UK Supreme Court Rules Foreign States Can Be Sued for Remote Spyware Attacks

The borderless nature of cyber-surveillance has long collided with the rigid, territorial rules of international diplomacy. If a government intelligence operator in the Middle East clicks a button to infect a laptop sitting on a desk in London, where did the attack actually happen? For years, states have operated under the assumption that because the physical keystroke occurred within their own borders, they were legally untouchable in the victim's country.

The UK Supreme Court has now provided a definitive answer that upends that assumption. In a landmark 3-2 decision handed down in late July 2026, the court ruled that the act occurs where the device is compromised. This effectively strips foreign states of their sovereign immunity for remote cyberattacks that cause harm on British soil, establishing a new frontier for digital accountability.[1][5][8]

The case that forced this legal reckoning, Kingdom of Bahrain v Shehabi, centers on two prominent Bahraini dissidents living in exile in the UK: Dr. Saeed Shehabi and Moosa Mohammed. Both men allege that their personal computers were covertly infected with commercial spyware by agents acting on behalf of the Bahraini government.[2][4]

The software in question is FinSpy, a sophisticated surveillance suite developed by the now-defunct German firm FinFisher. Unlike standard malware designed to steal passwords or display advertisements, FinSpy is marketed exclusively to law enforcement and intelligence agencies as a tool for total environmental control.[3][8]

Once deployed, the spyware does not merely exfiltrate static files. It logs every keystroke, intercepts encrypted communications, tracks the device's physical location, and can covertly activate the computer's microphone and camera to monitor the user's physical surroundings in real time.[4][8]

Shehabi and Mohammed allege that their devices were infected around September 2011, during the height of the Arab Spring protests, allowing Bahraini intelligence to monitor their communications with political prisoners and other activists for years. They only discovered the breach in 2014 following data leaks published by WikiLeaks and the watchdog group Bahrain Watch.[2][3][7]

In 2020, the two men filed a civil lawsuit against the Kingdom of Bahrain in the UK High Court. Because English law requires a specific type of damage to bypass certain legal hurdles, they sued for the severe psychiatric injury caused by the prolonged harassment and profound invasion of their privacy.[7][8]

Bahrain categorically denied the hacking allegations. However, rather than arguing the facts of the intrusion at this stage, the kingdom's legal defense relied on a much older shield: the State Immunity Act 1978. They argued that as a sovereign nation, Bahrain was immune from the jurisdiction of British courts.[6][8]

The core of Bahrain's argument rested on geography. Their lawyers contended that even if the hacking occurred exactly as alleged, the agents who initiated the cyber operation were located in Bahrain, not the UK. Therefore, the British legal system had no authority to intervene in the actions of a foreign state operating from its own soil.[5][8]

This forced the Supreme Court to interpret Section 5 of the State Immunity Act, known as the "territorial tort exception." This clause states that a foreign country is not immune from lawsuits regarding personal injury or property damage "caused by an act or omission in the United Kingdom."[1][5]

The majority opinion, delivered by Lord Lloyd-Jones, Lord Hamblen, and Lady Simler, concluded that the remote manipulation of a computer located in the UK constitutes an act within the UK. They rejected the premise that the foreign state's agents had to be physically present in Britain for the exception to apply.[8]

To illustrate the absurdity of Bahrain's interpretation, the majority justices offered a series of modern hypothetical scenarios. They noted that if physical presence were strictly required, a foreign state could remotely detonate a drone in London, or hack National Health Service (NHS) computers causing patient deaths, and still claim absolute legal immunity.[8]

The decision was not unanimous. Dissenting justices Lord Leggatt and Lord Burrows warned that the majority's interpretation could place the UK in breach of customary international law. They argued that international conventions have historically required the "author of the injury" to be physically present in the forum state when the tortious act occurs.[1][8]

Despite the dissent, the ruling bridges a critical gap between 20th-century legislation and 21st-century cyber warfare. By legally recognizing that a digital intrusion is a physical event on British territory, the judiciary has expanded the reach of domestic tort law to cover the realities of modern transnational repression.[1][5]

For authoritarian regimes that increasingly rely on commercial spyware to track dissidents, journalists, and human rights defenders across borders, the legal landscape has fundamentally shifted. The UK is no longer a safe harbor where foreign intelligence services can operate digitally without fear of civil liability.[2][4]

The implications extend far beyond this single lawsuit. Legal analysts note that the State Immunity Act 1978 has served as a model for similar legislation throughout the common law world, including in Australia and Singapore. Courts in those jurisdictions may now look to the UK Supreme Court's reasoning when handling their own state-sponsored hacking cases.[5]

With the jurisdictional shield removed, the case of Kingdom of Bahrain v Shehabi will now return to the High Court for a full trial on the merits. For the first time, a foreign state will be forced to answer for its alleged digital intelligence operations in a British courtroom, shifting the debate from theoretical immunity to concrete digital forensics.[2][7]