Key Takeaways
- The UK Supreme Court ruled 3‑to‑2 that Bahrain cannot invoke state immunity to block a lawsuit alleging that its agents hacked the laptops of two British‑based dissidents with FinSpy spyware.
- The Court held that the alleged surveillance, although initiated abroad, took effect in the United Kingdom, bringing the claim within the “personal injury” exception to state immunity under UK law.
- The decision overturns Bahrain’s successive victories in the High Court and Court of Appeal, allowing the claimants to proceed with their damages claim for psychiatric harm.
- The judgment clarifies the territorial scope of the personal injury exception, emphasizing that harm suffered in the forum state can defeat immunity even when the malicious act originates elsewhere.
- Legal experts view the ruling as a significant development for transnational human‑rights litigation, potentially opening doors for similar cases against states accused of cyber‑espionage and digital repression.
- The claimants, Saeed Shehabi and Moosa Mohammed, welcomed the decision as a step toward accountability, while Bahrain maintains its denial of any wrongdoing and may consider further legal avenues.
Background of the Claimants and the Alleged Spyware Attack
Saeed Shehabi and Moosa Mohammed are Bahraini political activists who have lived in the United Kingdom for several years. Both men have been involved in advocacy work concerning political prisoners and human‑rights abuses in Bahrain, a Gulf kingdom that has faced international criticism for its crackdown on dissent. According to their lawsuit filed in London’s High Court in 2020, around 2011 agents of the Bahraini government infected their personal computers with a sophisticated surveillance tool known as FinSpy (also marketed as FinFisher). FinSpy is capable of covertly capturing keystrokes, screenshots, audio, video, and files, enabling the operator to monitor virtually all activity on the compromised device. The claimants allege that the spyware allowed Bahraini intelligence services to monitor their communications with detained activists, lawyers, and journalists, thereby causing them severe psychiatric harm, including anxiety, depression, and a persistent fear of reprisal. Bahrain has consistently denied any involvement in the alleged hacking, characterizing the accusations as baseless and politically motivated.
Procedural History: From High Court to Supreme Court
The claimants initiated their claim in the High Court of England and Wales in 2020, seeking damages for the alleged psychiatric injury resulting from the spyware intrusion. Bahrain responded by asserting state immunity, a doctrine that shields foreign governments from being sued in the courts of another state without their consent. The High Court rejected Bahrain’s immunity plea in 2023, finding that the alleged acts fell within the personal injury exception to state immunity under Section 13 of the State Immunity Act 1978. Bahrain appealed, and the Court of Appeal upheld the High Court’s decision the following year, emphasizing that the harmful effects of the spyware were experienced in the United Kingdom. Unsettled by the appellate rulings, Bahrain petitioned the United Kingdom’s Supreme Court, the nation’s highest judicial authority, arguing that the alleged hacking occurred abroad and therefore fell outside the territorial scope of the exception. The Supreme Court heard the case in early 2025 and delivered its judgment on Monday, 3 November 2025.
Supreme Court’s Ruling and the Personal Injury Exception to State Immunity
In a 3‑to‑2 majority decision, the Supreme Court dismissed Bahrain’s appeal and affirmed that the claim could proceed. The Court’s reasoning centered on where the injury was suffered rather than where the malicious act originated. It held that the personal injury exception applies when the claimant experiences the relevant harm within the forum state, irrespective of whether the tortious conduct was initiated elsewhere. The judgment noted that FinSpy’s functionality—capturing data, transmitting it to remote servers, and enabling real‑time monitoring—produced a continuous and ongoing intrusion that the claimants felt in their homes and workplaces in Britain. Consequently, the alleged psychiatric injury was deemed to have occurred in the United Kingdom, satisfying the statutory requirement for the exception. The majority further clarified that state immunity is not a blanket bar; it yields when the claim is grounded in a tort that has a substantial connection to the forum, especially when the claim involves personal injury. The dissenting judges argued that the connection was too tenuous and warned of expanding judicial interference in foreign states’ internal affairs, but the majority concluded that the legislative intent behind the personal injury exception was to protect individuals suffering harm on UK soil.
Implications for State Immunity Doctrine and Transnational Litigation
The ruling refines the boundaries of state immunity in the United Kingdom, particularly concerning modern forms of transnational harm such as cyber‑espionage. By affirming that harm suffered domestically can defeat immunity even when the offending act originates abroad, the decision aligns UK law with a growing trend in other common‑law jurisdictions that recognize the extraterritorial reach of torts involving digital intrusions. Legal scholars suggest that the judgment may encourage claimants to pursue similar actions against other states accused of using spyware, surveillance technology, or other cyber‑tools to target dissidents, journalists, or human‑rights defenders residing in the UK. It also signals to foreign governments that immunity will not automatically shield them from liability for conduct that causes measurable injury within the UK, potentially influencing state behavior regarding cross‑border cyber operations. Conversely, critics caution that the decision could lead to a surge of litigation that strains diplomatic relations and raises concerns about judicial overreach into sovereign affairs. The Supreme Court’s interpretation, however, remains grounded in the statutory language of the State Immunity Act 1978 and the principle that states cannot claim immunity to evade responsibility for personal injury inflicted on individuals present in the forum.
Responses and Broader Context of Digital Surveillance and Accountability
The claimants welcomed the judgment as a vindication of their efforts to hold Bahrain accountable for what they describe as a blatant violation of their privacy and mental well‑being. Saeed Shehabi stated that the ruling “confirms that no state can hide behind immunity when it harms people on British soil,” while Moosa Mohammed emphasized the importance of the decision for other activists facing digital repression. Human‑rights organizations such as Amnesty International and Privacy International praised the outcome, noting that it reinforces the responsibility of states to refrain from unlawful surveillance and provides a potential avenue for redress for victims of cyber‑attacks. Bahrain’s government, through its legal representatives, reiterated its denial of any involvement in the alleged hacking and expressed disappointment with the Court’s finding, indicating that it may explore further legal options, including seeking clarification or potentially pursuing diplomatic channels. The case also highlights the pervasive use of FinSpy and similar commercial spyware by authoritarian regimes to monitor critics, a practice documented by investigative outlets and cyber‑security firms. The judgment underscores the growing role of national courts in addressing transnational digital harms where international mechanisms may be lacking or ineffective.
Next Steps and Potential Outcomes of the Case
With the Supreme Court’s denial of Bahrain’s immunity claim, the litigation will return to the High Court for a full trial on the merits. The claimants will need to prove that Bahraini agents were responsible for installing FinSpy on their laptops and that this conduct caused the psychiatric injury they allege. Evidence may include forensic analysis of the compromised devices, expert testimony on the capabilities and typical usage of FinSpy, and documentation linking the spyware to Bahraini intelligence agencies. Bahrain, meanwhile, will likely continue to deny involvement and may challenge the admissibility of certain evidence or seek to limit damages. Should the claimants succeed, they could be awarded compensatory damages for psychological distress, potentially setting a financial precedent for future cyber‑tort claims against states. Even if the claim ultimately fails, the Supreme Court’s decision already establishes an important jurisprudential marker: the personal injury exception to state immunity is not confined to acts wholly committed within the forum state, but extends to situations where the harmful effects are felt there. This clarification will likely influence how courts across the UK and potentially other common‑law countries handle future cases involving cyber‑espionage, transnational repression, and the limits of sovereign immunity.