EWJ FEB 59 2025 web - Flipbook - Page 56
An IT Crowd: State Immunity and
Spyware in Shehabi v Kingdom of Bahrain
The Court of Appeal decision of Shehabi v Kingdom of Bahrain [2024] EWCA Civ 1158 is
a fascinating appeal concerning a host of issues, from state immunity to statutory interpretation,
and surveillance. The key issue was whether a foreign state whose agents, located abroad, caused
spyware to be installed remotely on the devices of individuals in the United Kingdom (causing
those individuals psychiatric injury upon discovering the state had been spying on them), was
entitled to immunity from civil proceedings.
The claimants’ case was that in September 2011,
Bahrain’s servants or agents, who operated remotely
from outside the UK, hacked their computers with a
spyware program called FinSpy. The claimants
argued that this amounted to harassment under the
Protection from Harassment Act 1977. Expert
evidence supported the claimants’ contention that the
discovery of the hacking of their computers caused
them a psychiatric injury. The first claimant was
alleged to have suffered an adjustment disorder, whilst
the second claimant was alleged to have suffered an
exacerbation of an existing adjustment disorder.
claimants. Mr Justice Julian Knowles held that remote
manipulation from abroad of devices located in the
UK was an act within the UK. Further, the judge held
that the plain meaning of section 5 was that immunity
would not apply if an act or omission causing personal
injury took place in the UK, even if other causative
acts took place abroad. He followed his earlier judgment in Al-Masarir v Kingdom of Saudi Arabia [2022]
EWHC 2199 (QB), [2023] QB 475. On the third issue,
the judge held that psychiatric injury did fall under
“personal injury” within the meaning of section 5. The
Kingdom of Bahrain appealed.
The legal framework within which the issues arose was
common ground between the parties. Section 1(1) of
the State Immunity Act 1978 Act is headed ‘General
immunity from jurisdiction’ and provides:
“A State is immune from the jurisdiction of the courts of
the United Kingdom except as provided in the following
provisions of this Part of this Act.”
Lord Justice Males gave the leading judgment in the
Court of Appeal, dismissing all three grounds of
appeal (Lord Justice Warby and Lady Carr of Waltonon-the-Hill CJ agreed.)
Ground 1 – was there an act by the foreign state in
the United Kingdom?
The first ground of appeal was that the judge in the
court below was wrong to hold that the alleged acts of
computer surveillance took place in the UK rather
than abroad. Lord Justice Males considered that as a
straightforward use of language, remote manipulation from abroad of a device on UK soil was an act
within the UK. At [34] he stated:
In essence, this means that in order for a state to be
subject to the jurisdiction of the UK courts, the proceedings must be of a kind specified in sections 2-11 of
the Act, and if the provisions contained therein do not
apply, then the court lacks jurisdiction.
Section 5 reads as follows:
“A State is not immune as respects proceedings in respect
of–
(a) death or personal injury; or
(b) damage to or loss of tangible property,
caused by an act or omission in the United Kingdom.”
“The true position in such a case is that the agents of the
foreign state commit acts both in this country and abroad. To
distinguish between what happens abroad and what happens
here, characterising the former as an act and the latter as
merely the effect of the act, is artificial and unprincipled. The
reality is that a foreign state which acts in this way is interfering here with the territorial sovereignty of the United
Kingdom.”
The crux of the claimants’ position was that their
psychiatric injuries amounted to personal injury
within section 5 of the State Immunity Act 1978, and
therefore Bahrain was not immune.
He agreed with Mr Justice Julian Knowles that what
was said in R v Governor of Brixton Prison, ex parte Levin
and Ashton Investments Ltd v OJSC Russian Aluminium
(Rusal) was helpful. However, Lord Justice Males was
careful to emphasise that this was not because those
cases set out applicable legal principles – and it would
be dangerous to incorporate principles of extradition
law or the procedure governing service out of the jurisdiction, into the context of state immunity. These
cases were helpful because they demonstrate on comparable facts that to characterise the act of hacking as
taking place in the UK is a natural and appropriate
use of language. In Levin an applicant had used his
There were three main issues:
1. Whether in such circumstances there was an act by
the foreign state in the United Kingdom at all;
2. Whether immunity was only lost if all the acts by
agents of the foreign state took place in the United
Kingdom;
3. Whether psychiatric injury was “personal injury”
within the meaning of section 5.
At first instance, the case was decided in favour of the
EXPERT WITNESS JOURNAL
54
F E B R UA RY 2 0 2 5
