Although it has not passed yet, a new law being proposed in Congress could change the way foreign cyberattack damages are weighed upon in the U.S. court system.
This piece of legislation is called the Homeland and Cyber Threat Act, or the HACT Act. It would allow American citizens and businesses to sue foreign governments for damages — a provision not allowed under the current justice system.
At the center of the debate on this topic is the Foreign Sovereign Immunities Act (FSIA), a federal law that shields governments from civil cases in the United States. There are exceptions to this, especially when a government is acting as a commercial entity, but it also can be sued when accused of terrorist acts. This is where the cyberattack issue comes into play.
According to a recent article in Law360 about the HACT Act, part of the motivation for this proposed legislation stems from claims by the Democratic National Committee that Russia hacked their emails before the 2016 election. They weren’t able to fight this in court with Russia due to the FSIA.
Among the specifics of the act are language that spells out what foreign countries would not be immune from when it comes to cyberattack. This includes unauthorized access to a computer or confidential, electronic stored information. It also includes sharing information through a hack without consent as well as transmitting information, codes or commands in a damaging way to the potential plaintiff.
One game-changer for the introduction of this legislation was an attack on SolarWinds, a U.S. software provider. Hackers, alleged to be from Russia, infiltrated SolarWinds’ access to government entities, including the Department of Homeland Security, as well as private companies.
Although it has bipartisan support, there are some legal issues that need to be weighed carefully before this is accepted into law. The tension between the government’s authority and the private sector is one such consideration. At what point does a business lose control to act in its own best interests against a cyberattack?
It also opens up the U.S. itself to similar claims, as it’s entirely possible that some crippling cyberattacks could stem from this country and be sued by others because of the precedent this sets.
As experts on sovereign law, we are watching this particular piece of legislation closely in order to see how it may impact the international business world. If you have any questions about this proposed law, or about any international business matters that may affect your business, feel free to contact us at 305-503-5930 or [email protected]. You can also find out more about Ehrenstein|Sager law firm on our website.