UK Supreme Court Denies Bahrain Sovereign Immunity in Remote Spyware Case

On July 27, 2026, the UK Supreme Court issued a significant ruling on the reach of state immunity in the age of remote and digital state conduct. In The Kingdom of Bahrain v Shehabi and another [2026] UKSC 25, a divided 3 to 2 majority held that Bahrain could not claim immunity from tort claims brought by two London based activists whose computers were allegedly hacked and infected with spyware by Bahraini agents operating from abroad.

Background

Dr Saeed Shehabi, a pro democracy journalist who has lived in the UK since 1973, and Mr Moosa Mohammed, a human rights activist who fled Bahrain in 2006, allege that from around September 2011 persons acting on behalf of Bahrain hacked or infected their UK based computers with spyware. They allege they suffered psychiatric harm upon learning of the surveillance in 2014, following disclosures by WikiLeaks and Bahrain Watch, and framed their claim as harassment under the Protection from Harassment Act 1997.

Bahrain invoked state immunity under the State Immunity Act 1978. Section 5 of that Act removes immunity for personal injury or property damage caused by an act or omission in the United Kingdom, the so called territorial tort exception. Bahrain argued that because its agents were operating from outside the UK, with the spyware controlled through a server in Bahrain, the exception did not apply.

The Ruling

The Supreme Court disagreed. The majority held that section 5 requires only a legally causative act in the UK, not physical presence of the responsible agent in the UK. Remotely hacking a computer located in the UK, the Court reasoned, is itself an act in the UK because it interferes with the territorial sovereignty of the United Kingdom, just as a drone triggered explosion or a remotely detonated device would be. The Court found this reading consistent with Parliament's deliberate choice to depart from the narrower presence requirement found in Article 11 of the European Convention on State Immunity.

Two justices dissented. Lord Leggatt, drawing on the Court's own recent decision in El Khouri v USA, would have held that an act is done where the actor is located, not where its effects are felt, so a command entered from Bahrain remains an act in Bahrain even though its effects are felt instantly in the UK. Lord Burrows separately argued that section 5 is properly read consistently with the presence requirement in the European Convention on State Immunity, and that the UK was not free to derogate from it.

Why It Matters

This decision meaningfully widens the practical reach of the territorial tort exception for claims arising from extraterritorial state conduct with effects inside the UK, including cyber intrusion, digital surveillance, and potentially other remotely directed harms. It builds on the High Court's earlier reasoning in Al Masarir v Kingdom of Saudi Arabia, and confirms that approach at the highest level, though the narrow margin leaves room for future argument in factually different cases.

For human rights defenders, journalists, and dissidents living in exile who have been targeted by digital surveillance from abroad, the ruling opens a path to accountability in the English courts that previously appeared foreclosed by sovereign immunity. It is likely to be cited in future UK litigation against states accused of directing surveillance, cyber intrusion, or other remote harms at individuals within the United Kingdom.

This post is provided for general informational purposes and does not constitute legal advice.