No state immunity for spy software

In Shehabi v Kingdom of Bahrain [2024] EWCA Civ 1158 last week, the court upheld an earlier High Court ruling that the Kingdom of Bahrain does not have sovereign immunity under the State Immunity Act 1978 regarding its alleged use of FinSpy surveillance software to infiltrate the computers of dissidents Dr Saeed Shehabi and Moosa Mohammed.

Shehabi and Mohammed had engaged in political activism to highlight and condemn human rights abuses in Bahrain for a number of years. They believed their laptops were infected in 2011 by the malicious software FinSpy, which records voice calls, messages, emails, contacts lists, browsing history, documents and videos, and allows recording of live audio from the laptop’s microphone and camera.

The case centred on whether a foreign state whose agents abroad cause spyware to be installed on the computers of individuals in the UK, causing those individuals psychiatric injury, is entitled to immunity from civil proceedings.

Dismissing all three grounds of Bahrain’s appeal, Lady Carr, the Lady Chief Justice, and two Lords Justice of Appeal held the remote manipulation of a computer located in the UK is an act within the UK, a foreign state does not have immunity for personal injury caused by an act in the UK, and personal injury under s 5 of the 1978 Act includes standalone psychiatric injury.

Ida Aduwa, senior associate solicitor at law firm Leigh Day, representing Shehabi and Mohammed, said: ‘This measured and detailed ruling sets an important precedent and will provide greater protection to dissidents living in the UK who are targeted by the states whose deplorable actions they are working to fight against.’

The facts of the case are similar to Al-Masarir v Kingdom of Saudi Arabia [2022] EWHC 2199 (QB), [2023] QB 475 in which the High Court rejected Saudi Arabia’s argument that s 5 of the 1978 Act applies only to private law acts and not to foreign state-authorised acts in the UK. The appeal in Al-Masarir was dismissed before it could be heard.