Supreme Court Decimates Key Remedies for Tech Complicity in Human Rights Abuse

Madeline Batt is the Legal Fellow for Tech Justice Law.

The Tech Litigation Roundup spotlights notable lawsuits and court decisions across a variety of tech-and-law issues.

This month, the US Supreme Court issued a decision in Doe v. Cisco that all but eliminated pathways for tech accountability under both the Alien Tort Statute (ATS) and the Torture Victim Protection Act (TVPA). Both laws concern liability for human rights violations, so the Supreme Court's decision restricts litigation over some of the most egregious allegations of abuse by US tech companies.

The lawsuit against Cisco claimed that the tech giant built bespoke products to help the Chinese government surveil and persecute a religious minority, the Falun Gong. According to the plaintiffs, Cisco designed an internet surveillance system called the “Golden Shield” and a facial recognition-equipped video surveillance system that enabled China to identify Falun Gong practitioners, arrest them, and subject them to torture during forced-conversion sessions. In her dissent, Justice Sonia Sotomayor highlighted media reports that thousands of Falun Gong believers have been tortured to death.

As Justice Sotomayor recounts, plaintiffs allege that Cisco explicitly marketed its services as “useful to the ‘douzheng’ [crackdown] of Falun Gong” and characterized Falun Gong and its members as “viruses” and an “evil cult” in internal materials. In addition to helping China identify and track Falun Gong practitioners, Cisco’s surveillance systems allegedly provided information that Chinese officials used to threaten torture victims’ family members to coerce them into renouncing their beliefs.

Falun Gong adherents sued Cisco and two of its executives based on the ATS, alleging that they aided and abetted violations of international law by assisting in this campaign of persecution. One US citizen plaintiff also alleged that the executives aided and abetted his torture in violation of the TVPA.

US tech liability under the Alien Tort Statute pre-Cisco

The ATS, enacted by the First Congress in 1789, gives federal courts jurisdiction to hear cases by “alien[s]” (foreign plaintiffs) for torts “committed in violation of the law of nations or a treaty of the United States.” For nearly two centuries, it was infrequently used. But following the 1980 case Filártiga v. Peña-Irala, the ATS saw a resurgence as a basis for victims of serious human rights violations to sue the perpetrators in US courts. In 2004, the Supreme Court endorsed the ATS's use for this purpose in Sosa v. Alvarez-Machain while cautioning that “independent judicial recognition of actionable international norms” should remain “subject to vigilant doorkeeping.”

Since that relative high point for the ATS, however, the Supreme Court has repeatedly limited the law’s scope. In Kiobel v. Royal Dutch Petroleum, the Court held that the ATS did not apply to conduct that occurred entirely in other nations’ territories. In Jesner v. Arab Bank, PLC, the Court held that foreign corporations could not be liable under the ATS. In Nestle USA, Inc. v. Doe, the Court held that allegations of “general corporate activity” occurring within the US were insufficient for the ATS to apply. All of these restrictions led some to conclude, even pre-Cisco, that the ATS was “dead.”

As Cisco itself demonstrates, though, US Big Tech remained unusually vulnerable to liability under the already-weakened ATS. As American companies, these tech giants were not immunized under Jesner. And the nature of digital technologies means that employees in the US can sit at desks in Silicon Valley providing technical support for persecution across the world, potentially exposing them to liability despite the ATS’s exclusively domestic application. The Ninth Circuit decided that the ATS––even with significant carveouts––applied to Cisco’s alleged conduct, suggesting that the ATS could still be a meaningful tool for accountability when US tech companies contract with governments committing human rights abuses.

The impact of Cisco’s ATS holding for tech accountability

After the Supreme Court’s Cisco decision, that will not happen. Instead of continuing to chip away at the ATS––for example, by holding that it does not support aiding-and-abetting liability––the Court issued a broad ruling that renders the statute nearly useless.

To understand the decision, it is important to know that the ATS is a jurisdictional statute that does not itself create any causes of action. That means that the law gives federal courts power to hear disputes, but it does not create any new power for plaintiffs to sue. Plaintiffs either have to rely on some other congressionally enacted law that authorizes them to sue, or they have to ask the court to recognize a judicially-created cause of action.

That unusual structure, the Supreme Court recognized, is the result of a completely different conception of the law at the time that ATS was passed. In the 18th century, certain causes of action were understood to exist within “general common law” for federal judges to “discover.” General common law has since been eliminated from US law altogether, and causes of action must now be created by Congress or judges. Importantly, this Supreme Court has been hostile toward the idea that judges should be the ones to create causes of action. The Court already displayed its skepticism when it effectively nullified the Bivens remedy, a key judicially-created cause of action used to challenge violations of US constitutional rights.

In Cisco, the Supreme Court held that federal courts lack the power to recognize causes of action under the ATS. To be more exact, courts theoretically have this power, but any conceivable cause of action that could be recognized under the ATS would violate the stringent test already used to decimate Bivens. As a result, the range of viable ATS causes of action is––in Justice Amy Coney Barrett's words––a “null set.” This technical distinction allowed the Supreme Court to abandon Sosa's holding without explicitly acknowledging that it was overruling the case, prompting Justice Sotomayor to call Cisco “yet another low point in this Court’s esteem for its precedents.”

In practice, this means that there are only two types of cases that can be brought under the ATS. The first is cases where Congress has passed a separate law authorizing suit, as with the TVPA. Because federal courts already have jurisdiction over cases arising under federal law, the ATS will generally be superfluous in this context. But even assuming the ATS has value here, this pathway is unlikely to be useful for tech accountability litigators. As discussed below, Cisco's narrowing of TVPA liability likely prevents tech executives' exposure, and Congress does not appear poised to pass new legislation that would welcome victims of human rights violations into US courts to challenge tech corporations' complicity in their abuse.

The second type of case that can still be brought under the ATS are challenges based on the “Blackstone three,” the set of torts that the Supreme Court has concluded were actionable under the ATS at the time of its passage: violations of safe conducts, infringements of the rights of ambassadors, and piracy. These archaic torts similarly offer little to those in search of tech accountability. Ultimately, the holding effectively eliminates the ATS as a vehicle for human rights and tech litigation, as well as for contemporary human rights litigation more broadly.

Cisco’s TVPA holding likely precludes tech executive liability

In addition to the ATS claims, one plaintiff in Cisco alleged that two of the company’s executives violated the TVPA by aiding and abetting his torture.

The TVPA imposes civil liability on certain people who “subjec[t] an individual to torture.” The statute only provides for individual liability, so corporations cannot be sued under the TVPA. But in cases like Cisco, where plaintiffs have enough information to allege facts about how individual executives participated in deals that led to their torture, the TVPA still appeared able to meaningfully further accountability for alleged Big Tech participation in gross human rights violations. Given executives’ individual exposure, the prospect of TVPA liability may have been particularly effective at shaping the decision-making of the people who sign off on contracts that facilitate state violence.

Again, Cisco put an end to that possibility. The Court held that there is no aiding and abetting liability under the TVPA, so executives who knowingly provide technology that help state actors commit torture are not liable under the statute. This conclusion is narrower than the Court's ATS holding, and the TVPA will still provide a meaningful remedy to torture victims in many contexts. But against tech executives, whose participation in acts of torture will virtually always be at least as indirect as the alleged acts of Cisco executives, the holding is likely fatal to the TVPA's prospects as a tool for accountability.

US tech and human rights litigation after Cisco

Cisco’s restrictions on the ATS and TVPA arrive at a moment where US tech companies are becoming increasingly entangled with the US government, and TJL and others have raised concerns that the US partnership with tech is facilitating war crimes and other grave harms. These legal and political developments have left the future of US-based tech and human rights litigation uncertain.

One possible outcome is a turn toward foreign courts for human rights litigation against US tech companies––though this strategy brings its own challenges. It may not always be possible to obtain jurisdiction over US companies in a given foreign forum, and evidence of US corporate complicity may be harder to access from abroad.

In the US, plaintiffs may turn to litigating foreign law claims in American courts or relying on state law torts to obtain remedies for human rights abuse. For example, in 2024, a jury in Florida found Chiquita Brands International responsible under Colombian law for financially supporting a paramilitary group that killed the plaintiffs’ relatives. And for litigators of ATS cases whose core claims failed after prior Supreme Court decisions narrowing the statute’s scope, common law tort claims originally included “as an afterthought” have sometimes allowed the cases to remain viable. As tech companies face increasing exposure for consumer harms under tort theories, Cisco may put the same sources of law to the test for human rights harms that would previously have been challenged under the ATS or TVPA.

For now, Cisco's elimination of two key vehicles to challenge tech complicity in human rights violations leaves companies and executives less constrained by liability fears. Victims, meanwhile, are left searching for new pathways to redress.

Other tech litigation developments

• SCOTUS says Constitution protects cell phone location data: In another major decision this month, the US Supreme Court held in Chatrie v. United States that obtaining cell phone location data from tech companies counts as a search under the Fourth Amendment. As a result, police will generally need a warrant to legally acquire this data; the decision stopped short of determining that geofence warrants are always constitutionally insufficient. The decision recognizes a reasonable expectation of privacy in information shared with a tech company under the Constitution, a significant step for the legal framework governing digital privacy.
• OpenAI faces investigation and lawsuit by state attorneys general: The Florida Attorney General sued OpenAI on June 1 for alleged legal violations related to AI safety. The first-of-its-kind lawsuit raises some claims familiar from private lawsuits brought by TJL and others––such as violations of an unfair trade practices statute, negligence, and strict product liability claims––and a novel claim of public nuisance, which is currently being tested in the social media context in New Mexico. Weeks later, OpenAI was served a subpoena as part of an investigation by a coalition of state attorneys general.
• After Mythos/Fable takedown, lawsuit challenges US power to restrict model access: A legal tech firm that relies on Anthropic’s LLMs for its own products sued the United States, arguing that its order requiring Anthropic to restrict foreign nationals’ access to the company’s most advanced AI models was unlawful and exceeded export control authority.
• Data centers in US courts: Proponents and opponents of the data center boom both took their fight to the courts this month. The US followed through on its threat to intervene in the Clean Air Act case against xAI and is seeking to dismiss the entire suit, while cloud company Oracle sued the Public Service Commission of Wisconsin to challenge financial security requirements regulating hyperscale data center operators in the state. Meanwhile, residents of Oregon and Utah brought actions raising different legal theories that both challenge an alleged lack of public input in procedures to approve data center tax breaks in Hillsboro and construction in Box Elder County. In Mississippi, another lawsuit was filed challenging the gas turbines powering xAI’s data centers near Memphis. The proposed class action alleges private nuisance, public nuisance, negligence, and negligent infliction of emotional distress based on noise pollution from the turbines, taking a new approach from the environmental and procedural challenges currently predominating in data center litigation.
• International cases with major implications: The Delhi High Court upheld India’s authority to temporarily but entirely restrict access to the messaging app Telegram against a constitutional challenge, prompting concerns over impacts on freedom of expression. Separately, a German court ruled that Google can be liable for false statements in AI summaries appearing at the top of search results, because––unlike a traditional search engine––Google, not any third party, is responsible for generating the text.
• Litigation spotlights increasingly advanced scams: The FTC sued what it says is a network scam subscription app makers alleging they extensively use shell companies to dodge app store enforcement. Google sued Doe plaintiffs alleging they run a cybercrime operation that leverages Gemini to create fake websites for phishing. And a proposed class action in California alleges that AI company Kalibrate helps gas stations illegally collude to raise prices for consumers.
• Amazon sued over Ring’s Familiar Faces feature: Amazon faces a proposed class action lawsuit over an opt-in Ring feature that allegedly subjects every person captured on the doorbell camera to facial recognition AI and stores their biometric data. While some states have statutes explicitly regulating biometric privacy, this lawsuit relies on more widely available causes of action including deceptive trade practices, privacy torts, and unjust enrichment, and seeks to represent a nationwide class.