The UK Supreme Court announced on July 27 that the Kingdom of Bahrain cannot claim state immunity to block a lawsuit brought by pro-democracy dissidents who allege spyware was implanted on their devices.
The appeal was the country’s last opportunity to avoid a reputationally damaging trial for the hacking of the exiled activists’ computers.
The contentious nature of the judgment is highlighted by the split decision of the justices, with two of the five dissenting from the decision.
Regardless, the ruling represents a victory for the Bahraini opposition movement, as well as for human rights campaigners who have long sought to raise awareness of foreign governments using spyware to both monitor and menace dissidents residing in the UK.
Meanwhile, dissenting voices are concerned about the diplomatic implications of a ruling which makes the UK legal environment a global outlier.
Background of case
Bahrain is a constitutional monarchy in which King Hamad bin Isa Al Khalifa appoints the cabinet and legislative power is severely constrained. According to Human Rights Watch, the country’s elections “are neither free nor fair” with authorities systematically excluding and repressing opposition voices.
Saeed Shehabi, 71, and Moosa Mohammed, 45, are prominent pro-democracy activists who have made their homes in the UK after experiencing repression. Both men sued the Bahraini state in 2020, and had their citizenship revoked.
Shehabi and Mohammed allege their computers were hacked in September 2011 and implanted with the digital surveillance software FinSpy, a FinFisher product made by the Gamma group.
FinSpy malware can collect and transmit data from an infected device, including by turning on the microphone to record audio, activating the camera to capture images, stealing files the user interacts with, taking screenshots, and intercepting calls.
The hacking of their devices was revealed in 2014, after which the two men turned to London’s High Court, seeking damages for alleged harassment and resulting psychiatric injury.
They are represented by the law firm Leigh Day, which has also represented Kenyan veterans tortured in the 1950s, workers in equal pay claims against major companies, and injured members of British Cycling.
Rebecca White, a spyware expert for Amnesty International, told EU Reports that the development of “military grade spyware” was contributing to “a global surveillance crisis”, and that the use of spyware to monitor activists is a form of transnational repression with “huge psychological and mental health impacts”.
Bahrain has argued through its lawyers that it should be afforded state immunity under the State Immunity Act 1978, since the agent of the alleged crime would have been outside of the United Kingdom at the time.
Having lost appeals in the High Court and the Court of Appeal, Bahrain took their case to the highest court in the United Kingdom in the hope that the claimants’ case would be dismissed.
Section 5 of the State Immunity Act, however, provides that states cannot claim immunity in cases involving personal injury resulting from an act or omission that occurred in the UK.
A key issue in the judgment also concerned whether hacking a computer in the UK from abroad constituted an act in the UK. But, by the 3-2 split decision, the five Justices ruled that hacking a computer located in the UK by a foreign agent situated abroad is, indeed, an act in the UK, clearing the way for the pro-democracy activists to bring a claim for the harm they have suffered against the Gulf state.
Legal implications
“Avenues for accountability have been hard to come by for victims of spyware abuse and judgments like this one open up a pathway to justice,” White explained.
However, some caution that the ruling could have implications that extend far beyond espionage cases. According to Lord Leggatt, one of the two dissenting judges, the Supreme Court’s interpretation of the State Immunity Act could signify that the UK is “acting unilaterally and in breach of its international obligations under both the European Convention and customary international law.”
Jehad Mustafa, partner at London-based law firm Farrer & Co, shared his concern with EU Reports that the consequences of the judgement could be profound.
“By holding that a foreign state can face proceedings in England for sovereign conduct directed from abroad, the UK has become an outlier in the international community,” he said. A perceived infringement on sovereignty by English Courts could, in other words, prompt states to reassess their diplomatic and economic engagement with the UK, especially where this exposes assets to enforcement risk.
A human rights precedent
Regardless of how states respond, the judgment could lead to a surge in cases being brought in the UK for digital crimes carried out abroad but with some effects in the UK.
“After more than six years in the courts, the Supreme Court has confirmed the argument we built this claim around: a foreign state that reaches into the UK to spy on dissidents living here cannot hide behind state immunity, even if some of its conduct takes place abroad,” said Ida Aduwa, senior associate solicitor at Leigh Day, while praising her clients’ courage.
“For the many human rights defenders, journalists and members of civil society who have made the UK their home in the belief that it would offer them protection, the English Courts are now demonstrably open to them.”
Meanwhile, Mohammed said in a statement that “the era of abusing victims while hiding behind state immunity is over.”
“This is not just a victory for us, but for everyone targeted by authoritarian states beyond their own borders. The court’s message is clear: states that abuse people on British soil will be held accountable,” added Shehabi.
The ruling is also expected to clarify the legal position for other spyware-related claims being pursued by Leigh Day.
Featured image: courtesy of Leigh Day
