The English court has jurisdiction to hear a claim against a foreign state that it has allegedly hacked activists’ computers using spyware

Summary

The High Court has dismissed an immunity application made by the Kingdom of Bahrain (the “defendant”) in response to claims made by two activists (the “claimants”) who allege that they have suffered psychiatric injury as a result of their laptops being infected with spyware by the defendant which enabled it to conduct covert surveillance on them. The court held that the personal injury exception to immunity applied (s.5, State Immunity Act 1978 (“SIA”)). The judgment provides a helpful analysis of the rationale underpinning state immunity and, moreover, how the personal injury exception to immunity should be construed. The judgment covers similar matters considered in Al-Masarir v Kingdom of Saudi Arabia [2022] EWHC 2199 (QB), which we discussed here.

The background

The claimants alleged that at some point in September 2011 the defendant’s servants or agents, likely operating remotely outside of the UK, hacked or infected their computers with a spyware program called ‘FinSpy’ whilst the claimants and their computers were in the UK.  The claimants alleged that this constituted harassment under the Protection from Harassment Act 1997 and, resultingly, they suffered from psychiatric injury. The claimants’ position was that this amounted to personal injury under s.5, SIA and, therefore, the defendant was not immune from the English court’s jurisdiction.

The defendant denied hacking or infecting the claimants’ computers, and it applied for:

a.    a declaration of immunity under the SIA, alternatively;

b.    an order setting aside earlier court orders, pursuant to which leave to serve out of the jurisdiction had been granted; and

c.    in either case, a declaration that the court does not have jurisdiction to hear the claims and to set aside the order for service out. 

In his judgment, Mr Justice Knowles focused on the application of state immunity to the case. 

The legal issues

The SIA affords immunity to foreign states from the jurisdiction of the English courts pursuant to s.1 SIA, unless the proceedings fall within one of the specified statutory exceptions to immunity, listed in ss.2 to 11, SIA, including the personal injury exception which provides that a state is not immune from proceedings in respect of: (a) death or personal injury, or (b) damage to or loss of tangible property, caused by an act or omission in the UK.

This article focuses on the following two overarching issues covering state immunity:

• Does section 5, SIA: (a) require the presence of the infringing state actor in the UK in order for the state concerned not to be immune in domestic civil proceedings: and (b) does it also require all of the acts causing injury to have taken place in the UK for immunity not to apply?
• Do the claimants’ psychiatric injuries constitute ‘personal injury’ within s. 5, SIA?

The court found in favour of the claimants in respect of both issues and the detailed analysis undertaken by the court is summarised below.

The territorial scope of s.5

The defendant submitted that as a matter of construction, s.5 requires each and every individual tortious act to have been committed in the UK such that if some acts occur outside the UK the defendant state is immune.  Mr Justice Knowles considered the defendant’s submissions against the backdrop of his earlier judgment in Al-Masarir and, in summary, he remained of the view that s.5 does not either: (a) require the presence of the infringing state actor in the UK; or (b) require all of the defendant’s acts to have occurred in the UK.

The first question addressed by the court was whether there is a presence requirement under s.5.  The court was emphatic that it is the location of the act or acts causing the injury which is the issue under s.5, not the presence of the author of the act(s). In support of this view is the fact that where an instrument on immunity incorporates a presence requirement this is achieved expressly, such as Article 11 of the European Convention on State Immunity (the “Basle Convention”) (which the UK signed in 1972) and Article 12 of the United Nations Convention on Jurisdictional Immunities of States and their Property 2004 (which is not yet in force). The court concluded that Parliament’s omission of the presence requirement in s.5 was intentional, particularly given that it was legislating against the backdrop of the Basle Convention.

The next question considered by the court was whether s.5 requires the act (or all the acts, where the damage was caused by more than one act) to have taken place in the UK, as the defendant contended.  Noting that the court had set out the relevant principles of statutory construction of s.5 in Al-Masarir, Mr Justice Knowles held that the grammatical meaning of s.5 and, specifically, the use of the indefinite article (death or personal injury caused by ‘an act or omission’) means what it says. There must be an act or omission in the UK which causes the damage “on a more than de minimis basis.”  Parliament did not state ‘the act or omission’, still less, ‘acts or omissions occurring entirely within the UK’, and that omission was supportive of the claimants’ position.

The court noted that its interpretation of s.5 is supported by cases covering the tort jurisdictional gateway where the English court’s approach has been that it is sufficient that a substantial and efficacious act was committed in the jurisdiction for permission to serve out to be granted, and not the entire tort.  Notably, this threshold – under the jurisdictional tort gateway - is clearly higher than “on a more than de minimis basis”.

The court also considered the defendant’s arguments which relied on the US case law under the Foreign Sovereign Immunities Act (“FSIA”) pursuant to which the entire tort must have occurred in the US for the non-commercial tort exception to immunity to apply (known as the ‘entire tort’ doctrine).  The court dismissed the defendant’s arguments on the basis that the US jurisprudence is based on different statutory wording. Further the court cautioned against placing reliance on decisions of foreign courts concerning different statutes, different wording and, moreover, a different and distinct legislative history.

The court concluded that if the defendant’s position was upheld that would ultimately render the s.5 exception to immunity almost meaningless.  The court reasoned that if the defendant’s position was upheld s.5 would only apply to the most straightforward of cases such as a road traffic accident involving a vehicle driven by an employee of a foreign embassy.  That would deprive the exception of its full force and effect - given the likelihood that most of the cases where a foreign state should not be immune would involve tortious activity committed overseas – and could lead to perverse outcomes.   

The meaning of personal injury

The defendant had also submitted that the earlier Employment Appeal Tribunal decisions in Military Affairs Office of the Embassy of Kuwait v Caramba-Coker [2003] UKEAT 1054_02_1004 and Federal Republic of Nigeria v Ogbonna [2012] 3 SCR 176 should be distinguished (or the defendant contended they were wrongly decided).  Those decisions established that psychiatric injury fell within s.5 as a form of personal injury.  The court was unpersuaded by the defendant’s arguments and agreed that the EAT’s decisions remain good law, and commented that they had recently been affirmed by the Court of Appeal in Corinna Zu Sayn-Wittgenstein-Sayn v His Majesty Carlos Alfonso Victor Maria de Borbón y Borbón [2022] EWCA Civ 1595.  

It is noteworthy that the court also observed that since Ogbonna was decided there has been support in academic commentary for the proposition that the terms ‘personal injury’ in international instruments do not have an autonomous meaning in international law. This reinforced the court’s view that the s.5 exception should not be construed in a narrow way that is contrary to the clear and settled meaning of ‘personal injury’ in domestic law.

Comment

This is the second decision of the English court to apply the personal injury exception to a sovereign’s claim to immunity arising from the alleged use of spyware, and the judgment comes in the wake of the court’s recent decision in Al-Masarir.  The alleged facts in both cases bear a striking resemblance and, notably, they were both heard by Mr Justice Knowles.  In the present case, Mr Justice Knowles cemented his earlier views that the statutory wording in s.5 of the SIA is clear and means what it says. Firstly, there is no presence requirement in s.5 and there is no need for the whole act or omission to have taken place in the UK for s.5 to apply. Secondly, and as laid down by the EAT, the normal meaning of personal injury in domestic law applies to the term ‘personal injury’ under s.5. Therefore, a claim for psychiatric injury constitutes personal injury, and is caught by the exception to immunity under s.5, SIA.

These cases arguably demonstrate an expansive view of what constitutes a personal injury claim under s.5. It is now nearly two decades since the House of Lords’ judgment in Jones v Saudi Arabia [2007] 1 AC 270, and these cases beg the question whether a personal injury claim alleging acts of torture by a state, where the personal injury is caused by an act committed in this jurisdiction as well as abroad, could be brought against a state before the English courts.  Mr Justice Knowles’ comments in Shehabi v The Kingdom of Bahrain suggest that a claimant could, potentially, argue that there is an exception to immunity in such circumstances.

(1) Dr Saeed Shehabi (2) Moosa Mohammed v The Kingdom of Bahrain [2023] EWHC 89 (KB)