Threat Management, Threat Intelligence, Malware

U.S. citizen sues Ethiopian gov’t for planting spyware

A U.S. citizen is suing the Ethiopian government for planting spyware on his personal computer and for illegal wiretapping.

The Ethiopian-born U.S. citizen using the pseudonym Mr. Kidane filed a lawsuit in federal court accusing the Ethiopian government of infecting his computer with FinSpy malware and for invading his privacy, according to court documents. Kidane is a critic of the Ethiopian government and a supporter of members of the Ethiopian democracy movement.

The case began in 2013 after an investigation conducted by the Electronic Frontier Foundation (EFF) and the University of Toronto's Citizen Lab concluded that the spyware was part of a systemic campaign by the Ethiopian government to spy on perceived opponents.

Lawyers argued Thursday before a U.S. Court of Appeals for the District of Columbia Circuit over whether U.S. courts have jurisdiction to hear a case brought by an American citizen for wiretapping and invasion of his privacy that occurred in his Maryland home. The EFF believes this question is relevant because under the Foreign Sovereign Immunities Act, foreign governments are only liable for torts they commit within the United States.

“Mr. Martinez argued that the location where the harm was inflicted upon Mr. Kidane was in Maryland, where his computer and he were the entire time he was spied upon,” the EFF said in a Feb. 2 report. “The question of whether U.S. courts can provide a remedy to an American who was wiretapped shouldn't turn on where the eavesdropper was sitting, but rather where the actual wiretapping occurred, which in this case was Silver Spring, Md.”

Ethiopia's lawyer argued that their country should be allowed to do anything to Americans, even set off a car bomb, as long as Ethiopia didn't have a human agent in the United States. When one of the judges asked what would happen if Ethiopia mailed a letter bomb into the United States to assassinate an opponent, or hacked an American's self-driving car, causing it to crash, the nation's council said they could not be sued for any of those as well, the EFF said.

This is the first time anyone has sued a foreign government for wiretapping in the United States EFF Senior Staff Attorney Nate Cardozo told SC Media.

"It's also the first time that anyone has sued a foreign government for a "remote controlled" act in the U.S. If Ethiopia's theory wins, it will indeed set a precedent," Cardozo said. "Namely, that foreign governments may commit torts on U.S. soil, so long as they're technically sophisticated enough that no human agent sets foot in the country."

The same way that Defensive cybersecurity is always going to be a step behind the offensive side, so will legal strategies, he said.

"If Ethiopia wins, it will set a quite troubling precedent," Cardozo said. "It will mean that a U.S. Court of Appeals will give more latitude to a foreign government to conduct digital spying operations in the U.S. that it would afford to even the U.S. government. In that eventuality, I hope Congress would step in to correct the court's error."

The privacy advocacy group expects to have a rule on the appeal in the next few months. 

UPDATE: This story has been updated to include comments from EFF Senior Staff Attorney Nate Cardozo.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.