Appellants, a prospective class of more than 5,000 Kenyan citizens and businesses injured in the 1998 bombing of the United States Embassy in Nairobi, Kenya, sued the United States under the Federal Tort Claims Act alleging that the government negligently failed to secure the Embassy and to warn of a potential terrorist attack. Following limited jurisdictional discovery, the district court dismissed the complaint, finding that the discretionary function, foreign country, and independent contractor exceptions to the Federal Tort Claims Act's waiver of sovereign immunity bar appellants' claims. We affirm in all respects.

At approximately 10:30 on the morning of August 7, 1998, an explosives-laden truck dispatched by the al Qaeda terrorist network approached the entrance to the rear parking lot of the United States Embassy in Nairobi, Kenya. An embassy guard, a Kenyan employed by UIIS, a security company working under contract with the State Department, refused to open the Embassy gate. Blocked from entering the compound, one of the two terrorists began shooting while the other threw a flash grenade at another guard. Unarmed and unable to notify the Embassy's detachment of United States Marines either by telephone or radio, the guards ran for cover. Although apparently still off-premises, the terrorists detonated their explosives, causing massive internal damage to the Embassy, killing forty-four Embassy employees and approximately 200 Kenyan citizens, injuring some 4,000 individuals, and causing the collapse of an adjacent building. Approximately nine minutes later, another al Qaeda terrorist detonated an explosives-laden truck some thirty-five feet from the outer wall of the United States Embassy in Dar Es Salaam, Tanzania. That attack killed twelve people and injured eighty-five.

Appellants, all Kenyan citizens and businesses injured in the Nairobi bombing, filed suit against the United States in the U.S. District Court for the District of Columbia alleging that government actions and inactions led to the bombing and exacerbated appellants' injuries. Brought under the Federal Tort Claims Act (FTCA), 28 U.S.C. § 2671 et seq., counts I and II of the complaint allege that the United States Embassy was inherently dangerous; that State Department employees knew or should have known about a likely attack on the Embassy and that despite this knowledge they failed to warn their superiors, the Embassy, and Kenyan citizens; that the State Department failed to provide properly trained security personnel to the Embassy and to take necessary security precautions to prevent an attack; and that as a result of these shortcomings, the Embassy had become a private and public nuisance. Counts I and II also seek to hold the United States liable for the negligence of the UIIS guards. Count III alleges that the government's security failures violated customary international law, the Kenyan Constitution, and the International Covenant on Civil and Political Rights (ICCPR). Count IV seeks formation of a constructive trust to hold any assets or funds seized by the United States from Osama bin Laden and al Qaeda for the benefit of plaintiffs and prospective class members.

Invoking the discretionary function and foreign country exceptions to the FTCA's limited waiver of sovereign immunity, 28 U.S.C. § 2680(a), (k), the government moved to dismiss. Before ruling on the government's motion, the district court allowed plaintiffs three months of jurisdictional discovery. See Macharia v. United States, No. 99-3274 (D.D.C. Mar. 26, 2001). During discovery, the government objected to plaintiffs' efforts to obtain information from any agency other than the State Department. The government also objected to any discovery on the merits. A magistrate judge sustained both objections, and the district court denied plaintiffs' motion for reconsideration. See Macharia v. United States, No. 99-3274 (D.D.C. Dec. 17, 2001).

Following completion of jurisdictional discovery, the district court dismissed the complaint. Macharia v. United States, 238 F. Supp. 2d 13 (D.D.C.2002). Rather than "apply the heightened requirements of [Federal Rule of Civil Procedure] 12(b)(6) and treat all factual allegations — including those related to jurisdiction — in the complaint as true," id. at 21 (internal quotation marks omitted), the court treated the government's jurisdictional arguments as a "factual challenge," id. at 20, under Federal Rule of Civil Procedure 12(b)(1), and required plaintiffs to "demonstrate" "through testimony and affidavits" that the "case is properly before the court," id. at 21. Observing that plaintiffs "were afforded three months of discovery on the jurisdictional question," id., the court rejected plaintiffs' contention that it "should not dismiss the action pursuant to Rule 12(b)(1) because [they] have not had the opportunity to conduct sufficient jurisdictional discovery in this case," id. With respect to most allegations contained in counts I and II, the court found that "[t]he decisions made by [the United States] regarding the security of the Embassy and warnings of possible threats are clearly discretionary in nature and grounded in policy and therefore[] do not fall within the FTCA's waiver of sovereign immunity." Id. at 26. The district court dismissed all claims based on the alleged negligence of the UIIS guards under the foreign country and independent contractor exceptions to the FTCA. Id. at 26-28. As to count III, the court held that sovereign immunity bars plaintiffs' Kenyan Constitution and ICCPR claims, and that plaintiffs had failed to allege a claim under customary international law. Id. at 28-31. Having dismissed plaintiffs' substantive claims, the district court dismissed count IV, explaining that "a constructive trust is not an independent cause of action." Id. at 31.

Plaintiffs now challenge the district court's discovery rulings and its dismissal of their complaint. Our review of the district court's dismissal of the complaint pursuant to Federal Rule of Civil Procedure 12(b)(1) and 12(b)(6) is de novo, see Stokes v. Cross, 327 F.3d 1210, 1214 (D.C.Cir. 2003); we review the district court's discovery rulings for abuse of discretion, see Goodman Holdings v. Rafidain Bank, 26 F.3d 1143, 1147 (D.C.Cir.1994).

The FTCA authorizes district courts to hear suits for money damages against the United States "for injury or loss of property, or personal injury or death caused by the negligent or wrongful act or omission of any employee of the Government ... if a private person ... would be liable to the claimant in accordance with the law of the place where the act or omission occurred." 28 U.S.C. § 1346(b)(1). The Act's waiver of sovereign immunity has various exceptions, however. We agree with the district court that three of those exceptions — discretionary function, foreign country, and independent contractor — bar appellants' claims under counts I and II.

The FTCA's discretionary function exception bars claims "based upon the exercise or performance or the failure to exercise or perform a discretionary function or duty on the part of a federal agency or an employee of the Government, whether or not the discretion involved be abused." 28 U.S.C. § 2680(a). In United States v. Gaubert, 499 U.S. 315, 322-23, 111 S. Ct. 1267, 1273-74, 113 L. Ed. 2d 335 (1991), the Supreme Court established a two-part test for determining whether the discretionary function exception applies in a particular case. First, because "[t]he exception covers only acts that are discretionary in nature, acts that involve an element of judgment or choice," id. at 322, 111 S. Ct. at 1273 (internal quotation marks omitted), Gaubert's first step requires that we determine whether any "federal statute, regulation, or policy specifically prescribes a course of action for an employee to follow," id. If one does, "the employee has no rightful option but to adhere to the directive." Berkovitz v. United States, 486 U.S. 531, 536, 108 S. Ct. 1954, 1958-59, 100 L. Ed. 2d 531 (1988). Under Gaubert's second step, which applies when there is no "federal statute, regulation, or policy" and when the "challenged conduct involves an element of judgment," id., the court must decide "whether th[e] judgment is of the kind that the discretionary function exception was designed to shield," id. "Because the purpose of the exception is to prevent judicial `second-guessing' of legislative and administrative decisions grounded in social, economic, and political policy through the medium of an action in tort," the Supreme Court explained, "when properly construed, the exception protects only governmental actions and decisions based on considerations of public policy." Gaubert, 499 U.S. at 323, 111 S. Ct. at 1273-74 (internal quotation marks and citations omitted).

In this case, even after several months of discovery, appellants failed to establish, as Gaubert's first step requires, the existence of a "federal statute, regulation, or policy" that applies to any of the government's allegedly negligent conduct, including the government's alleged failure to secure the Embassy and to warn of a potential attack. This failure is hardly surprising, for as the district court explained, "determinations about what security precautions to adopt at American embassies, and what security information to pass on, and to whom this information should be given, do not involve the mechanical application of set rules, but rather the constant exercise of judgment and discretion." Macharia, 238 F.Supp.2d at 23. Indeed, the Secretary of State has authority to "develop and implement ... policies and programs, including funding levels and standards, to provide for the security of United States Government operations of a diplomatic nature," 22 U.S.C. § 4802(a)(1), and the "Physical Security Standards" section of the State Department's Foreign Affairs Manual instructs "[p]roject managers and regional security officers ... [to] follow all standards to the maximum extent possible," UNITED STATES DEP'T OF STATE FOREIGN AFFAIRS MANUAL, 12 FAM 314.1. The manual also directs foreign service officers to engage in a process of

[r]isk management ... begin[ning] with an assessment of the value of the assets, the degree of a specific type of threat, and the extent of the vulnerabilities.... A decision is then made as to what level of risk can be accepted and which countermeasures should be applied. Such a decision involves a cost-benefit analysis, giving decision makers the ability to weigh varying security risk levels against the cost of specific countermeasures.

Id., 12 FAH-6 H-511.4. In short, embassy security is vested in the discretion of State Department employees, from the Secretary to the foreign service officers at various embassies. See Macharia, 238 F.Supp.2d at 23-24.

Conceding that they "did not rely on any documents" to demonstrate that a "federal statute, regulation, or policy" applied to the government's conduct, Appellants' Reply Br. at 6, appellants contend that the discretionary function exception is nevertheless inapplicable because the government failed to follow an unwritten federal policy. According to appellants, the Office of Diplomatic Security (DS), the office within the State Department responsible for embassy security, failed to file "trip reports" with the Embassy's Regional Security Officer following visits to the Embassy in March and June 1998, even though "`[a] team trip report would have been a normal practice.'" Appellants' Reply Br. at 6 (citing Williams Dep. at 125:19-20). DS's failure to file a trip report, appellants maintain, left the Embassy with inadequate guidance about how to improve security and to prevent al Qaeda's attack.

Even assuming an unwritten practice can satisfy the statute's requirement, appellants have failed to establish that DS had a mandatory obligation to file a trip report. To the contrary, although the record establishes that filing trip reports was DS's "procedure," one witness testified that "reality sometimes intercedes, and you do not have sufficient time to do something as formal as ... a trip report." Flowers Dep. at 51:15-17. The same witness explained that filing a trip report "would be ideal, but it could have been that the people that were team leaders ... were immediately sent on other trips or to handle other pressing business.... If [the diplomatic security agent] was called away before he had a chance to write a trip report, it might be sometime before he gets to it or it could be never if this flood of work doesn't give him the opportunity to do it." Id. at 49:7-21. The record thus establishes only that filing trip reports was preferred, not that it was required, i.e., not that it amounted to a mandatory policy.

Having failed to identify a relevant "federal statute, regulation, or policy" under Gaubert's first step, appellants contend that the discretionary function exemption is inapplicable under the second step because the government's conduct was the product of simple negligence rather than social, political, or economic considerations. Specifically, appellants cite twenty-one instances of alleged government negligence, from its failure to fix a pin in the drop bar at the Embassy's rear parking lot to its failure to timely design a training program for vehicle bomb recognition and prevention that led to appellants' injuries. See Appellants' Br. at 25-26. The district court helpfully distilled these allegations into six categories:

1) a failure to provide guidance and advice on improving security at the Embassy, 2) a failure to provide security equipment to the Embassy, 3) a failure to train adequately Embassy personnel and contractors to deal with various security threats, 4) a failure to warn adequately Embassy personnel, and others, of potential terrorist threats, 5) an improper classification of the level of security risk at the Embassy, or 6) falsely leading Embassy personnel to believe that security analyses had been conducted or would be conducted.

Macharia, 238 F.Supp.2d at 22. The district court concluded that all six categories were barred by the second step of the discretionary function test. Id. As the district court explained, "[d]ecisions regarding how much safety equipment should be provided to a particular embassy, how much training should be given to guards and embassy employees, and the amount of security-related guidance that should be provided necessarily entails balancing competing demands for funds and resources." Macharia, 238 F.Supp.2d at 25. "Each individual embassy's need for security," the district court noted:

must be balanced against the need perceived at other embassies, and the need for security must be balanced against the need for alternative projects that could consume scarce resources. Moreover, each of Defendant's decisions regarding security involved balancing potential inconvenience to State Department employees against the perceived security gains that would result from a safety measure.

Id. We have little to add to the district court's fine analysis, except to note that, as the government points out in its brief, "decisions about foreign embassies, especially their location and structure, require agency officials to account for policy objectives, and consult and negotiate with the host country — actions that, by their very nature, affect foreign relations." Appellee's Br. at 27.

Appellants insist that "[n]othing in the record supports the notion that anyone at DS `decided' to: make inaccurate statements, fail to keep a promise, fail to send a report, fail to send a report on time, overlook a broken pin or outdated dropbar, or fail to correct misapprehensions." Appellants' Br. at 30. Put another way, appellants maintain that Gaubert's second step requires evidence that decision makers actually considered social, economic, or policy considerations. But we rejected just this argument in Cope v. Scott, 45 F.3d 445, 449 (D.C.Cir.1995) (citation omitted): "What matters is not what the decisionmaker was thinking, but whether the type of decision being challenged is grounded in social, economic, or political policy. Evidence of the actual decision may be helpful in understanding whether the `nature' of the decision implicated policy judgments, but the applicability of the exemption does not turn on whether the challenged decision involved such judgments."

Appellants' challenges to the district court's discovery orders require little discussion. They argue that the district court improperly applied a factual attack standard under Federal Rule of Civil Procedure 12(b)(1), which requires plaintiffs to demonstrate through affidavits and other testimony that the court has jurisdiction, instead of a facial attack standard under Federal Rule of Civil Procedure 12(b)(6), where the court accepts the plaintiffs' allegations as true. See Gould Elecs., Inc. v. United States, 220 F.3d 169, 178 (3d Cir. 2000). According to appellants, the district court's choice of a factual attack standard was error, since the court allowed discovery only regarding physical security and denied appellants a chance to conduct discovery on "threat response." Appellants' Br. at 18. In support of this allegation, appellants point out that the deponents offered by the government declined to answer any questions on the threat issue, but appellants ignore the fact that those deponents were not asked to testify on that issue. Moreover, as the government observes, "appellants refute their own argument by citing documents on threat information that appellee produced in discovery, to support their claim of failure to disseminate threat information." Appellee's Br. at 42. The district court thus properly employed a factual attack standard under Federal Rule of Civil Procedure 12(b)(1).

Nor do we detect any abuse of discretion in the district court's other discovery orders. The State Department's statutory responsibility for embassy security obviated the need for discovery in other departments and agencies. See 22 U.S.C. § 4802. Likewise, discovery on the merits would have been entirely irrelevant to the jurisdictional issue raised by the government's motion to dismiss. See Ignatiev v. United States, 238 F.3d 464, 467 (D.C.Cir. 2001) (remanding dismissal of FTCA claim for jurisdictional discovery).

Our conclusion regarding the discretionary function exception leaves only appellants' allegations of negligence by Embassy guards. According to appellants, the Kenyans UIIS hired as Embassy guards lacked adequate training and equipment, and negligently failed to identify and stop the terrorists from detonating the bomb. We agree with the district court that the independent contractor and foreign country exceptions bar these claims.

The FTCA's waiver of sovereign immunity applies only to tortious acts undertaken by "officers or employees of any federal agency ... and persons acting on behalf of a federal agency in an official capacity." 28 U.S.C § 2671. The Act defines "federal agency" as "the executive departments[,]... independent establishments of the United States, and corporations primarily acting as instrumentalities or agencies of the United States, but does not include any contractor with the United States." Id. The Supreme Court has interpreted this language, referred to as the "independent contractor exception," to mean that a contractor's negligence may only be imputed to the United States if the contractor's "day-to-day operations are supervised by the Federal Government." United States v. Orleans, 425 U.S. 807, 815, 96 S. Ct. 1971, 1976, 48 L. Ed. 2d 390 (1976). "A critical element in distinguishing an agency from a contractor," the Court explained, "is the power of the Federal Government `to control the detailed physical performance of the contractor.'" Id. at 814, 96 S. Ct. at 1976 (quoting Logue v. United States, 412 U.S. 521, 528, 93 S. Ct. 2215, 2219-20, 37 L. Ed. 2d 121 (1973)).

Appellants contend that DS designed the Embassy's contracts for employing local guards, handled all payments to UIIS, and regularly provided advice regarding the contracts. See Appellants' Br. at 33. They also contend that the contract required UIIS to provide the State Department with the names of the local guards it employed, to submit the names of all personnel to the Department for approval, to ensure that guards wear uniforms approved by the Department, and to conduct inventories as directed by the Department. Id. Far from demonstrating day-to-day State Department supervision of the contractor, however, these allegations establish only that "the contract set forth detailed guidelines and regulations that the contractor was required to conform with as it implemented its hiring, supervision and training of Embassy local guards." Macharia, 238 F.Supp.2d at 28. As the Supreme Court held in Orleans, the government may "fix specific and precise conditions to implement federal objectives" without becoming liable for an independent contractor's negligence. Orleans, 425 U.S. at 816, 96 S. Ct. at 1976.

To be sure, appellants presented evidence that supervision of the UIIS contract amounted to a "full time job for one [Assistant Regional Security Officer]." Appellants' Br. at 34. Although this may well constitute the sort of day-to-day supervision falling outside the independent contractor exception, Assistant Regional Security Officers are located overseas — in this case, in Nairobi — and the FTCA's sovereign immunity waiver does not extend to acts or omissions arising in territory subject to the sovereign authority of another nation. See 28 U.S.C. § 2680(k); see also United States v. Spelar, 338 U.S. 217, 221, 70 S. Ct. 10, 12, 94 L. Ed. 3 (1949) (purpose of foreign country exception is to avoid having another country's law define the scope of the federal government's tort liability). Moreover, to the extent that appellants allege negligent supervision of local guards by State Department employees located in the United States, those allegations are, for the reasons given above, barred by the discretionary function exception. See supra pp. 65-68.

Having considered appellants' remaining arguments and finding no basis for questioning the district court's disposition, we affirm in all respects.

So ordered.