The Kingdom of Bahrain v Shehabi and another [2026] UKSC 25 (27 July 2026)

Bahraini agents allegedly hacked the computers of two UK-based pro-democracy activists using FinSpy spyware, operated remotely from Bahrain, causing psychiatric injury. The Supreme Court held by majority that section 5 of the State Immunity Act 1978 removes state immunity where causative acts occur in the UK, even if the actor is abroad.

Facts

The respondents, Dr Saeed Shehabi and Mr Moosa Mohammed, are Bahraini pro-democracy activists resident in the United Kingdom, both having been granted refugee status or asylum. From around September 2011, agents of the Kingdom of Bahrain allegedly hacked the respondents’ computers, which were located in the UK, using spyware known as ‘FinSpy’. The spyware was operated remotely from Bahrain via a command and control server in Bahrain. It permitted the appellant’s agents to access and exfiltrate data, intercept communications, and use the computers’ microphones and cameras to conduct surveillance. The respondents discovered the hacking in around August 2014 and allegedly suffered psychiatric injury (adjustment disorder) as a result. They brought proceedings alleging harassment contrary to the Protection from Harassment Act 1997. For the purposes of the preliminary issue on state immunity, the facts were assumed to be true.

Issues

The central issue was the correct interpretation of section 5 of the State Immunity Act 1978 (SIA), which removes state immunity for proceedings in respect of death, personal injury or property damage ’caused by an act or omission in the United Kingdom’. Three specific questions arose:

1. Whether section 5 applies only where the responsible or precipitating act was in the UK;
2. Whether section 5 requires every causative act to have occurred in the UK; and
3. Whether section 5 requires the author of the injury to have been physically present in the UK at the time of the relevant act.

Arguments

Appellant (Bahrain)

Bahrain submitted that section 5 required either the responsible/precipitating act to occur in the UK, or all causative acts to occur in the UK, or the author to be present in the UK at the time. It relied heavily on article 11 of the European Convention on State Immunity (ECSI), which contains both a territorial requirement and an express presence requirement, and argued that section 5 should be interpreted consistently with article 11 under the principle of consistent interpretation (The Eschersheim [1976] 1 WLR 430). It also argued that customary international law required immunity for sovereign acts absent presence in the forum.

Respondents

The respondents submitted that section 5 was clear and unambiguous: a state is not immune where a legally causative act occurs in the UK, even if other acts occur abroad and the author is not present. They argued that Parliament had deliberately departed from the wording of article 11 by omitting the presence requirement, and that this was permitted by the UK’s declaration under article 24(1) of the ECSI. In the alternative, they invoked article 6 ECHR via section 3 of the Human Rights Act 1998.

Judgment

The Supreme Court, by a majority (Lord Lloyd-Jones, Lord Hamblen and Lady Simler), dismissed the appeal. Lord Leggatt and Lord Burrows dissented.

Majority reasoning

The majority held that section 5 is clear and unambiguous: it requires only that there be a legally causative act or omission in the UK. There is no requirement that ‘the’ act, or ‘all’ acts, or the author be present in the UK. The natural meaning of ‘act’ includes acts done through mechanical, electrical or remote means, and does not import a presence requirement. As Males LJ had held in the Court of Appeal, the remote manipulation from abroad of a computer located in the UK is an act within the UK; to distinguish between what happens abroad and what happens here, characterising the former as an act and the latter as merely the effect, was described as ‘artificial and unprincipled’.

On article 11 ECSI, the majority held that the SIA was intended to give broad effect to, but not precisely implement, the ECSI. The UK’s declaration under article 24(1) permitted derogation from the ECSI scheme. The majority concluded that Parliament had deliberately departed from the presence requirement in article 11, and that the principle of consistent interpretation therefore had no application. Article 11’s second linking factor (presence) was not reflected in section 5, and this omission was deliberate.

On customary international law, the majority held that there was a reasonable basis for the UK to conclude that it could enact a territorial tort exception applicable erga omnes, not distinguishing between sovereign and non-sovereign acts, and without a presence requirement. Even if no such exception existed in customary international law, this would not support the appellant’s interpretation, since the alternative reading would still breach customary international law. The presence requirement in article 11 ECSI and article 12 UNCSI appears to serve jurisdictional purposes rather than defining the substantive limits of immunity.

Applying section 5 to the pleaded facts, the majority held that the ten classes of alleged acts—including installing spyware on the devices, running it, exfiltrating data, and activating microphones and cameras—all took place in the UK and were legally causative of the injury. The case therefore fell within the section 5 exception.

Dissenting judgments

Lord Leggatt (dissenting) held that section 5 should be interpreted consistently with article 11 ECSI to require the presence of the agent in the UK. He emphasised the distinction between acts and their effects, holding that a human agent can only act where physically located. He drew support from El-Khouri v Government of the United States of America [2025] UKSC 3, where this court had held that ‘conduct’ would normally be understood as acts done by a person in the specified location, not effects felt there. He concluded that the majority’s interpretation placed the UK in breach of its treaty obligations under the ECSI and of customary international law.

Lord Burrows (dissenting) agreed with Lord Leggatt, holding that section 5 was reasonably capable of being interpreted consistently with article 11 ECSI, so the presumption in The Eschersheim was not rebutted. He held that the derogation permitted by article 24(1) ECSI did not extend to sovereign acts absent a supporting customary international law rule, and the respondents had failed to demonstrate any such rule existed.

Implications

The decision confirms that section 5 of the State Immunity Act 1978 removes state immunity where a legally causative act or omission occurs in the United Kingdom, even where other causative acts occur abroad and the author is not physically present in the UK. This has significant implications for claims against foreign states arising from cyber-intrusions, remote surveillance, and other transnational acts committed against persons or property in the UK. The judgment recognises that modern technology enables sovereign acts to be committed remotely with substantial territorial effect, and that such acts may constitute interference with UK territorial sovereignty on the same footing as acts committed by agents physically present in the UK.

The decision also clarifies the relationship between the SIA and the ECSI. The SIA is not a precise implementation of the Convention, and the UK’s declaration under article 24(1) permits departures from the ECSI scheme. The section 5 territorial tort exception applies to both sovereign and non-sovereign acts and applies erga omnes, not merely between contracting states.

The judgment leaves open questions about the precise state of customary international law on the territorial tort exception, particularly as to whether such an exception applied to sovereign acts committed by agents outside the forum in 1978 or today. The majority declined to reach a concluded view on this issue, but held that there was at least a reasonable basis for the UK to legislate as it did. The dissenting judgments highlight the risk that the majority’s interpretation may place the UK in breach of its international obligations.

Practically, this decision matters to victims of state-sponsored surveillance, cyber-attacks, or other harmful conduct affecting them or their property in the UK, and to legal practitioners advising in this area. It also serves as an important precedent for the interpretation of statutes implementing international treaties, particularly where domestic legislation departs from the treaty language.

Verdict: The appeal was dismissed by a majority (Lord Lloyd-Jones, Lord Hamblen and Lady Simler; Lord Leggatt and Lord Burrows dissenting). The Kingdom of Bahrain is not entitled to state immunity in respect of the respondents’ proceedings, as the alleged hacking constituted causative acts in the United Kingdom within the meaning of section 5 of the State Immunity Act 1978.

Source: The Kingdom of Bahrain v Shehabi and another [2026] UKSC 25 (27 July 2026)