The Homeland and Cyber Threat Act (HACT) was introduced in the U.S. House on March 12, 2021. This bill would allow U.S. citizens to sue foreign governments, agents and officials and to collect monetary damages for personal injury, damage or loss of property resulting from a cyberattack with foreign origins.

This bipartisan bill was introduced because cybersecurity activity and cyber incidents continue to rise, leading to increasing concerns of data security. Rep. Bergman, R-MI, a key sponsor of both this bill and a similar bill introduced in 2019, describes HACT as a tool of accountability for foreign states. The other bill sponsors (Reps. Allred, D-TX; Fitzpatrick, R-PA; Herrera Beutler, R-WA; Neguse, D-CO; and Kim, D-NJ) echo this theme of accountability and point to HACT as a way for Americans to “fight back against foreign cyberattacks.”

The bill proposes an amendment to Title 28, Chapter 97, of the U.S. Code, Jurisdictional Immunities of Foreign States. The current language provides immunity to foreign states in U.S. courts, even if the actor is involved in cybersecurity acts against US nationals. If amended, this immunity would be removed, allowing U.S. nationals the opportunity to seek monetary damages from foreign state actors. This legislation is also being spurred on by the recent SolarWinds and Microsoft Exchange cyberattacks. In light of the recent Colonial Pipeline attack just days ago, the push for the passage of this bipartisan legislation may increase exponentially.

If passed, however, there are some possible legal and political repercussions. One consequence is that removing such immunity to foreign states may result in foreign states allowing legal reciprocity against US nationals. Specifically, there is a concern that if this legislation passes, it would remove certain exemptions from the Foreign Sovereign Immunities Act, and it could open up lawsuits against U.S. government officials by citizens of other nations.

This legislation could also have harsh repercussions for US intelligence agencies, who use cyber operations for collecting intelligence. Foreign governments may view the permissions granted under HACT as an invitation to sue U.S. intelligence agencies for utilizing data strategies for intelligence collection.