John DOE, also known as Kidane, Appellant v. The FEDERAL DEMOCRATIC REPUBLIC OF ETHIOPIA, Appellee, 851 F.3d 7

KAREN LeCRAFT HENDERSON, Circuit Judge: Plaintiff John Doe — proceeding pseudonymously as “Kidane” — ciaims he was tricked into downloading a computer program. The program allegedly enabled the Federal Democratic Republic of Ethiopia (Ethiopia) to spy on him from abroad. He wants to sue the Republic of Ethiopia. But foreign states are immune from suit unless an exception to the Foreign Sovereign Immunities Act (FSIA) applies. Ki-dane invokes the FSIA’s exception for noncommercial torts. We conclude his reliance is misplaced.

The noncommercial-tort exception abrogates sovereign immunity for a tort occurring entirely in the United States. Kidane, by contrast, alleges a transnational tort. We therefore affirm the district court’s dismissal for lack of subject matter jurisdiction. I. BACKGROUND Now an American citizen, Kidane was born in Ethiopia. He obtained asylum in the United States in the early 1990s and has at all relevant times lived in Silver Spring, Maryland. There, he has remained active in the Ethiopian community and has maintained contacts who work to increase awareness of corruption and human rights issues in Ethiopia.

As alleged in the complaint, in late 2012 or early 2013, Kidane opened an attachment to an e-mail he received from an acquaintance. The e-mail had been forwarded and was allegedly sent originally by or on behalf of Ethiopia. Kidane’s complaint is silent as to whether the individual who sent Kidane the e-mail was located in the United States but the e-mail’s text suggests that individual was located in London. See Am. Compl. Ex. C (“You took your family to London.... ”). Once opened, the attachment allegedly infected Kidane’s computer with a “clandestine ... program! ] known as FinSpy.” Am. Compl. ¶ 4.

FinSpy is “a system for monitoring and gathering information from electronic devices, including computers and mobile phones, without the knowledge of the device’s user.” Id. ¶ 6. It is “sold exclusively to government agencies.” Id. After installation on Kidane’s computer, FinSpy “began ... recording some, if not all, of the activities undertaken by users of the computer,” whether Kidane or his family members. Id. ¶ 5. It then allegedly communicated with a server in Ethiopia. Kidane filed suit against Ethiopia, pressing two claims.

First, Kidane sought relief under the Wiretap Act, 18 U.S.C. §§ 2510 et seq., which prohibits “any person [from] intentionally intercepting] ... any wire, oral, or electronic communication^]” id. § 2511(1). Second, Kidane alleged Ethiopia committed the Maryland common law tort of intrusion upon seclusion. The district court dismissed Kidane’s lawsuit in its entirety. Doe v. Fed. Democratic Republic of Ethiopia, 189 F.Supp.3d 6, 28 (D.D.C. 2016). It first concluded that the relevant Wiretap Act provision could not be enforced via private lawsuit against a foreign government. Id. at 12-15.

It next dismissed Kidane’s state-law claim for lack of subject matter jurisdiction. Id. at 15-28. The district court observed that the FSIA grants all foreign states immunity from suit in American courts, subject to limited enumerated exceptions. Id. at 16. Kidane invoked only one^ — the noncommercial-tort exception. Id. The district court found that exception inapplicable because the “entire tort” did not occur in the United States, as required. Id. at 18-25. II. ANALYSIS On appeal, Kidane challenges both grounds the district court used for dismissal. Each challenge triggers de novo review. Simon v.

Republic of Hungary, 812 F.3d 127, 135 (D.C. Cir. 2016); El Paso Nat. Gas Co. v. United States, 750 F.3d 863, 874 (D.C. Cir. 2014). Unlike the district court, we do not reach the question whether the Wiretap Act authorizes a cause of action against Ethiopia for intercepting Kidane’s communications. We instead conclude that the FSIA withdraws jurisdiction in toto. The FSIA is “the ‘sole basis for obtaining jurisdiction over a foreign state in our courts.’ ” Weinstein v. Islamic Republic of Iran, 831 F.3d 470, 478 (D.C. Cir. 2016) (quoting Argentine Republic v.

Amerada Hess Shipping Corp., 488 U.S. 428, 434, 109 S.Ct. 683, 102 KEd.2d 818 (1989)). Unless an exception applies, “a foreign state shall be immune from the jurisdiction of the courts of the United States.” 28 U.S.C. § 1604. One of those exceptions is the noncommercial-tort exception.

It abrogates immunity from an action involving “personal injury or death, or damage to or loss of property, occurring in the United States and caused by the tortious act or omission of [a] foreign state or of any official or employee of that foreign state while acting within the scope of his office or employment[.]” Id. § 1605(a)(5). The phrase “occurring in the United States”' is no mere surplusage. “ ‘[T]he entire tort’— including not only the injury but also the act precipitating that injury — must occur in the United States.” Jerez v. Republic of Cuba, 775 F.3d 419, 424 (D.C.

Cir. 2014) (quoting Asociacion de Reclamantes v. United Mexican States, 735 F.2d 1517, 1525 (D.C. Cir. 1984)). In Jerez, the plaintiff (Jerez) alleged he was intentionally injected with hepatitis C while imprisoned in Cuba. See id. at 421. He sued Cuba, relying on the noncommercial-tort exception. Id. at 424. We found the exception inapplicable. As we explained, the alleged injection of hepatitis C occurred abroad and we rejected Jerez’s argument that a separate tort occurred each time the virus replicated in his body. Id.

Replication showed only that Jerez suffered an “ongoing injury,” not that the tort’s precipitating act also occurred in the United States. Id. (emphasis omitted). Tsupport his replication theory, Jerez “anal-ogiz[ed] the defendants’ actions to a foreign agent’s delivery into the United States of an anthrax package or a bomb.” Id. That analogy was flawed, we explained, because “the defendants’ infliction of injury ... occurred entirely in Cuba, whereas the infliction of injury by the hypothetical anthrax package or bomb would occur entirely in the United States.” Id.

Kidane argues that Ethiopia’s tort is akin to the anthrax hypothetical. But the 'hypothetical was dictum and, of course, “[bjinding circuit law comes only from the holdings of a prior panel, not from its dicta.” Gersman v. Grp. Health Ass’n, 975 F.2d 886, 897 (D.C. Cir. 1992). And Jerez’s holding hardly helps Kidane. Jerez squarely held that “the entire tort ... must occur in the United States” for the noncommercial-tort exception to apply. 775 F.3d at 424 (emphasis added) (internal quotation marks omitted). Here, at least a portion of Ethiopia’s alleged tort occurred abroad.

Maryland’s intrusion-upon-seclusion tort shows why that is so. The tort covers “[o]ne who intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns, [making the intruder] subject to liability to the other for invasion of his privacy, if the intrusion would be highly offensive to a reasonable person.” Bailer v. Erie Ins. Exch., 344 Md. 515, 687 A.2d 1375, 1380-81 (1997) (emphasis and internal quotation marks omitted) (quoting Restatement (Second) of Torts § 652B (1977)). There is thus no tort without intentional intrusion.

But whether in London, Ethiopia or elsewhere, the tortious intent aimed at Kidane plainly lay abroad and the tortious acts of computer programming likewise occurred abroad. Moreover, Ethiopia’s placement of the FinSpy virus on Kidane’s computer, although completed in the United States when Kidane opened the infected e-mail attachment, began outside the United States. It thus cannot be said that the entire tort occurred in the United"States. The two cases on which Kidane relies—Liu v. Republic of China, 892 F.2d 1419 (9th Cir. 1989), and Letelier v.

Republic of Chile, 488 F.Supp. 665 (D.D.C. 1980)—are easily distinguished. In Liu, two gunmen allegedly acting at a Taiwanese admiral’s direction assassinated a man in California, 892 F.2d at 1421; in Letelier, Chilean government agents allegedly constructed, planted and detonated a car bomb in Washington, D.C., 488 F.Supp. at 665. In both, the courts determined they had jurisdiction under the FSIA’s noncommercial-tort exception to hear the victims’ survivors’ claims against the respective foreign sovereigns. Liu, 892 F.2d at 1425-26, 1431; Letelier, 488 F.Supp. at 673-74.

Both involved actions “occurring in the United States” that were — without reference to any action undertaken abroad — tortious. Ethiopia’s digital espionage is of a different character. Without the software’s initial dispatch or an intent to spy — integral aspects of the final tort which lay solely abroad — Ethiopia could not have intruded upon Kidane’s seclusion under Maryland law. Kidane’s Wiretap Act claim is similarly deficient. The Wiretap Act in pertinent part proscribes “intentional[ ] interceptions]” of “wire, oral, or electronic communication^].” 18 U.S.C. § 2511(l)(a).

But, again, the “intent[ ],” id. and FinSpy’s initial deployment occurred outside the United States. The tort Kidane alleges thus did not occur “entire[ly]” in the United States, Jerez, 775 F.3d at 424 (internal quotation marks omitted); it is a transnational tort over which we lack subject matter jurisdiction. Kidane regards this conclusion as inconsistent with the noncommercial-tort exception’s purpose and legislative history. He argues that, when the Congress codified the exception, it considered — but rejected — the approach of the European Convention on State Immunity.

The European Convention abrogated sovereign immunity for certain torts if the facts underlying the torts occurred in the forum nation and if “the author of the injury or damage was present in that territory at the time.” European Convention on State Immunity art. 11, reprinted in Hearings on H.R. 11,315 Before the Subcomm. on Admin. Law & Governmental Relations of the H. Comm, on the Judiciary, 94th Cong. 39 (1976) (1976 Hearings). Kidane notes the absence of similar language in

section 1605(a)(5). We think Kidane reads too much into the Congress’s silence. As the Supreme Court has explained, the “Congress’ primary purpose in enacting § 1605(a)(5) was to eliminate a foreign state’s immunity for traffic accidents and other torts committed in the United States, for which liability is imposed under domestic tort law.” Amerada Hess Shipping Corp., 488 U.S. at 439-40, 109 S.Ct. 683. It is thus unsurprising that transnational cyberespionage should lie beyond

section 1605(a)(5)’s reach. Kidane also directs us to the FSIA’s commercial activity exception to illuminate

section 1605(a)(5)’s boundaries. The commercial activity exception authorizes claims “based upon a commercial activity carried on in the United States by [a] foreign state[.]” 28 U.S.C. § 1605(a)(2). He observes that the Supreme Court, interpreting this provision, found instructive the “point of contact” between the tort and its victim in determining where the tort occurred. OBB Personenverkehr AG v. Sachs, 577 U.S. -, 136 S.Ct. 390, 397, 193 L.Ed.2d 269 (2015) (internal quotation marks omitted). But Sachs underscores why the commercial activity exception is of limited usefulness here.

There, the American plaintiff purchased a European rail travel pass from a Massachusetts travel agent. Id. at 393. When she used the pass to board the defendant Austrian state-owned railway’s train in Innsbruck, Austria, she fell onto the tracks, where the moving train crushed her legs. Id. She sued, invoking the FSIA’s commercial activity exception. Id. at 394. The Supreme Court concluded, however, that her lawsuit was not “based upon” the domestic sale of the rail pass. Id. at 393.

It noted that “an action is based upon the particular conduct that constitutes the gravamen of the suit.” Id. at 396 (internal quotation marks omitted). It explained that “the conduct constituting the gravamen of [her] suit plainly occurred abroad.” Id. But Sachs interpreted the commercial activity exception. And unlike the commercial activity exception, the noncommercial-tort exception does not ask where the “gravamen” occurred, id.; instead, it asks where the “entire tort” occurred, Asociacion de Reclamantes, 735 F.2d at 1525 (emphasis added).

For the foregoing reasons, we affirm the district court’s dismissal of Kidane’s intrusion-upon-seclusion claim for lack of subject matter jurisdiction. Because the same reasoning applies with equal force to Ki-dane’s Wiretap Act claim, we affirm the dismissal of that claim as well. So ordered. . Because, at this stage, Ethiopia has not disputed the factual basis for our jurisdiction but “challenges only the legal sufficiency of [Ki-dane's] jurisdictional allegations/' we “take [his] factual allegations as true and determine whether they bring the case within” the FSIA's noncommercial-tort exception.

Phoenix Consulting Inc. v. Republic of Angola, 216 F.3d 36, 40 (D.C. Cir. 2000). . The district court reached this issue before addressing subject matter jurisdiction under the FSIA. Although recognizing that ordinarily it must address subject matter jurisdiction first, Doe, 189 F.Supp.3d at 11, it forestalled the jurisdictional inquiry based on Vermont Agency of Natural Resources v. United States ex rel. Stevens, 529 U.S. 765, 120 S.Ct. 1858, 146 L.Ed.2d 836 (2000).

There, the High Court concluded that the statutory question was "logically antecedent” to Vermont's Eleventh Amendment immunity from suit and there existed "no realistic possibility” that answering the statutory question first “expand[ed] the Court’s power beyond the limits that the jurisdictional restriction has imposed.” Id. at 779, 120 S.Ct. 1858 (internal quotation marks omitted). . Ethiopia made several other arguments against the noncommercial-tort exception’s applicability but the district court rejected each. Doe, 189 F.Supp.3d at 17-18, 25-28. We need not address those arguments. .

Even in such circumstances, the FSIA restores sovereign immunity from suits “based upon the exercise or performance or the failure to exercise or perform a discretionary function regardless of whether the discretion [has been] abused’’ and from suits "arising out of malicious prosecution, abuse of process, libel, slander, misrepresentation, deceit, or interference with contract rights[.]” 28 U.S.C. § 1605(a)(5)(A) — (B). . Jerez initially sued Cuba in Florida state court, where he obtained a default judgment. Jerez, 775 F.3d at 421.

His case came to us through his efforts to execute the judgment on certain intellectual property. Id. . As the district court acknowledged, Doe, 189 F.Supp.3d at 24, and as Ethiopia observes, when the State Department Legal Adviser was asked whether there was any inconsistency between the European Convention and the FSIA, he responded that — subject to one discrepancy not relevant here — there generally was not. 1976 Hearings, at 37. .

In so concluding, the Court quoted a letter written by Justice Oliver Wendell Holmes to then-Professor Felix Frankfurter opining that “the 'essentials' of a personal injury narrative will be found at the 'point of contact’ — the place where the boy got his fingers pinched.' " Sachs, 136 S.Ct. at 397. Kidane reads Sachs — particularly its reliance on the "point of contact’’ language — as confirming that “a tort occurs at the place where the injury was inflicted upon the plaintiff.” Appellant's Br. 14. We disagree with his reading. .

We do not reach the applicability of the FSIA provisions governing discretionary functions or torts based upon misrepresentation or deceit. See 28 U.S.C. § 1605(a)(5)(A)-(B); see also supra n.4.