Supreme Court rejects Bahrain’s invocation of state immunity against liability for spyware hacking against pro-democracy activists

About this case:

• Citation:
  [2026] UKSC 25
• Judgment:
  External link
• Court:
  UK Supreme Court
• Judge:
  Lord Lloyd-Jones, Lord Hamblen and Lady Simler

The Kingdom of Bahrain sought to invoke state immunity against tort claims brought by two campaigners whose computers had allegedly been infected with spyware at the hands of Bahraini state agents. Unsuccessful submissions before the trial judge and Court of Appeal led to further argument before the UK Supreme Court.

The appeal was heard by Lord Lloyd-Jones, Lord Hamblen, Lord Leggatt, Lord Burrows and Lady Simler, with Tom Hickman KC, Robert Volterra and Stephen Donnelly appearing for the appellant and Timothy Otty KC, Ben Silverstone and Philippa Webb for the respondent.

Remote spyware infection

Legal argument in the appeal proceeded on a set of assumed facts. Both respondents campaign for democracy in Bahrain, having fled the country for the United Kingdom as refugees. The first respondent leads the opposition group Bahrain Freedom Movement, while the second respondent works as a photographer, videographer and human rights activist.

In 2011, Bahraini state agents infected the respondents’ computers with a spyware program enabling audio and video surveillance, in addition to wide-ranging access to the respondents’ files and communications. Installation of the spyware, operated via a server located in Bahrain, was conducted remotely from Bahrain. Following the publication of information by WikiLeaks in 2014, the respondents suffered psychiatric injury in the form of adjustment disorder as a result of discovering that they had been subject to the spyware program.

The appellant, the Kingdom of Bahrain, sought a declaration of immunity in respect of the respondents’ personal injury in terms of the State Immunity Act 1978 (“SIA”). Enacted in partial implementation of the European Convention on State Immunity (“ECSI”), the SIA grants immunity from the jurisdiction of UK courts to States subject to various exceptions. One such exception lies in section 5 of the SIA, which provides, so far as material, that a State “is not immune as respects proceedings in respect of death or personal injury … caused by an act or omission in the United Kingdom”.

At issue in the proceedings were three questions: namely, whether the term ‘act’ in section 5 refers solely to the act responsible for, or which precipitated, the injury; whether immunity is only excluded where every act causing injury took place in the UK; and whether immunity is only excluded where the author of the injury was present in the UK at the time when the relevant facts took place.

Interference with UK territorial sovereignty

Emerging as the majority on a court split three to two, Lord Lloyd-Jones, Lord Hamblen and Lady Simler reasoned: “Section 5 of the SIA is expressed in straightforward language. It provides that a foreign state is not immune as respects proceedings in respect of personal injury caused by an act or omission in the United Kingdom. The section requires an act in the United Kingdom which is causative of personal injury or damage to property. As a matter of ordinary language, there is no requirement in section 5 for ‘the’ act or ‘all’ acts to be in the United Kingdom, still less is there any express requirement of presence in the United Kingdom for the author of the relevant act … The words ‘caused by an act or omission’ naturally import the legal requirements of causation in the area of law concerned … This will exclude acts which are not legally causative because too remote, insignificant or non-operative.”

Addressing the appellant’s arguments on the relationship between section 5 SIA and article 11 ESCI, the majority noted: “One purpose of the SIA was to permit the United Kingdom to become a party to the ESCI. However, it is clear that while the SIA was intended to give broad effect to the ESCI it was not intended to implement it precisely … This is permitted by a power of derogation conferred by article 24(1) of the ESCI and the UK declaration on ratification … The exception created by article 11 is expressly limited to cases where the author of the injury or damage was present in the territory of the forum state at the time when the facts which occasioned the injury or damage occurred. No corresponding words appear in section 5 of the SIA.”

They continued: “On behalf of the appellant [counsel] relies on the principle of consistent interpretation as expressed by Lord Diplock in The Eschersheim (1976) … [that] ‘If there be any difference between the language of the statutory provision and that of the corresponding provision of the Convention, the statutory language should be construed in the same sense as that of the Convention if the words of the statute are reasonably capable of bearing that meaning’ … We do not accept this submission. The words of section 5 are not reasonably capable of bearing the same meaning as the words of article 11 which impose the presence requirement … [T]he principle of consistent interpretation has no application here.”

Applying the law as they regarded it to the assumed facts of the respondents’ case, the majority reasoned: “Taken together we agree with the courts below that these assumed facts constitute a causative act or series of acts in the United Kingdom. In essence, these acts involved surveillance of the respondents. That surveillance was of persons in the United Kingdom by means of the hacking of computers in the United Kingdom. It took place in the United Kingdom even if it may have been initiated from abroad. It involved an interference with the territorial sovereignty of the United Kingdom … and it caused injury to the respondents.”

Giving rhetorical consideration to further hypothetical examples, they concluded: “[The appellants’ interpretation] would also lead to arbitrary distinctions being drawn. The appellant now accepts … that the murder of someone within the United Kingdom by agents present here but acting on the instructions of a foreign state would not involve immunity, with the notorious case of the polonium poisoning of Alexander Litvinenko being cited as an example. There would, however, be immunity if the same murder was carried out by a drone operated by a state official from abroad planting and detonating a bomb. Similarly, there would be immunity if such drones entered the airspace of Heathrow causing aeroplanes to crash and multiple deaths or if NHS computer systems were hacked by operatives in a foreign state and put out of operation causing patients to die. Such acts would plainly also involve serious and intrusive interference with the territorial sovereignty of the United Kingdom. In our view, given the current state of both international and UK law, such acts are not entitled to state immunity before UK courts.”

The appeal was accordingly dismissed.