cornell L. Rev. 1087, 1102–03 (2017); Matthew A. Powell, Comment, A Call to Congress: The Urgent Need for Cyberattack Amendments to the Foreign Sovereign Immunities Act, J.L. & Cyber Warfare, Fall 2018, at 117, 144–47; Sam Kleiner & Lee Wolosky, Time for a Cyber-Attack Exception to the Foreign Sovereign Immunities Act, Just Sec. (Aug. 14, 2019), https://www.justsecurity.org/65809/time-for-a-cyber-attack-exception-to-the-foreign-sovereign-immunities-act [https://perma.cc/7E6E-3ETQ].[/footnote] while others have urged for courts to adopt a more lenient approach to the noncommercial tort exception.[footnote]See, e.g., Samantha N. Sergent, Note, Extinguishing the Firewall: Addressing the Jurisdictional Challenges to Bringing Cyber Tort Suits Against Foreign Sovereigns, 72 Vand. L. Rev. 391, 413–16 (2019).[/footnote] This Note argues, however, that there is already an existing alternative FSIA exception through which many future U.S. victims of malicious, state-sponsored cyberattacks can obtain jurisdiction over foreign-state sponsors: the Justice Against Sponsors of Terrorism Act (JASTA).[footnote]Justice Against Sponsors of Terrorism Act, Pub. L. No. 114-222, 130 Stat. 852 (2016) (codified at 18 U.S.C. § 2333 (2018); 28 U.S.C. § 1605B (2018)).[/footnote] Before 2016, U.S. victims of terrorism could sue a state responsible for the attack only if the state had been “designated as a state sponsor of terrorism.”[footnote]28 U.S.C. § 1605A(a)(2)(A)(i)(I).[/footnote] But in 2016, Congress passed JASTA, which expanded the FSIA to allow U.S. nationals to sue any foreign state that physically injured them or their property through “an act of international terrorism in the United States; and a tortious act . . . regardless where [it] occurred.”[footnote]Id. § 1605B(b).[/footnote] Accordingly, this Note argues that many future instances of state-sponsored cyberattacks can be characterized within the JASTA exception’s framework: A foreign state commits a tortious act of infecting a U.S. national’s device with malware, resulting in a separate act of terrorism that physically harms said national or their property on U.S. soil. Part I overviews the FSIA and its exceptions, including the noncomercial tort exception, the terrorism exception, and the JASTA exception. Part II demonstrates why the noncommercial tort exception and other pre-JASTA FSIA exceptions, as well as the proposed cyberattack exception, provide inadequate solutions for U.S. victims of state-sponsored cyberattacks. Part III then offers the JASTA exception as a practical, already-existing mechanism through which U.S. nationals harmed by state-sponsored cyberattacks could potentially obtain jurisdiction over the foreign state responsible for the attack, and further addresses arguments for why courts may still wish to refrain from using JASTA as a means to sue a foreign state.