Appeals court rules Americans have no legal recourse if hacked by foreign governments
Put aside the matter of Russian interference in our presidential election to instead consider this scenario: If Vladimir Putin ordered his government-employed hackers to plant spyware on your personal computer – stealing all your data and even recording your Skype calls – you would have no access to any legal remedy in the U.S. court system.
Preposterous, you say?
That’s the law, according to the United States Court of Appeals for the District of Columbia Circuit, which yesterday upheld a lower court decision denying even a day in court to an American citizen who moved here from Ethiopia 30 years ago and was victimized by that country’s government in the exact fashion described above.
The Electronic Frontier Foundation, which is representing the victim who goes the pseudonym Mr. Kidane, believes the decision is indeed preposterous. From a blog post by EFF senior staff attorney Nate Cardozo:
In a stunningly dangerous decision today, the D.C. Circuit ruled that Mr. Kidane had no legal remedy against Ethiopia for this attack, despite the fact that he was wiretapped at home in Maryland. The court held that, because the Ethiopian government hatched its plan in Ethiopia and its agents launched the attack that occurred in Maryland from outside the U.S., a law called the Foreign Sovereign Immunities Act (FSIA) prevented U.S. courts from even hearing the case.
The decision is extremely dangerous for cybersecurity. Under it, you have no recourse under law if a foreign government that hacks into your car and drives it off the road, targets you for a drone strike, or even sends a virus to your pacemaker, as long as the government planned the attack on foreign soil. It flies in the face of the idea that Americans should always be safe in their homes, and that safety should continue even if they speak out against foreign government activity abroad.
You can find some of those hypotheticals unlikely yet still find alarming the idea that Mr. Kidane could be attacked in his home this way – likely in response to his advocating for political reforms in Ethiopia. FSIA was passed by Congress in 1976 and signed into law by President Gerald Ford. Needless to say, none of those political actors envisioned at the time anything approaching this level of cyber attack being directed at individual Americans.
Nevertheless, the appeals court held that this outcome is what those lawmakers intended. You can read their decision here.
EFF is considering its next legal move.
As for today’s Congress and President Trump: Bitterly divided though they may be on so many issues, they should have little difficulty coming together to remedy this outrageous unintended consequence of a 40-year-old law.