On May 16, 2009, U.S. Army Specialist David Schaefer, Jr., was killed by a roadside bomb while serving a tour of duty in Iraq. This litigation represents his mother's attempt to hold someone responsible for the senseless loss of her son. It is easy to understand why she wishes to do so. But not everything is redressable in a court. Terrorist attacks such as the one that took Spc. Schaefer's life often elude the conventional judicial system. Those directly responsible may be beyond the reach of the court, because they are unidentifiable, or because they are beyond the reach of the court's personal jurisdiction, or because they themselves have come to a violent end. Secondary actors, such as the organizations that fund the terrorists, are often amorphous and difficult to hale into court. Finally, despite Congress's effort to make state sponsors of terrorism accountable in U.S. courts, see 28 U.S.C. § 1605A, any resulting judgment may be uncollectible. See, e.g., Rubin v. Islamic Republic of Iran , --- U.S. ----, 138 S.Ct. 816 , --- L.Ed.2d ---- (2018).

Rhonda Kemper attempted to get around these formidable obstacles by alleging that the bomb that killed her son was a signature Iranian weapon that traveled from the Iranian Revolutionary Guard Corps ("the Guard") to Hezbollah to Iraqi militias, who then placed it in the ground in Basra, Iraq, where it killed Spc. Schaefer. Kemper asserts that Deutsche Bank AG, a German entity with U.S. affiliates, is responsible for her son's death under the Anti-Terrorism Act ("ATA"), 18 U.S.C. § 2333 . She ties Deutsche Bank to the fatal bomb through the Bank's alleged membership in an Iranian conspiracy to commit acts of terror. It joined that conspiracy, she contends, when it instituted procedures to evade U.S. sanctions and facilitate Iranian banking transactions.

The district court found that Kemper failed to plead facts that plausibly indicated that Deutsche Bank's actions caused her son's death. It thus dismissed her complaint for failure to state a claim. We affirm.

I

A

In presenting the following account of the facts, we take Kemper's account as true, understanding that it would be contestable if this case were to move forward. The May 2009 attack that killed Spc. Schaefer was typical of Iran's long and sordid history of supporting terrorism. The United States designated Iran a State Sponsor of Terrorism in 1984, and that designation continues to this day. Although Iran plays no official role in the ongoing hostilities in Iraq, it maintains a large presence in that country through proxies in Iraqi Shi'a militias. One of those proxies planted the bomb that killed Spc. Schaefer.

The allegation that Iran had a role in Spc. Schaefer's death is plausible because of the distinctive explosive used in the attack. Iran supplies Explosively Formed Penetrators ("EFPs") to its Iraqi agents. These EFPs have precisely crafted copper linings and military-grade explosives that are capable of piercing American armored vehicles. The Iranian EFPs leave a distinctive fingerprint on bomb debris. But for Iran, the technical sophistication and explosive power found in EFPs would be unavailable to Iraqi militias.

As a result of Iran's involvement in terrorism, in 1995 the United States imposed broad-ranging sanctions prohibiting almost all trade between the two countries. See Exec. Order No. 12959. Until November 2008, however, there were exceptions to the sanctions. The one that interests us allowed Iran some access to the U.S. financial system through a regulation known as the U-Turn exemption. 31 C.F.R. § 560.516 (1995), amended 73 Fed. Reg. 66,541 (Nov. 10, 2008). This exemption allowed Iranian entities to use a non-Iranian bank with a correspondent account in the United States to process transactions. For example, an Iranian bank could keep an account with a non-U.S. bank such as Deutsche Bank. Deutsche Bank could then use its own correspondent account with a U.S. bank to process the Iranian bank's transaction through the United States. The exemption was a practical necessity for Iran because much of Iran's economy is oil-based, and the oil market is conducted in U.S. dollars. Without access to the U.S. financial system, Iran's ability to use its oil-based earnings would be severely restricted. The U-Turn exemption thus gave Iran the ability to use its earnings from oil sales for legitimate, non-terroristic, purposes. Critical to the U-Turn exemption's functioning was the transparent identification of the various counterparties to the transactions conducted pursuant to it. This transparency allowed U.S. banks to ensure that no transactions would benefit any sanctioned entities, thereby preventing Iran from using any of its assets to promote its terrorism goals.

Deutsche Bank found a way to subvert this regulatory scheme. By strategically removing names or otherwise hiding the existence of potentially sanctioned counterparties to U.S.-dollar-clearing transactions, Deutsche Bank avoided the U-Turn exemption's transparency requirements and thus the additional regulatory scrutiny called for by the U.S. sanctions. For example, on some transactions Deutsche Bank employees would include notes stating "PLS DON'T MENTION THE NAME OF BANK SADERAT IRAN OR IRAN IN USA," or "THE NAME BANK MELLI OR MARKAZI SHOULD NOT BE MENTIONED ... IMPORTANT: NO IRANIAN NAMES TO BE MENTIONED WHEN MAKING PAYMENT TO NEW YORK" (capitalization in original). These notes, while far from subtle, were effective. The names of sanctioned or potentially sanctioned parties were removed from thousands of transactions that later passed through U.S. banks' sanctions-detection systems without triggering any inquiry. For its troubles, Deutsche Bank charged a premium for providing these sanctions-avoidance services. It put these practices in place around 1999 and maintained them until at least 2006. Some illicit transactions persisted even after the bank formally undertook to abolish them.

The use of these non-transparent services was not sporadic. Deutsche Bank offered them to Iranian, Libyan, Syrian, Burmese, and Sudanese financial institutions as well as to other entities subject to U.S. sanctions. Over seven years, Deutsche Bank processed more than 27,200 transactions valued at approximately $10.86 billion for these customers. Of these, Deutsche Bank estimated that approximately 600 transactions valued at over $38 million were illegal under one of the U.S. sanctions programs. Although the existence of Deutsche Bank's sanctions-avoidance program was hidden, Deutsche Bank considered it an important part of its business. At least one member of the Bank's management board was kept aware of its functioning; some non-U.S. employees were considered experts in the practices and trained other employees; and the Bank issued formal and informal written instructions and training manuals for dealing with sanctioned customers.

In November 2015, the discovery of these practices led to Deutsche Bank's agreeing to a consent order with the New York State Department of Financial Services. This consent order required Deutsche Bank to pay a $258 million civil penalty, to agree to an independent monitor's oversight, and to fire numerous employees. The consent order contains an exhaustive factual description of how Deutsche Bank avoided U.S. sanctions; it is the source of many of the facts that appear in Kemper's complaint. But the consent order does not state or suggest that any of the transactions Deutsche Bank processed were used to fund terrorism. And neither the consent order nor Kemper's complaint specifies what percentage of Deutsche Bank's sanctions-avoidance business came from Iranian institutions, as opposed to its other sanctioned customers.

B

Kemper asserts that Deutsche Bank's sanctions-avoidance business was part of a much larger ongoing conspiracy to further Iran's terroristic goals. The alleged co-conspirators included the following:

• Iran;

• the Guard;

• Iranian banks, including Bank Saderat, Bank Melli, and the Central Bank of Iran;

• the Islamic Republic of Iran Shipping Lines ("Shipping Lines"), Iran's national maritime carrier, which in 2008 the United States labeled a Specially Designated National for its role in perpetuating Iran's terrorism;

• various Western financial institutions, including Deutsche Bank.

These co-conspirators worked to funnel millions of dollars to Hezbollah, a U.S.-designated Foreign Terrorist Organization, and enabled certain co-conspirators directly to perpetrate homicides, bombings, and other acts of international terrorism.

Plaintiffs allege that Deutsche Bank was actively involved in this conspiracy from 1999 until 2011 (well after the formal abandonment of the evasive measures). The Bank's role was to use the sanctions-avoiding practices described above to facilitate Iran's and its co-conspirators' access to funds. In turn, the Iranian banks would provide financial services to the Guard, Hezbollah, and others who facilitated Iran's terrorism-related goals. Deutsche Bank also facilitated payments totaling more than $60 million to Shipping Lines, and those payments enabled Shipping Lines to assist in terrorist attacks.

Deutsche Bank allegedly knew of or was deliberately indifferent to the terroristic aims of this conspiracy. Popular news sources such as the BBC and CNN repeatedly reported on Iran's role in the killing of American troops in Iraq as far back as 2006. Furthermore, the Bank knew that the financial oversight systems imposed as part of the U.S. sanctions on Iran relied on financial institutions as the first line of defense to prevent Iran from using the U.S. financial system for terrorist funding.

C

Deutsche Bank responded to Kemper's complaint with a motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim upon which relief could be granted. The district court held that Kemper failed to allege facts showing that Deutsche Bank proximately caused her son's death in Iraq, and that this was a dispositive omission. It found that there were too many steps in the hypothesized causal chain between Deutsche Bank's actions and the terrorists that attacked Spc. Schaefer to support liability. It also found that, to the extent Deutsche Bank joined any conspiracy, it joined only a conspiracy to avoid sanctions. The latter conspiracy was distinct from any of Iran's terrorism-related goals. For that reason, the complaint did not satisfy the ATA's requirement that to establish liability, the pleaded conspiracy must be one to provide material support for terrorism. The district court thus dismissed Kemper's complaint, and this timely appeal followed.

We consider the district court's dismissal of Kemper's complaint de novo , assuming that all of her well-pleaded allegations are true and construing reasonable inferences in her favor. Ashcroft v. Iqbal , 556 U.S. 662 , 678, 129 S.Ct. 1937 , 173 L.Ed.2d 868 (2009) ; Bell Atlantic Corp. v. Twombly , 550 U.S. 544 , 127 S.Ct. 1955 , 167 L.Ed.2d 929 (2007) ; see also Manistee Apartments, LLC v. City of Chicago , 844 F.3d 630 , 633 (7th Cir. 2016).

II

In order to state a claim under the ATA, Kemper must plead facts showing that a United States national was injured "by reason of an act of international terrorism." 18 U.S.C. § 2333 (a). At first glance, her complaint seems to meet that requirement. Neither party disputes that the bombing that killed Spc. Schaefer was an act of international terrorism, and Schaefer and Kemper are both United States nationals who were injured by reason of that act. But the statute does not specify the set of possible defendants it contemplates. We can presume that Kemper could sue the person who placed the bomb, if she could find that person in the United States. But what about Deutsche Bank? Is the Bank sufficiently connected to that act of international terrorism to hold it liable for Kemper's injuries? If not, then do any of Deutsche Bank's other actions fit the statutory definition of international terrorism?

The ATA defines the term "international terrorism" through three requirements. First, the act must "involve violent acts or acts dangerous to human life" that violate U.S. or state criminal laws. 18 U.S.C. § 2331 (1)(A). Kemper alleges that Deutsche Bank violated the federal criminal prohibitions on providing material support to terrorism and conspiring to provide material support. See 18 U.S.C. §§ 2339A, 2339B. Second, the act must "appear to be intended to intimidate or coerce a civilian population; to influence the policy of a government by intimidation or coercion; or to affect the conduct of a government by mass destruction, assassination, or kidnapping." 18 U.S.C. § 2331 (1)(B). And third, the act must "occur primarily outside the territorial jurisdiction of the United States, or transcend national boundaries ...." 18 U.S.C. § 2331 (1)(C).

In addition to these statutory criteria, we have held that the ordinary tort requirements of "fault, state of mind, causation, and foreseeability must be satisfied" in an ATA action.

Boim v. Holy Land Found. For Relief & Dev. , 549 F.3d 685 , 692 (7th Cir. 2008) ( en banc ) (hereinafter " Boim III "). Finally, because the ATA provides for treble damages and cost shifting, 18 U.S.C. § 2333 (a), a plaintiff must prove intentional misconduct by the defendant. Boim III , 549 F.3d at 692-93 . Although the district court focused on Kemper's failure to plead causation adequately, we begin with the question whether Deutsche Bank's actions met the definition of international terrorism, and then move to causation.

A

Kemper's complaint fails plausibly to allege that Deutsche Bank's actions satisfy the statutory definition of international terrorism and thus fall within the ambit of the ATA. The Bank's conduct was not "violent" or "dangerous to human life" as 18 U.S.C. § 2331 (1)(A) requires, nor did it display the terroristic intent required by 18 U.S.C. § 2331 (1)(B).

The facts in our case are different from those in Boim III , which dealt with direct donations to a known terrorist organization. While giving fungible dollars to a terrorist organization may be "dangerous to human life," doing business with companies and countries that have significant legitimate operations is not necessarily so. That these business dealings may violate U.S. sanctions does not convert them into terrorist acts. This is especially so when, as here, the great majority of these business interactions did not actually violate any sanctions, and the sanctions at issue cover more than terrorism-related transactions.

Deutsche Bank's actions also do not appear intended to intimidate or coerce any civilian population or government. 18 U.S.C. § 2331 (1)(B)(i), (ii). To the objective observer, its interactions with Iranian entities were motivated by economics, not by a desire to "intimidate or coerce." This view is bolstered by the consent decree between Deutsche Bank and the New York State Department of Financial Services. While that decree describes Deutsche Bank's many wrongful actions taken in attempts to evade the U.S. sanctions apparatus, it never once mentions terrorism. Indeed, that decree repeatedly states that Deutsche Bank built its sanctions-evading business because it was "lucrative."

B

Even if we were to overlook the fundamental question whether Deutsche Bank's actions count as "international terrorism," Kemper would still need to show that her allegations would support civil liability against the Bank. Terrorism is an emotionally and politically charged issue, but the ATA ultimately is a tort statute. That means that causation must be proven before liability is established. Traditionally, the causation inquiry is broken down into two subparts: but-for or factual causation, i.e. , whether the harm could have occurred without the alleged tortious act; and proximate or legal cause, which attempts to determine the scope of liability for a defendant's actions. See, e.g. , Bridge v. Phoenix Bond & Indem. Co. , 553 U.S. 639 , 653-54, 128 S.Ct. 2131 , 170 L.Ed.2d 1012 (2008).

We have recognized that strict but-for causation is not necessary to prove ATA liability. See Boim III , 549 F.3d at 695-99 . In Boim III , we found that providing material support to terrorists is a wrongful act that, like spilling toxic waste into groundwater, creates liability regardless of literal but-for causation because it is done in the context of others committing similar wrongful acts. Id. at 696-97 ; see also Restatement (Third) of the Law of Torts: Liability for Phys. & Emot. Harm § 27, cmts. f, g (2010) ("Restatement (Third) of Torts"). We held that making a monetary donation to Hamas, knowing that organization's active participation in terrorism, fits into this exception to the general rule of but-for causation. 549 F.3d at 697-99 . Even if Hamas would have committed the terrorist attack at issue without the Boim III defendants' donations, the funders could still be held liable because they added to Hamas's ability to engage in terrorism. Id. Deutsche Bank argues that Boim III is no longer good law on this point because later Supreme Court decisions have held that when a statute such as the ATA uses the phrase "by reason of," liability under that statute requires but-for causation. See Burrage v. United States , 571 U.S. 204 , 213, 134 S.Ct. 881 , 187 L.Ed.2d 715 (2014) (Controlled Substances Act). We need not address this issue, however, because the failure of Kemper's complaint plausibly to allege proximate causation independently requires dismissal.

We first take this opportunity to clarify some language in Boim III that might be read to suggest that something less than proximate cause might suffice to prove ATA liability. See, e.g. , 549 F.3d at 698, 700 (noting that "terrorism is sui generis " and that ATA liability might attach to "someone who ... contributed to a terrorist organization in 1995 that killed an American abroad in 2045"). Such a reading would not be compatible with the opinion as a whole. Boim III expressly held that "the ordinary tort requirements relating to ... causation ... must be satisfied" to establish ATA liability. Id. at 692 . Indeed, the core of the logic underlying Boim III comes directly from the canonical case of Summers v. Tice , 33 Cal. 2d 80 , 199 P.2d 1 (1948), cited at 549 F.3d at 696 . The analogy between multiple sources providing material support to terrorists, and multiple hunters firing in the same direction, while imperfect, is helpful. In both cases there is an undoubtedly wrongful act. And in both cases a rigid insistence on singular but-for causation would perversely result in the tortfeasor's escaping liability not because of her own actions, but because she was lucky enough that other people were committing similarly wrongful acts at the same time. The causation inquiry was not meant to prevent liability in these situations.

Kemper does not argue that the ATA is devoid of a proximate-cause requirement, and for good reason. The Supreme Court has told us that "[i]t is a well established principle of [the common] law that in all cases of loss, we are to attribute it to the proximate cause, and not to any remote cause. ... [The Court] assume[s] Congress is familiar with the common-law rule and does not mean to displace it sub silentio in federal causes of action." Bank of Am. Corp v. City of Miami, Fla. , --- U.S. ----, 137 S.Ct. 1296 , 1305, 197 L.Ed.2d 678 (2017) (internal citations and quotations omitted). Furthermore, the Supreme Court has repeatedly and explicitly held that when Congress uses the phrase "by reason of" in a statute, it intends to require a showing of proximate cause. See Holmes v. Sec. Investor Prot. Corp. , 503 U.S. 258 , 267-68, 112 S.Ct. 1311 , 117 L.Ed.2d 532 (1992) ("by reason of" in RICO statute requires proximate cause); Assoc. Gen. Contractors of Cal., Inc. v. Cal. State Council of Carpenters , 459 U.S. 519 , 532-35, 103 S.Ct. 897 , 74 L.Ed.2d 723 (1983) ("by reason of" in section four of the Clayton Act requires proximate cause); see also Hemi Group, LLC v. City of New York, N.Y. , 559 U.S. 1 , 130 S.Ct. 983 , 175 L.Ed.2d 943 (2010). Three of our sister circuits have expressly extended this reasoning to the ATA. See Owens v. BNP Paribas, S.A. , 897 F.3d 266 , 273 (D.C. Cir. 2018) ; Fields v. Twitter, Inc. , 881 F.3d 739 , 744-45 (9th Cir. 2018) ; Rothstein v. UBS AG , 708 F.3d 82 , 95-96 (2d Cir. 2013). We see no reason to depart from this logic, and so we join them in holding that proximate cause is necessary for ATA liability.

That said, we know that simply stating that the ATA requires proof of "proximate cause" does not help much. A firm definition for the term "proximate cause" has escaped judges, lawyers, and legal scholars for centuries. See, e.g. , Waters v. Merchants' Louisville Ins. Co. , 36 U.S. (11 Pet.) 213, 221, 9 L.Ed. 691 (1837) (attempting to determine the proximate cause of the destruction of a steamboat). The term has so bedeviled the authors of the Restatements of Torts that they omitted it entirely from the First and Second Restatements and expressed a wish for its extermination in the Third. See Restatement (Third) of Torts, Spec. Note on Proximate Cause (2010).

The parties have jumped into the fray and, to no one's surprise, have reached different conclusions. Drawing on conspiracy law, Kemper directs us to the foreseeability of an outcome, see Halberstam v. Welch , 705 F.2d 472 (D.C. Cir. 1983), while Deutsche Bank implores us to focus on the number of steps that occur between an action and its consequence. See Nichols v. Mich. City Plant Planning Dep't , 755 F.3d 594 , 604 (7th Cir. 2014) ("Proximate cause requires only some direct relation between injury asserted and injurious conduct alleged, and excludes only those links that are too remote, purely contingent, or indirect." (quoting Staub v. Proctor Hosp. , 562 U.S. 411 , 419, 131 S.Ct. 1186 , 179 L.Ed.2d 144 (2011) ) ). This is, to a degree, a pointless debate: directness and foreseeability are logically linked. In most cases the more directly related an outcome is to an underlying action, the more likely that the outcome will have been foreseeable, and vice versa . In addition to directness and foreseeability, other courts attempting to define proximate cause under the ATA have also considered whether a defendant's actions were "a substantial factor in the sequence of events" leading to a plaintiff's injuries. Owens , 897 F.3d at 273 (quoting Rothstein , 708 F.3d at 91 ) (internal quotations omitted).

Fortunately, we do not need to resolve once and for all the centuries-old debate about what exactly proximate cause requires. It is enough to note that all of the factors identified by the parties and our sister circuits-foreseeability, directness, and the substantiality of the defendant's conduct-are relevant to the inquiry. Moreover, as Boim III displays, other established principles of tort causation will often be useful as well. This catch-all approach has been endorsed by the Supreme Court and is a recognition of the fact that "we use 'proximate cause' to label generically the judicial tools used to" perform an inquiry that ultimately " 'reflects ideas of what justice demands, or of what is administratively possible and convenient.' " Holmes , 503 U.S. at 268 , 112 S.Ct. 1311 (quoting W. Keeton, et al. , PROSSER AND KEETON ON LAW OF TORTS § 41, p. 264 (5th ed. 1984) ); see also Bridge, 553 U.S. at 654 , 128 S.Ct. 2131 ("Proximate cause ... is a flexible concept that does not lend itself to a black-letter rule that will dictate the result in every case." (internal quotation marks omitted) ).

We can now return to the facts of this case. Kemper alleges that Deutsche Bank provided financial services to Iranian financial institutions and to other Iranian businesses such as Shipping Lines, and those Iranian entities went on to provide services to terrorist groups. Kemper does not allege that Deutsche Bank ever serviced a terrorist group directly. Nor does she allege that these various Iranian institutions exist solely to perform terrorist acts. Indeed, although Kemper alleges that Shipping Lines transported weapons for Iran, she also specifically asserts that it "provides a variety of maritime transport services" and is "a global operator with a worldwide network of subsidiaries, branch offices and agent relationships." The Iranian financial institutions similarly have branches and subsidiaries spread across Europe and Asia. These facts take Kemper's allegations out of the purview of Boim III . Even if Hamas's non-terroristic endeavors were closely tied to its terroristic mission, it strains credulity to suggest that a worldwide network of banks or shipping lines is similarly dedicated to terrorism.

There is an additional hurdle that Kemper has not overcome: the Islamic Republic of Iran. The central theory tying all of Kemper's allegations together is that Iran is responsible for the terrorist attack that killed her son, and that Deutsche Bank facilitated that attack by providing services to Iran and state-owned Iranian businesses. But this theory ignores that, as the D.C. and Second Circuits have noted, Iran "is a sovereign state with 'many legitimate agencies, operations, and programs to fund.' " Owens , 897 F.3d at 276 (quoting Rothstein , 708 F.3d at 97 ). When one of the links on a causal chain is a sovereign state, the need for facts specifically connecting a defendant's actions to the ultimate terrorist attack is especially acute. See id. That Iran is involved in substantial non-terrorist activities is clear from Kemper's complaint. Kemper alleges that Deutsche Bank facilitated or conspired to facilitate Iran's providing approximately $210 million of transactions for various sanctioned entities and terrorist groups over several years. By contrast, Kemper states that over seven years, Iran's oil and gas revenues totaled $972.9 billion. Even according to Kemper, then, Iran had over $972 billion in revenues that it applied to non-terroristic undertakings.

Kemper's complaint also fails to suggest how her theory might overcome the traditional tort doctrine of superseding or intervening cause. A cause is superseding when "it is a 'cause of independent origin that was not foreseeable.' " Staub , 562 U.S. at 420 , 131 S.Ct. 1186 (quoting Exxon Co., U.S.A. v. Sofec, Inc. , 517 U.S. 830 , 837, 116 S.Ct. 1813 , 135 L.Ed.2d 113 (1996) ). We have recognized, consistently with the Restatement (Third) of Torts, that although "criminal acts are not superseding causes per se [,] ... acts that are either criminal or intentionally tortious ... are more likely to be adjudged superseding causes." Scottsdale Ins. Co. v. Subscription Plus, Inc. , 299 F.3d 618 , 620 (2002) ; see also Hibma v. Odegaard , 769 F.2d 1147 , 1155-56 (7th Cir. 1985) ; Restatement (Third) of Torts § 34, cmt. e. Here, there are numerous criminal intervening acts separating Deutsche Bank from the terrorist attack that killed Kemper's son. After Deutsche Bank did business with Iranian institutions, all of the following actors had to commit an independent criminal act before the offending EFP was set in Basra: the Iraqi militias, Hezbollah, the Guard, the Iranian financial and shipping institutions, and most importantly, the Islamic Republic itself.

Although Owens and Rothstein do not use the language of superseding cause, both recognize that a sovereign's affirmative choice to engage in a wrongful act will usually supersede a third party's choice to do business with that sovereign. See Owens , 897 F.3d at 276 ; Rothstein , 708 F.3d at 97 . This makes sense. Finding that a sovereign state's actions supersede other more tangential causes prevents the scope of liability from extending to the many individual persons, businesses, and other sovereigns that interact with that state. For example, the United Kingdom has authorized both Bank Saderat and Shipping Lines to operate subsidiaries in its territory.

The existence of those subsidiaries surely furthers Iran's ability to engage in terrorism, but we cannot imagine that U.K. regulators could be held responsible for Iran's terrorist acts. Similarly, purchasers of Iranian oil and natural gas contribute funds to Iran that Iran might use to support terrorism, but those purchasers are not liable for the attacks that Iran may facilitate with those funds.

Kemper counters these arguments with three of her own. First, she reminds us that Iran is a designated state sponsor of terrorism. Second, she finds it suspicious that the Iranian entities used Deutsche Bank's non-transparent services even though the U-Turn exemption was available for any legitimate business. And third, she reasons that the Iranian sanctions are anti-terrorism measures and so any attempt to subvert them necessarily furthers Iran's terrorism capabilities. All of that may be true, but we do not see how these points sufficiently connect Deutsche Bank to terrorism supported by the Iranian state. The United States has regularly differentiated between providing support to state sponsors of terror and providing support to terrorist organizations. See, e.g. , Owens , 897 F.3d at 276 (noting that Congress found a total prohibition on financial support to terrorist organizations justified while explicitly permitting some financial transactions with state sponsors of terrorism). Indeed, the ATA itself makes this distinction. See 18 U.S.C. § 2333 (d)(2) (limiting liability to injuries caused by "an organization that had been designated as a foreign terrorist organization").

The Iranian institutions' decision to avail themselves of Deutsche Bank's sanctions-avoiding services similarly does not sufficiently connect Deutsche Bank to terrorism. As we already have noted, most of the transactions processed by Deutsche Bank did not violate any U.S. sanctions (though they did violate processing rules). Beyond this, Deutsche Bank provided its services to sanctioned entities, such as those from Burma, whose disfavored status is unrelated to terrorism. These facts weaken the inference that Deutsche Bank's provision of sanctions-avoiding services was necessarily tied to terrorism. Finally, although the Iran sanctions may have begun because of Iran's support for terrorism, the actual sanctions extend far beyond commerce that could support terroristic endeavors. Instead, the sanctions prohibit virtually all trade between the United States and Iran, regardless of whether that trade could conceivably facilitate terrorism. Even if Deutsche Bank had facilitated Iran's purchase of a crate of oranges, that deal could violate U.S. sanctions. Without some other fact suggesting either an intent to support terrorism or a direct provision of services to terrorists, the violation of such a broad prohibition does not create a sufficient link to establish liability for terrorism-related torts under any traditional notion of proximate cause. The implication from these facts is that Deutsche Bank's sanctions-avoiding actions, while wrongful, were designed to increase its profits by providing a service to willing customers at premium prices. In other words, Kemper has not alleged facts plausibly suggesting that it was foreseeable that Deutsche Bank's actions would fund terrorism, or that it was a substantial factor in her son's death. And she has not alleged any facts directly connecting Deutsche Bank's business dealings, as shady as those dealings might have been, to Iranian terrorist acts.

III

Unlike previous ATA plaintiffs, who have focused on aiding and abetting theories of liability, Kemper alleges that Deutsche Bank joined a conspiracy with the Iranian financial institutions, Shipping Lines, Iran, and the various terrorist organizations that committed the attack that killed her son. She argues that terrorist attacks, including the one that killed Spc. Schaefer, were reasonably foreseeable acts done pursuant to or in furtherance of this conspiracy, and so Deutsche Bank is liable for those acts. See Pinkerton v. United States , 328 U.S. 640 , 66 S.Ct. 1180 , 90 L.Ed. 1489 (1946) (co-conspirators liable for crimes committed in furtherance of conspiracy); Halberstam , 705 F.2d at 487 (co-conspirators in civil conspiracy liable for acts that are "a reasonably foreseeable consequence of the scheme"). But Kemper's conspiracy allegations are factually implausible, and her legal theory underlying those allegations is problematic.

The crux of any conspiracy is an agreement between the co-conspirators. Ocasio v. United States , --- U.S. ----, 136 S.Ct. 1423 , 1429, 194 L.Ed.2d 520 (2016). Although "a conspirator [need] not agree to commit or facilitate each and every part of the offense," she must "reach an agreement with the specific intent that" the conspiratorial goal be completed. Id. (alteration in original) (emphasis added) (internal quotation marks omitted). Here, Kemper has not alleged facts that give rise to a plausible inference that Deutsche Bank agreed to provide material support for terrorism . Cf. Bell Atlantic Corp. v. Twombly , 550 U.S. 544 , 556-57, 127 S.Ct. 1955 , 167 L.Ed.2d 929 (2007). None of the allegations suggest that Deutsche Bank cared how its Iranian customers obtained or spent the funds that it processed for them. "A person who is indifferent to the goals of an ongoing conspiracy does not become a party to this conspiracy merely because that person knows that his or her actions might somehow be furthering that conspiracy." United States v. Collins , 966 F.2d 1214 , 1219-20 (7th Cir. 1992). This principle-that one cannot join a conspiracy through apathy-is especially important in business dealings. Because "[b]y definition market transactions-whether in legal or illegal markets-benefit both parties, [ ] we do not assume, ab initio , that they carry with them the excess baggage of conspiracy." United States v. Townsend , 924 F.2d 1385 , 1392 (7th Cir. 1991). The facts here suggest only that Deutsche Bank may have engaged in business dealings that incidentally assisted a separate terrorism-related conspiracy involving Iran; they do not suggest that Deutsche Bank ever agreed to join that conspiracy.

We thus agree with the district court's reading of the complaint to allege, at most, that Deutsche Bank joined a conspiracy to evade sanctions. Deutsche Bank and the Iranian financial institutions agreed to omit any reference to Iranian counterparties so as to avoid detection by U.S. banks and the possible sanctions that detection might trigger. But no facts suggest that Deutsche Bank agreed to facilitate any wrongful conduct beyond this.

Beyond this fundamental factual defect, the ATA's text creates two other hurdles for Kemper's conspiracy allegations. If Kemper's conspiracy liability theory could succeed on these facts, it would undermine the causation analysis required by the ATA's use of the phrase "by reason of." Kemper's continuous invocation of conspiracy law in her discussions of causation makes this fact obvious. Because co-conspirators are liable for each other's acts done in furtherance of the conspiracy, pleading the type of wide-ranging conspiracy that Kemper has would allow plaintiffs to hold defendants liable who were not the proximate cause of the plaintiff's injury. This is not to say that a plaintiff could never adequately plead a plausible ATA conspiracy. But the further down the causal chain a defendant sits, the more diligent a plaintiff must be to plead facts that plausibly suggest that the defendant entered into an agreement to support terrorism.

The second problem with Kemper's theory of conspiracy liability is that she premises it on the primary liability found in 18 U.S.C. § 2333 (a). We held in Boim III that even though section 2333(a) does not encompass secondary theories such as conspiracy liability, through a chain of incorporations Congress effectively created "[p]rimary liability ... [that] has the character of secondary liability." 549 F.3d at 691 . Conspiracy and other secondary liability principles could thus inform an analysis of section 2333(a) primary liability. Id. at 691-92 . But after Boim III was decided, Congress passed the Justice Against Sponsors of Terrorism Act, Pub. L. No. 114-222, § 4, 130 Stat. 852 , 854 (2016), which explicitly added a textual basis for secondary liability to the ATA. See 18 U.S.C. § 2333 (d). The amendment created liability "for an injury arising from an act of international terrorism committed, planned, or authorized by an organization that had been designated as a foreign terrorist organization ... as to any person ... who conspires with the person who committed such an act of international terrorism." Id. (emphasis added). The district court held that section 2333(d) 's requirement that the terrorist attack be committed by a designated foreign terrorist organization excluded liability for attacks committed by a state sponsor of terrorism, i.e. , Iran.

The district court thus concluded that because Kemper alleged the attack at issue here was orchestrated by Iran, her claim could not be sustained under section 2333(d). Kemper has not contested this holding on appeal, and so any argument she may have regarding it is waived. Bernard v. Sessions , 881 F.3d 1042 , 1048 (7th Cir. 2018). We note, however, that assuming the district court's interpretation of the statute is correct, Kemper's theory of conspiracy liability under section 2333(a) would render section 2333(d) 's express allowance for conspiracy liability superfluous. If section 2333(a) 's allowance for primary liability with the "character" of conspiracy liability can support a conspiracy including a state sponsor of terror, a designated terrorist organization, or anyone else (perhaps a lone wolf), then litigants would never need to use the more limited conspiracy liability authorized by section 2333(d). That result is one we must avoid. See Marx v. Gen. Revenue Corp. , 568 U.S. 371 , 392-93, 133 S.Ct. 1166 , 185 L.Ed.2d 242 (2013) ("[A] statute should be constructed so that effect is given to all of its provisions, so that no part will be inoperative or superfluous, void or insignificant." (quoting Corley v. United States , 556 U.S. 303 , 314, 129 S.Ct. 1558 , 173 L.Ed.2d 443 (2009) ) (internal quotations omitted) ).

IV

The events leading to this litigation are heartbreaking. The United States lost a soldier, and Rhonda Kemper lost her son. The desire to hold someone responsible for this grievous loss is eminently understandable. But Deutsche Bank is the wrong defendant. Its actions are too attenuated from the terrorist attack that killed Spc. Schaefer to hold it liable for his death. We AFFIRM the district court's judgment.