Blackbeards of the Twenty-First Century: Holding Cybercriminals Liable under the Alien Tort Statute

In 1997, an enemy state disrupted computer operations at key US military installations, including the Pentagon, the Joint Staff, and the Central Intelligence Agency ("CIA").1 The attack caused large-scale blackouts and shut down emergency phone service in Washington, D.C. and other major cities.2 Or at least it did hypothetically. The damage occurred in Eligible Receiver 97, "the first large-scale, no-warning military field exercise crafted to test the ability of the US to respond to an attack on both [US] military and civilian information infrastructure."3 Conducted by the Joint Chiefs of Staff, Eligible Receiver 97 "inflict[ed] considerable simulated damage" and spotlighted US vulnerability to a new threat: cybercrime."4 Cybercrime is a worldwide phenomenon that involves computer-related attacks and computer network attacks in cyberspace-the "territory" commonly perceived as the Internet-and is unbound by geographical and physical constraints. Satellite phones and battery power make physical requirements, such as a telephone landline and electricity, superfluous. By the same token, the cybercriminal can target anyone in the world. The scope and magnitude of cybercrime's consequences have garnered international attention. Foreign countries and multilateral organizations have taken steps to identify and outlaw certain acts of cybercrime.5 But the US may have taken it one step further. In Sosa v Alvarez-Machain,6 the US Supreme Court recast the federal judiciary as the world's sheriff-at least for established violations of international law. It held that the Men Tort Statute ("ATS") incorporates customary international norms into federal law.7 It also held that citizenship, of either plaintiff or defendant, is irrelevant. Federal courts can hear all claims of international law violations regardless of where they arose. The US has already outlawed cybercrime domestically.8 If cybercrime can be identified as a customary international norm, federal courts will have jurisdiction over all private cybercrime suits brought by plaintiffs of every country against defendants of every country. This Comment explores whether cybercrime constitutes a violation of the law of nations under the ATS. It argues that certain acts of cybercrime may be actionable, but cybercrime as a whole has not yet reached the level of a customary international norm. Part I presents Sosa's approach for recognizing a customary international norm as a private right of action under the ATS. Part II discusses the rising significance of cybercrime and international efforts to thwart it. Part III analogizes cybercrime to one of Sosa's paradigm offenses against the law of nations-piracy-and argues that cyberspace should be viewed as the modern "high seas." This analogy demonstrates why cybercrime is suitable for international recognition, but it also indicates where cybercrime law lacks the requisite specificity. Finally, part IV concludes by presenting other methods of prohibiting violations of international law under federal domestic law and foreshadowing the future international status of cybercrime. I. THE SOSA FRAMEWORK The Alien Tort Statute ("ATS") states that "district courts shall have original jurisdiction of any civil action by an alien for a tort only, committed in violation of the law of nations or a treaty of the United States."9 While the ATS had been dormant since its adoption in the Judiciary Act of 1789, it was recently invoked to combat violations of customary international norms.10 In Sosa v Alvarez-Machain, the Supreme Court provided a framework for identifying actionable claims under the ATS.11 Sosa arose when a group of Mexican nationals abducted Humberto Alvarez-Machain ("Alvarez") from his home in Mexico and took him to the US, where he was arrested for the torture and murder of a US Drug Enforcement Agency agent.12 Alvarez, also a Mexican national, sued his abductors in US federal court.13 However, his suit failed. …