When U.S. citizens are killed by terrorists abroad, there’s an understandable and entirely sympathetic urge to hold someone accountable.

But suing third parties with no direct involvement in the attacks—banks, social media providers, pharmaceutical companies, sovereign nations—is proving to be a stretch.