Bahrain v Shehabi [2026] UKSC 25: UK Supreme Court Landmark Ruling on State Immunity, Spyware, and Cross-Border Digital Surveillance

Introduction

The judgment in The Kingdom of Bahrain v Shehabi and Another [2026] UKSC 25, delivered by the United Kingdom Supreme Court on 27 July 2026, is a major development in the law of state immunity, cross-border cyber surveillance, and digital territoriality.

By a 3–2 majority, the Supreme Court dismissed Bahrain’s appeal and held that the claim brought by two Bahraini dissidents could proceed notwithstanding Bahrain’s reliance on state immunity under the State Immunity Act 1978 (SIA).

The case arose from allegations that Bahraini agents remotely infected the claimants’ computers in the United Kingdom with FinSpy spyware, enabling covert access to data, interception of communications, and use of microphones and cameras for surveillance. The alleged operators were outside the UK, and the command-and-control server was in Bahrain, but the targeted computers and the claimants were in the UK.

The Central Legal Question

The central legal question was therefore deceptively simple:

Can a foreign state’s remote digital operation constitute an “act … in the United Kingdom” for the purposes of section 5 of the State Immunity Act 1978, even when the foreign state’s agent is physically outside Britain?

The majority answered yes.

The decision is potentially landmark because it applies a 1978 statutory framework to a form of state conduct—remote digital surveillance—that does not depend upon the physical presence of the perpetrator in the territory.

The Facts: Alleged FinSpy Surveillance of Bahraini Dissidents

The respondents were Dr. Saeed Shehabi, a pro-democracy journalist and activist, and Moosa Mohammed, a photographer, videographer, and human rights activist. Both lived in the United Kingdom. Their pleaded case was that, from approximately September 2011, persons acting on behalf of Bahrain hacked or infected their computers with FinSpy, spyware capable of accessing information, intercepting communications, and activating microphones and cameras. The alleged Bahraini agents were operating remotely outside the UK, and the spyware was operated through a command-and-control server in Bahrain. The computers, however, were located in the United Kingdom.

The claimants alleged that the surveillance amounted to harassment under the Protection from Harassment Act 1997. They further alleged psychiatric injury after discovering the surveillance in about August 2014. Dr. Shehabi was said to have developed an adjustment disorder, while Mr. Mohammed suffered a significant exacerbation of an existing adjustment disorder.

Important Qualification on the Allegations

A crucial qualification is necessary: these allegations were assumed to be true only for the purpose of determining the preliminary state-immunity issue. The Supreme Court did not finally determine that Bahrain had in fact hacked the computers or that the claimants would ultimately succeed at trial.

The Legal Issue: Section 5 of the State Immunity Act 1978

Section 1 of the SIA establishes the general principle that a foreign state is immune from the jurisdiction of UK courts, subject to statutory exceptions. One such exception is section 5, which provides that a state is not immune in proceedings concerning:

• death or personal injury; or
• damage to or loss of tangible property, where the harm is “caused by an act or omission in the United Kingdom.”

The dispute was about the territorial meaning of those words.

Bahrain advanced three principal arguments. It contended, in substance, that section 5 required either:

• the responsible or precipitating act to have occurred in the UK;
• all causative acts to have occurred in the UK; or
• The author of the injury has been physically present in the UK.

The Supreme Court majority rejected all three approaches.

The Supreme Court’s 3–2 Decision

The majority consisted of Lord Lloyd-Jones, Lord Hamblen, and Lady Simler. Lord Leggatt and Lord Burrows dissented.

The majority held that section 5 requires a legally causative act or omission in the United Kingdom. It does not require that every causative event occur here, nor does the statutory language impose an express requirement that the human actor be physically present in Britain.

This distinction is fundamental. The Court did not say that every technical event occurring inside a computer automatically satisfies section 5. Rather, the act in the UK must be:

• attributable to the foreign state or its agent; and
• legally causative of the relevant personal injury or property damage.

Acts that are too remote, insignificant, or non-operative would not satisfy the requirement.

Also Read: Latest Updates from United Kingdom

Why the Majority Treated the Hacking as an Act in the UK

The most technologically significant part of Bahrain v Shehabi 2026 concerns the meaning of an “act.” Bahrain argued that the relevant act occurred when its operator, sitting abroad, issued instructions to the computer system. The subsequent processes occurring on the UK computer were said to be merely consequences or effects.

The majority rejected this artificial separation.

The pleaded case identified numerous acts occurring in the UK, including:

• transmitting executable files to computers located in England;
• installing FinSpy;
• running the spyware;
• accessing and manipulating computer memory;
• storing information on the computers;
• transmitting and receiving data through UK telecommunications infrastructure;
• exfiltrating information;
• activating microphones and cameras; and
• recording and transmitting keystrokes and mouse movements.

The Court concluded that these were not merely passive consequences of an overseas act. Taken together, they constituted surveillance of persons in the United Kingdom through computers located in the United Kingdom.

Thus, the alleged surveillance was initiated abroad but operated, in a legally significant sense, within Britain.

Causation: A Particularly Important Aspect of the Judgment

One of the most important clarifications in Bahrain v Shehabi [2026] UKSC 25 is that section 5 does not require the claimant to identify a single “responsible” or “precipitating” act.

The majority rejected Bahrain’s argument that the causal inquiry must stop at the initial command issued abroad. Modern tortious conduct can involve a series of causative events.

The statutory question is whether there is a legally causative act in the United Kingdom. Consequently, the fact that an overseas command initiated the spyware operation did not prevent subsequent acts occurring in Britain from satisfying section 5.

This reasoning could become highly significant in future litigation involving:

• ransomware;
• malware;
• spyware;
• remote access tools;
• automated cyberattacks;
• digital interception; and
• other distributed technological systems.
• Also Read: How to Copyright Lyrics in India: Step-by-Step Registration Guide

A Critical Point: Section 5 Is Not Limited to Commercial Conduct

Another substantial feature of the judgment is easily overlooked. Section 5 does not distinguish between sovereign and non-sovereign acts.

This is unusual because state immunity traditionally rests upon the distinction between acta jure imperii—sovereign governmental conduct—and acta jure gestionis—commercial or private-type conduct.

The majority noted that section 5 contains no express limitation excluding sovereign acts. Consequently, even conduct that would ordinarily be regarded as quintessentially governmental—such as intelligence surveillance—may fall within section 5 if its statutory requirements are satisfied.

This substantially increases the importance of the decision. The case is therefore not merely about “cybercrime by a foreign government.” It concerns the difficult boundary between sovereign immunity and territorial sovereignty.

The European Convention on State Immunity: The Real Battle

The most difficult legal issue was the relationship between section 5 of the SIA and Article 11 of the European Convention on State Immunity (ECSI).

Article 11 contains a personal-injury exception where:

• the facts causing the injury occurred in the territory of the forum state; and
• The author of the injury was present in that territory when those facts occurred.

The Bahrain case plainly did not satisfy the second requirement because the alleged operators were outside the UK.

Bahrain therefore argued that section 5 should be interpreted consistently with Article 11. This argument was rejected by the majority.

Article 24 ECSI: The Key to the Majority’s Reasoning

In my view, Article 24 of the ECSI is one of the most important aspects of the judgment and deserves greater prominence than it usually receives in short summaries of the case.

Article 24 permits a contracting state, subject to conditions, to allow its courts to exercise jurisdiction against another contracting state in circumstances beyond Articles 1–13, broadly to the extent that its courts could exercise jurisdiction against non-contracting states.

The UK had made the relevant declaration.

The majority therefore held that the SIA was not required to reproduce Article 11 word-for-word.

Indeed, the Court identified several instances where the SIA deliberately differs from the ECSI.

The majority concluded that Parliament had deliberately omitted the express presence requirement found in Article 11.

That omission could not simply be inserted into section 5 through judicial interpretation.

This is a major statutory-interpretation point:

The Supreme Court treated the different wording of section 5 as legally significant, rather than treating it as an accidental drafting difference.

The Dissent: Lord Leggatt and Lord Burrows

The dissenting judgments deserve serious attention because they expose the international-law difficulty created by the majority’s approach.

Lord Leggatt began from the customary international-law principle that states enjoy immunity from the jurisdiction of other states in respect of sovereign activities.

His central argument was that an act is ordinarily performed where the actor is located.

Thus:

• Bahrain operator → Bahrain act → UK consequences

rather than:

• Bahrain operator → UK act.

Lord Leggatt considered that the presence requirement in Article 11 reflected the international-law balance between state immunity and territorial sovereignty. He warned that extending the exception to sovereign acts performed by agents outside the UK lacked sufficient support in customary international law.

Lord Burrows substantially agreed and emphasized the principle that domestic legislation should, where reasonably possible, be interpreted consistently with the UK’s treaty obligations.

The dissent therefore presents a powerful counterargument: the majority may have interpreted section 5 more broadly than the UK’s international-law obligations permit.

The International-Law Tension

The most intellectually significant feature of Bahrain v. Shehabi 2026 may ultimately be this disagreement.

The majority considered that the UK could legitimately adopt a wider statutory exception under Article 24, provided customary international law did not prohibit the exercise of jurisdiction in the particular circumstances.

The dissent considered that customary international law did prohibit such an extension where the foreign state’s agent was outside the forum state.

Lord Leggatt went further, concluding that allowing the claim to proceed would place the United Kingdom in breach of international law.

Thus, this is not merely a cyber-surveillance case.

It is also an important judgment on the relationship between:

• Parliamentary legislation + treaty obligations + customary international law + state immunity.

Article 6 ECHR: What the Court Did Not Decide

The claimants also raised Article 6 of the European Convention on Human Rights, concerning access to a court.

But the Supreme Court did not decide that issue.

Once the majority concluded that Section 5 itself removed Bahrain’s immunity, it became unnecessary to determine whether denying access to the court would violate Article 6.

This is an important limitation.

It would therefore be legally inaccurate to describe the judgment as holding that human rights override state immunity in cyber-surveillance cases.

The actual holding is narrower:

On the assumed facts, section 5 of the State Immunity Act 1978 removes Bahrain’s immunity because there were legally causative acts in the UK causing alleged personal injury.

What Makes Bahrain v Shehabi a Landmark Judgment?

1. It Adapts Territoriality to the Digital Age

A foreign state cannot necessarily characterize a cyber operation as entirely foreign merely because its operators are abroad.

2. It Recognizes Distributed Digital Acts

The location of the targeted computer and the operations occurring on it can be legally relevant.

3. It Confirms That Every Causative Act Need Not Occur in Britain

A legally causative UK act may be sufficient even when other causative events occurred abroad.

4. It Potentially Exposes Sovereign Cyber Operations to Civil Proceedings

Section 5 does not expressly exclude sovereign acts.

5. It Creates an Important Precedent for Spyware Litigation

The reasoning could be relevant to future claims involving remote surveillance of people physically located in England.

6. It Exposes a Significant Conflict of Judicial Opinion

The 3–2 division means that the international-law implications remain contested.

What the Judgment Does Not Mean

The decision should not be overstated.

Bahrain v Shehabi [2026] UKSC 25 does not establish that every foreign cyberattack is actionable in England.

The claimant must still establish the statutory requirements, including a legally causative act or omission in the UK and qualifying personal injury or tangible property damage.

Nor did the Court finally determine that Bahrain actually conducted the alleged hacking.

The case was decided on the assumed factual basis necessary to resolve the preliminary immunity question.

Most importantly, section 5 is not a general cyber-jurisdiction provision.

Its application remains tied to the specific statutory categories of harm.

Wider Significance for Cross-Border Digital Surveillance

The judgment nevertheless marks an important shift in the legal understanding of digital territoriality.

A single cyber operation may involve:

• an operator in one country;
• a command server in another;
• telecommunications infrastructure elsewhere;
• a targeted computer in a fourth location; and
• a victim in a fifth.

Traditional territorial rules become difficult to apply when the physical and digital locations of an operation diverge.

Bahrain v Shehabi demonstrates that courts may examine not simply where the human operator sat, but where the relevant technological conduct actually occurred and where the legally significant interference took place.

That principle could become increasingly important as states use sophisticated cyber capabilities for intelligence gathering, surveillance, and transnational operations.

Implications for Indian Lawyers and Cyber-Law Practitioners

Although Bahrain v Shehabi 2026 is a UK decision, it has considerable comparative value for Indian practitioners.

India is also confronting increasingly complex questions concerning:

• cross-border cyber operations;
• digital surveillance;
• privacy;
• territorial jurisdiction;
• foreign-state conduct;
• electronic evidence; and
• constitutional rights in the digital environment.

The UK Supreme Court’s reasoning provides useful comparative material for analyzing circumstances where conduct originates outside India but deliberately operates upon computers, networks, or individuals within India.

However, the decision should not be mechanically transplanted into Indian law. India’s constitutional framework, jurisdictional rules, and law relating to foreign-state immunity are materially different.

Its principal value for Indian lawyers is therefore doctrinal and comparative.

Conclusion

Bahrain v Shehabi [2026] UKSC 25 is a genuinely important judgment because it forces state-immunity law to confront a reality that could not have been fully anticipated when the State Immunity Act 1978 was enacted: sovereign power can now be exercised across borders without the sovereign’s agent ever crossing the border.

The Supreme Court majority has adopted an approach under which the physical location of the foreign operator is not necessarily decisive. Where a foreign state’s remote digital operation results in legally causative acts occurring on computers in the United Kingdom and causes qualifying personal injury there, the territorial exception in section 5 may remove state immunity.

The decision is especially significant because the Court did not confine the principle to commercial or private conduct. The statutory wording, according to the majority, can encompass sovereign activity as well.

Yet the 3–2 split should not be ignored. Lord Leggatt and Lord Burrows provide a formidable international-law critique, particularly concerning the ECSI presence requirement and customary international law. Their reasoning means that the judgment should be regarded not as the end of the debate over digital territoriality, but as an important new stage in it.

The deeper lesson of Bahrain v. Shehabi 2026 is that territoriality in the digital age cannot always be identified simply by asking where a person was sitting when they pressed a key.

For modern cyber operations, the more legally meaningful question may be:

Where did the legally significant digital conduct occur, and where did it cause the protected harm?

That question will increasingly shape the future of state immunity, spyware, cyber surveillance, human rights, and cross-border digital litigation.

Citation: The Kingdom of Bahrain v Shehabi and another [2026] UKSC 25 (UK Supreme Court, 27 July 2026).

FAQs: Bahrain v Shehabi [2026] UKSC 25

1. What is the significance of Bahrain v Shehabi [2026] UKSC 25?

Bahrain v Shehabi [2026] UKSC 25 is a landmark UK Supreme Court judgment on state immunity, spyware, and cross-border digital surveillance. By a 3–2 majority, the Court held that a foreign state’s remote digital conduct can potentially fall within the personal-injury exception to state immunity under section 5 of the State Immunity Act 1978.

2. What did the UK Supreme Court decide about state immunity in Bahrain v. Shehabi?

The UK Supreme Court held that Bahrain could not rely on state immunity at the preliminary stage because the alleged spyware operation involved legally causative acts occurring in the United Kingdom and allegedly causing personal injury there. The Court found that section 5 of the State Immunity Act 1978 does not require the foreign state’s agent to be physically present in the UK.

3. How does Bahrain v. Shehabi affect cross-border spyware and cyber surveillance cases?

The judgment potentially expands the circumstances in which foreign states can face civil litigation in England for cross-border spyware and digital surveillance. A remote cyber operation initiated abroad may still have a legally significant territorial connection with the UK, where computers located in Britain are targeted and qualifying personal injury results occur.

4. Does Bahrain v Shehabi mean that every foreign cyberattack can be sued upon in the UK?

No. Bahrain v. Shehabi [2026] UKSC 25 does not create unlimited UK jurisdiction over foreign cyberattacks. Section 5 requires a legally causative act or omission in the United Kingdom and qualifying personal injury or damage to tangible property. The Supreme Court also did not finally decide whether Bahrain actually conducted the alleged surveillance.

5. Why is Bahrain v Shehabi [2026] UKSC 25 important for human rights and digital surveillance law?

The judgment is important because it connects state immunity, human rights, spyware, and digital territoriality. It recognizes that modern surveillance can be conducted remotely across national borders and that the physical location of the foreign operator may not be decisive. The ruling could influence future litigation involving government spyware, cyber surveillance of dissidents, and other forms of cross-border digital interference.

Key Takeaways: Bahrain v Shehabi [2026] UKSC 25

• Bahrain v Shehabi [2026] UKSC 25 is a landmark UK Supreme Court judgment concerning state immunity, spyware, human rights, and cross-border digital surveillance.
• On 27 July 2026, the UK Supreme Court ruled by a 3–2 majority that Bahrain could not rely on state immunity to prevent the claim from proceeding at the preliminary stage.
• The case involved allegations that FinSpy spyware was used to compromise computers belonging to Bahraini dissidents who were located in the United Kingdom.
• The alleged Bahraini operators were outside the UK, while the targeted computers and the alleged victims were inside the UK.
• The Supreme Court held that a remote digital operation can potentially constitute an “act” in the United Kingdom for the purposes of section 5 of the State Immunity Act 1978.
• The Court found that section 5 does not require the foreign state’s agent to be physically present in the UK when the relevant digital conduct occurs.
• A key principle is that not every causative act needs to take place in the UK. What matters is whether there is a legally causative act or omission occurring in the UK that causes qualifying harm.
• The judgment is particularly significant because section 5 is not confined to commercial conduct. It can potentially apply even where the alleged conduct is governmental or sovereign in character.
• Article 11 of the European Convention on State Immunity was central to the dispute because it contains a territorial presence requirement. The majority concluded that Parliament had deliberately adopted different wording in section 5 of the UK State Immunity Act.
• Article 24 of the European Convention on State Immunity was also important to the majority’s reasoning concerning the UK’s ability to maintain a wider domestic jurisdictional rule.
• The 3–2 split decision is significant. Lord Leggatt and Lord Burrows dissented, raising important concerns about customary international law, state immunity, and the UK’s international obligations.
• The Supreme Court did not decide the Article 6 ECHR issue because it was unnecessary after finding that Section 5 itself could remove Bahrain’s immunity.
• The Court also did not finally determine that Bahrain actually carried out the alleged spyware operation. The allegations were assumed for the purpose of deciding the preliminary immunity question.
• Bahrain v Shehabi 2026 could influence future litigation involving government spyware, cyber surveillance, remote hacking, digital espionage, and cross-border cyber operations.
• The broader legal significance is that digital territoriality cannot always be determined simply by identifying where the human operator was physically located.
• For lawyers and technology-law practitioners, the judgment demonstrates the growing importance of the location of targeted computers, digital infrastructure, and legally significant harm when determining jurisdiction and state immunity.

Summary

Bahrain v Shehabi [2026] UKSC 25 establishes an important principle for modern state immunity and cyber surveillance law: a foreign state’s remote digital operation may constitute an act in the UK even when its operators are abroad, potentially allowing civil claims for qualifying personal injury under section 5 of the State Immunity Act 1978. The 3–2 ruling has major implications for spyware, cross-border digital surveillance, cyber jurisdiction, human rights, and digital territoriality.

Important Links

• Lawyers in India
• Copyright Registration in India
• Caveat Filing in Supreme Court of India
• Mutual Consent Divorce in Delhi NCR: WhatsApp 9650499965

Lawyers in the United Kingdom