KAREN LECRAFT HENDERSON, Circuit Judge.
Plaintiff John Doe—proceeding pseudonymously as "Kidane"—claims he was tricked into downloading a computer program. The program allegedly enabled the Federal Democratic Republic of Ethiopia (Ethiopia) to spy on him from abroad. He wants to sue the Republic of Ethiopia. But foreign states are immune from suit unless an exception to the Foreign Sovereign Immunities Act (FSIA) applies. Kidane invokes the FSIA's exception for noncommercial torts. We conclude his reliance is misplaced. The noncommercial-tort exception abrogates sovereign immunity for a tort occurring entirely in the United States. Kidane, by contrast, alleges a transnational tort. We therefore affirm the district court's dismissal for lack of subject matter jurisdiction.
Now an American citizen, Kidane was born in Ethiopia.
As alleged in the complaint, in late 2012 or early 2013, Kidane opened an attachment to an e-mail he received from an acquaintance. The e-mail had been forwarded and was allegedly sent originally by or on behalf of Ethiopia. Kidane's complaint is silent as to whether the individual who sent Kidane the e-mail was located in the United States but the e-mail's text suggests that individual was located in London. See Am. Compl. Ex. C ("You took your family to London . . . ."). Once opened, the attachment allegedly infected Kidane's computer with a "clandestine . . . program known as FinSpy." Am. Compl. ¶ 4. FinSpy is "a system for monitoring and gathering information from electronic devices, including computers and mobile phones, without the knowledge of the device's user." Id. ¶ 6. It is "sold exclusively to government agencies." Id. After installation on Kidane's computer, FinSpy "began . . . recording some, if not all, of the activities undertaken by users of the computer," whether Kidane or his family members. Id. ¶ 5. It then allegedly communicated with a server in Ethiopia.
Kidane filed suit against Ethiopia, pressing two claims. First, Kidane sought relief under the Wiretap Act, 18 U.S.C. §§ 2510 et seq., which prohibits "any person [from] intentionally intercept[ing] . . . any wire, oral, or electronic communication[,]" id. § 2511(1). Second, Kidane alleged Ethiopia committed the Maryland common law tort of intrusion upon seclusion.
The district court dismissed Kidane's lawsuit in its entirety. Doe v. Fed. Democratic Republic of Ethiopia, 189 F.Supp.3d 6, 28 (D.D.C. 2016). It first concluded that the relevant Wiretap Act provision could not be enforced via private lawsuit against a foreign government.
On appeal, Kidane challenges both grounds the district court used for dismissal. Each challenge triggers de novo review. Simon v. Republic of Hungary, 812 F.3d 127, 135 (D.C. Cir. 2016); El Paso Nat. Gas Co. v. United States, 750 F.3d 863, 874 (D.C. Cir. 2014). Unlike the district court, we do not reach the question whether the Wiretap Act authorizes a cause of action against Ethiopia for intercepting Kidane's communications. We instead conclude that the FSIA withdraws jurisdiction in toto.
The FSIA is "the `sole basis for obtaining jurisdiction over a foreign state in our courts.'" Weinstein v. Islamic Republic of Iran, 831 F.3d 470, 478 (D.C. Cir. 2016) (quoting Argentine Republic v. Amerada Hess Shipping Corp., 488 U.S. 428, 434 (1989)). Unless an exception applies, "a foreign state shall be immune from the jurisdiction of the courts of the United States." 28 U.S.C. § 1604. One of those exceptions is the noncommercial-tort exception. It abrogates immunity from an action involving "personal injury or death, or damage to or loss of property, occurring in the United States and caused by the tortious act or omission of [a] foreign state or of any official or employee of that foreign state while acting within the scope of his office or employment[.]" Id. § 1605(a)(5).
In Jerez, the plaintiff (Jerez) alleged he was intentionally injected with hepatitis C while imprisoned in Cuba. See id. at 421. He sued Cuba, relying on the noncommercial-tort exception. Id. at 424.
Kidane argues that Ethiopia's tort is akin to the anthrax hypothetical. But the hypothetical was dictum and, of course, "[b]inding circuit law comes only from the holdings of a prior panel, not from its dicta." Gersman v. Grp. Health Ass'n, 975 F.2d 886, 897 (D.C. Cir. 1992). And Jerez's holding hardly helps Kidane. Jerez squarely held that "the entire tort . . . must occur in the United States" for the noncommercial-tort exception to apply. 775 F.3d at 424 (emphasis added) (internal quotation marks omitted). Here, at least a portion of Ethiopia's alleged tort occurred abroad.
Maryland's intrusion-upon-seclusion tort shows why that is so. The tort covers "[o]ne who intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns, [making the intruder] subject to liability to the other for invasion of his privacy, if the intrusion would be highly offensive to a reasonable person." Bailer v. Erie Ins. Exch., 687 A.2d 1375, 1380-81 (Md. 1997) (emphasis and internal quotation marks omitted) (quoting RESTATEMENT (SECOND) OF TORTS § 652B (1977)). There is thus no tort without intentional intrusion. But whether in London, Ethiopia or elsewhere, the tortious intent aimed at Kidane plainly lay abroad and the tortious acts of computer programming likewise occurred abroad. Moreover, Ethiopia's placement of the FinSpy virus on Kidane's computer, although completed in the United States when Kidane opened the infected e-mail attachment, began outside the United States. It thus cannot be said that the entire tort occurred in the United States.
The two cases on which Kidane relies—Liu v. Republic of China, 892 F.2d 1419 (9th Cir. 1989), and Letelier v. Republic of Chile, 488 F.Supp. 665 (D.D.C. 1980)—are easily distinguished. In Liu, two gunmen allegedly acting at a Taiwanese admiral's direction assassinated a man in California, 892 F.2d at 1421; in Letelier, Chilean government agents allegedly constructed, planted and detonated a car bomb in Washington, D.C., 488 F. Supp. at 665. In both, the courts determined they had jurisdiction under the FSIA's noncommercial-tort exception to hear the victims' survivors' claims against the respective foreign sovereigns. Liu, 892 F.2d at 1425-26, 1431; Letelier, 488 F. Supp. at 673-74. Both involved actions "occurring in the United States" that were—without reference to any action undertaken abroad— tortious.
Ethiopia's digital espionage is of a different character. Without the software's initial dispatch or an intent to spy— integral aspects of the final tort which lay solely abroad— Ethiopia could not have intruded upon Kidane's seclusion under Maryland law. Kidane's Wiretap Act claim is similarly deficient. The Wiretap Act in pertinent part proscribes "intentional intercept[ions]" of "wire, oral, or electronic communication[s]." 18 U.S.C. § 2511(1)(a). But, again, the "intent," id., and FinSpy's initial deployment occurred outside the United States. The tort Kidane alleges thus did not occur "entire[ly]" in the United States, Jerez, 775 F.3d at 424 (internal quotation marks omitted); it is a transnational tort over which we lack subject matter jurisdiction.
Kidane regards this conclusion as inconsistent with the noncommercial-tort exception's purpose and legislative history. He argues that, when the Congress codified the exception, it considered—but rejected—the approach of the European Convention on State Immunity. The European Convention abrogated sovereign immunity for certain torts if the facts underlying the torts occurred in the forum nation and if "the author of the injury or damage was present in that territory at the time." European Convention on State Immunity art. 11, reprinted in Hearings on H.R. 11,315 Before the Subcomm. on Admin. Law & Governmental Relations of the H. Comm. on the Judiciary, 94th Cong. 39 (1976) (1976 Hearings). Kidane notes the absence of similar language in section 1605(a)(5). We think Kidane reads too much into the Congress's silence.
Kidane also directs us to the FSIA's commercial activity exception to illuminate section 1605(a)(5)'s boundaries. The commercial activity exception authorizes claims "based upon a commercial activity carried on in the United States by [a] foreign state[.]" 28 U.S.C. § 1605(a)(2). He observes that the Supreme Court, interpreting this provision, found instructive the "point of contact" between the tort and its victim in determining where the tort occurred. OBB Personenverkehr AG v. Sachs, 577 U.S. ___, 136 S.Ct. 390, 397 (2015) (internal quotation marks omitted). But Sachs underscores why the commercial activity exception is of limited usefulness here. There, the American plaintiff purchased a European rail travel pass from a Massachusetts travel agent. Id. at 393. When she used the pass to board the defendant Austrian state-owned railway's train in Innsbruck, Austria, she fell onto the tracks, where the moving train crushed her legs. Id. She sued, invoking the FSIA's commercial activity exception. Id. at 394. The Supreme Court concluded, however, that her lawsuit was not "based upon" the domestic sale of the rail pass. Id. at 393. It noted that "an action is based upon the particular conduct that constitutes the gravamen of the suit." Id. at 396 (internal quotation marks omitted). It explained that "the conduct constituting the gravamen of [her] suit plainly occurred abroad." Id.
For the foregoing reasons, we affirm the district court's dismissal of Kidane's intrusion-upon-seclusion claim for lack of subject matter jurisdiction. Because the same reasoning applies with equal force to Kidane's Wiretap Act claim, we affirm the dismissal of that claim as well.