The Kingdom of Bahrain v Shehabi: Supreme Court allows spyware hacking claim to proceed

The Supreme Court has ruled by a three to two majority that the Kingdom of Bahrain cannot claim state immunity from a civil claim brought by two London-based pro-democracy activists who allege its agents hacked their computers using spyware, in a judgement that clarifies how far state immunity extends to conduct carried out remotely from abroad.

In The Kingdom of Bahrain v Shehabi and another [2026] UKSC 25, Lord Lloyd-Jones, Lord Hamblen and Lady Simler, forming the majority, held that section 5 of the State Immunity Act 1978, which removes immunity for proceedings concerning personal injury or property damage "caused by an act or omission in the United Kingdom," applies even where the individuals responsible for the act were never physically present in the country. Lord Leggatt and Lord Burrows dissented, each delivering separate judgements.

Dr Saeed Shehabi and Mr Moosa Mohammed, both long-term UK residents with refugee or citizenship status, allege that from 2011 agents of Bahrain, operating from a server located there, infected their computers with spyware known as FinSpy, allowing covert access to their data, communications, and device cameras and microphones over a three-year period. They claim to have developed psychiatric injuries after learning of the surveillance in 2014 through information published by WikiLeaks and Bahrain Watch. Bahrain sought a declaration of immunity, arguing that because its agents operated the spyware from outside the UK, no relevant act occurred within the jurisdiction.

The majority rejected that argument, endorsing the Court of Appeal's finding that the remote manipulation of a computer located in England amounts to an act "in the United Kingdom" as a matter of ordinary language, regardless of where the person issuing the instructions happened to be sitting. Drawing a comparison to a burglar remotely disabling a safe's locking mechanism, the majority held that treating what happens abroad as "the act" and what happens in England as merely its "effect" was artificial. They also rejected Bahrain's argument that section 5 should be read as containing an implicit requirement that the perpetrator be physically present in the UK at the time of the act, noting that unlike the equivalent provision in the European Convention on State Immunity, which Parliament had before it when drafting the 1978 Act, section 5 contains no such express presence requirement, and that this omission was, in the majority's view, deliberate.

Lord Leggatt, dissenting, argued the majority had blurred a fundamental distinction between an act and its effects, and that the natural and grammatically correct reading of "an act... in the United Kingdom" refers to conduct performed by a person physically located there, consistent with the wording of both the European and United Nations conventions on state immunity, both of which expressly require the presence of the author of the harm in the forum state. He warned that departing from this settled international consensus without clear parliamentary intention risked placing the UK in breach of its treaty obligations. Lord Burrows likewise dissented, finding the statutory language at least ambiguous and that any ambiguity should be resolved in favour of consistency with Britain's international obligations under the established presumption that legislation implementing a treaty should, where reasonably possible, be read compatibly with it.

The majority further rejected Bahrain's contention that customary international law required a presence requirement, finding a substantial and growing body of state practice supporting a broader territorial exception applicable to sovereign as well as private acts, though they acknowledged no prior case had extended immunity's removal to circumstances where the wrongdoer was never present in the forum state.

The appeal was dismissed, and the claimants' proceedings against Bahrain may now proceed to trial.