The Supreme Court held, by a majority, that the Kingdom of Bahrain is not immune from English proceedings in which two activists living in the United Kingdom claim psychiatric injury from the remote hacking of their computers. Section 5 of the State Immunity Act 1978 removes immunity where personal injury is caused by an act in the United Kingdom, even if the foreign state’s agents were abroad. The appeal was dismissed on assumed facts; whether the hacking occurred, and whether Bahrain is liable, was not decided.
The appeal decided a preliminary question of state immunity, not whether Bahrain had hacked anyone. Dr Saeed Shehabi and Mr Moosa Mohammed claim damages for harassment. For the immunity question, the courts treated their pleaded case as correct.
Law Teacher writing support
Writing a law essay?
We choose a writer who is an expert in your area of law and qualified to at least the academic level you select. Most of our writers hold a master’s degree or PhD, have teaching experience, or both.
Send us your question and, if you wish, any marking criteria. We’ll write an essay to your instructions.
The assumed facts
Dr Shehabi and Mr Mohammed are activists in the Bahraini opposition who live in the United Kingdom. They allege that, from around September 2011, people acting for Bahrain infected their computers in the United Kingdom with spyware called FinSpy. On that case, the operators were likely working remotely from outside the United Kingdom, through a command-and-control server in Bahrain, while the respondents and their computers were here. The spyware is said to have allowed access to and removal of information, interception of communications, and use of the computers’ microphones and cameras. The respondents say this was harassment contrary to the Protection from Harassment Act 1997. They learned of it in or around August 2014 and claim psychiatric injury: Dr Shehabi developed an adjustment disorder, and Mr Mohammed suffered a significant worsening of an adjustment disorder he already had.
The statutory question
Section 1 of the State Immunity Act 1978 gives a foreign state immunity from the jurisdiction of United Kingdom courts unless an exception applies. Section 5 removes immunity for proceedings for death or personal injury, or damage to or loss of tangible property, caused by an act or omission in the United Kingdom. Unlike some other exceptions, it does not distinguish between sovereign and non-sovereign acts. It was common ground that the alleged conduct was sovereign activity.
Bahrain argued that section 5 still did not apply. It said the exception covers only the responsible or precipitating act; or only where every causative act took place in the United Kingdom; or only where the person who caused the injury was present here. Any of those readings would have preserved immunity. The High Court and the Court of Appeal rejected them, and Bahrain appealed.
The majority’s reading
Lord Lloyd-Jones, Lord Hamblen and Lady Simler held that the ordinary meaning is clear. Section 5 requires an act or omission in the United Kingdom which is legally causative of the injury. One legally causative act in the United Kingdom is sufficient. Other causative acts may take place abroad, and the person responsible need not be physically present here. The words import the legal requirements of causation, so an act that is too remote, insignificant or non-operative is not enough. No further qualification needs to be read in.
They rejected the argument that the only relevant act was the inputting of instructions abroad, with events on the computers treated as secondary. A tort claim may have more than one legally causative act, and section 5 does not impose a different causation test. They also rejected the argument that the Interpretation Act 1978 requires every causative act to be in the United Kingdom. A claimant who relies on causative acts here need not prove that no causative act occurred elsewhere.
They agreed with Males LJ that, as a straightforward use of language, remotely manipulating a computer located in the United Kingdom is an act in the United Kingdom. Calling what happens here a mere effect of an act abroad was, in their view, artificial. A foreign state which acts in that way interferes with the United Kingdom’s territorial sovereignty.
The European Convention and customary international law
One purpose of the 1978 Act was to enable ratification of the European Convention on State Immunity. Article 11 removes immunity for personal injury or damage to tangible property only if the facts which occasioned the harm occurred in the forum state and the author was present there. It was common ground that this claim would not fall within article 11.
The majority held that the Act was intended to give the Convention broad effect, not to copy it. Article 24, under which the United Kingdom made a declaration, permits a wider exception than the Convention’s listed exceptions, provided immunity is not denied for sovereign acts which customary international law requires to be immune. They did not read that limit as preserving immunity for every sovereign act. Article 11 itself applies to sovereign as well as non-sovereign acts.
They held that omitting a presence requirement was deliberate. If Parliament had wanted both of article 11’s links with the forum, it could have included both. The presumption that legislation should be read consistently with a treaty therefore did not apply. Where Parliament has plainly laid down the law, the courts must apply it even if that would place the United Kingdom in breach of a treaty.
The majority did not decide whether customary international law contains a general territorial exception covering sovereign acts which cause injury. They held that it did not compel a presence requirement to be read into section 5. In their view there was a reasonable basis for enacting an exception of general application where a relevant act took place in the United Kingdom. They added that, even if customary international law contained no such exception, reading in a presence requirement would not cure that difficulty, because section 5 already applies to sovereign acts performed here.
The pleaded hacking
The respondents pleaded ten classes of acts in the United Kingdom, including transmitting and installing FinSpy on computers located in England, running it, storing and exfiltrating information, and activating microphones and cameras. The majority agreed that, taken together, these assumed facts were legally causative acts here. The alleged surveillance was of people in the United Kingdom, carried out by hacking computers here, even if initiated abroad. On that basis the claim fell within section 5.
Because immunity did not apply, the majority did not decide the respondents’ further argument that granting immunity would breach their right of access to a court under article 6 of the European Convention on Human Rights.
The dissent
Lord Leggatt would have allowed the appeal. He considered that an act is done where the person is, not where its effects are felt: commands entered abroad may affect a computer here almost immediately, but the acts remain abroad. He would have read section 5 consistently with article 11, so that immunity is lost only if the agent was in the United Kingdom. In his view the majority’s reading places the United Kingdom in breach of the European Convention and customary international law. He also rejected the article 6 argument, holding that immunity on these facts still reflected international law and was a proportionate restriction on access to a court. Lord Burrows agreed with that essential reasoning. He considered section 5 ambiguous and reasonably capable of requiring the agent’s presence, so the presumption of a treaty-consistent reading was not rebutted. He too would have allowed the appeal.
Verdict: By a majority, the Supreme Court dismissed Bahrain’s appeal. On the assumed facts, the claim falls within section 5 of the State Immunity Act 1978, so Bahrain is not immune and the proceedings may continue. The Court made no finding that the hacking occurred or that Bahrain is liable. The majority left undecided the respondents’ alternative argument that immunity would breach their right of access to a court under article 6 of the European Convention on Human Rights. Lord Leggatt and Lord Burrows dissented and would have allowed the appeal.
Source: The Kingdom of Bahrain v Shehabi and another [2026] UKSC 25
