The Supreme Court has given judgment in an appeal on how section 5 of the State Immunity Act 1978 applies to injury claims against a foreign state, in a case about spyware on computers in the UK.
Key facts
- Who: People and organisations affected by the state immunity exception for personal injury and property damage caused by an act or omission in the UK.
- From: 27 July 2026 (judgment date)
- Source: The Kingdom of Bahrain v Shehabi and another [2026] UKSC 25
On 27 July 2026 the Supreme Court gave judgment in The Kingdom of Bahrain v Shehabi and another [2026] UKSC 25, following a hearing on 26 and 27 November 2025. The appeal was from the Court of Appeal ([2024] EWCA Civ 1158). The case concerns section 5 of the State Immunity Act 1978.
Background
Section 1 of the Act gives a foreign state general immunity from the jurisdiction of the courts of the United Kingdom, subject to listed exceptions. Section 5 provides that a state is not immune in proceedings in respect of death or personal injury, or damage to or loss of tangible property, "caused by an act or omission in the United Kingdom".
The respondents are Dr Saeed Shehabi and Mr Moosa Mohammed, activists for democracy and human rights in Bahrain who live in the UK. They allege that from around September 2011 people acting for Bahrain infected their computers with a spyware program called FinSpy. The facts are taken from their pleaded case and assumed to be correct for the preliminary issue on appeal.
On those assumed facts, the operators were likely working remotely from outside the UK and the spyware was run through a server in Bahrain, while the respondents and their computers were in the UK. The respondents say it let the operators copy information, intercept communications and use the computers' microphones and cameras. They say this amounted to harassment under the Protection from Harassment Act 1997, and that they suffered psychiatric injury when they learned of it in or around August 2014.
The questions
Bahrain argued that section 5 applies only if:
- the act or omission causing the injury was the responsible or precipitating act or omission;
- every act or omission causing the injury took place in the UK; or
- the person responsible was present in the UK when the facts occurred.
If Bahrain was right on any of these, state immunity would apply to the proceedings.
The earlier decisions
Julian Knowles J dismissed Bahrain's application for a declaration of immunity ([2023] EWHC 89 (KB)). The Court of Appeal dismissed its appeal. It held that remote manipulation from abroad of a computer in the UK is an act within the UK, and that a foreign state is not immune for injury caused by an act in the UK even if other causative acts took place abroad.
The Supreme Court considered the wording of section 5 in context, the European Convention on State Immunity, customary international law and supporting materials. The respondents also argued, if necessary, that granting immunity would breach their right of access to a court under article 6 of the European Convention on Human Rights.
What this means for people affected by state immunity questions
The judgment concerns how far section 5 reaches where some of the conduct took place outside the UK. Anyone whose situation involves a foreign state should read the full judgment and take legal advice on how it applies.
Sources
- The Kingdom of Bahrain v Shehabi and another [2026] UKSC 25, Supreme Court, 27 July 2026