State immunity and remote cyber operations: the UK Supreme Court’s decision in Kingdom of Bahrain v Shehabi

Introduction

On 27 July 2026, the UK Supreme Court handed down its judgment in The Kingdom of Bahrain (Appellant) v Shehabi and another (Respondents) [2026] UKSC 25. By a 3–2 majority, the Court dismissed Bahrain’s appeal, holding that Bahrain could not rely on state immunity to prevent the respondents’ claims from proceeding to trial.

The decision is significant because it clarifies the scope of section 5 of the State Immunity Act 1978 (“SIA 1978”) and its application to modern cyber operations. The judgment establishes that the “personal injury” exception to state immunity can apply where the act in question, here the manipulation of a computer located in the UK, is carried out remotely by cyber means, without the state’s agents being physically present in the UK.

Background

The respondents are human rights activists who reside in the UK. They allege that, from around September 2011, persons alleged to be acting on behalf of the Kingdom of Bahrain, and operating remotely from outside the UK caused spyware (known as FinSpy) to be installed on their personal computers and devices while they were in the UK. The respondents contend that this amounted to harassment in contravention of the Protection from Harassment Act 1997. On discovering the surveillance, the respondents allege that they suffered psychiatric injury.

The respondents brought proceedings against Bahrain, claiming damages for personal injury. Bahrain asserted that it was entitled to state immunity pursuant to the SIA and sought to have the proceedings dismissed on jurisdictional grounds. 

The central question was whether the exception in section 5 of the SIA 1978 applied in circumstances where the alleged wrongful act, being the alleged hacking and installation of spyware, was initiated by agents located outside the UK but was alleged to have operated on computers located in the UK.

Bahrain submitted that the exception in section 5 only applies: (i) where the act or omission causing personal injury or property damage was the responsible or precipitating act or omission; or (ii) where every act or omission causing personal injury or property damage took place in the UK; or (iii) where the author of the personal injury or property damage was present in the UK at the time when the facts which occasioned the injury or damage occurred.

In the lower courts:

• Knowles J. dismissed Bahrain’s application for a declaration of immunity and other relief. Knowles J. followed his earlier judgment in Al-Masarir v Kingdom of Saudi Arabia [2022] EWHC 2199 (QB), holding that section 5 contains no express "presence requirement" and that Parliament deliberately omitted the wording found in Article 11 of the European Convention on State Immunity ("ECSI"), which would have required the foreign state's agents to be physically present within the forum state. He also concluded that it was sufficient for there to be a legally causative act in the UK; section 5 did not require every causative act to occur in the UK. Our article reflecting on the High Court’s earlier judgment is discussed here, and our article discussing the Al-Masarir judgment is available here.
• The Court of Appeal dismissed Bahrain’s appeal.  Giving the leading judgment, Males LJ held that it was artificial and unprincipled to characterise the remote manipulation of a computer located in the UK as occurring only where the operator was located. Rather, the acts occurred both where the commands were initiated and where the spyware operated. Our article commenting on the Court of Appeal’s judgment is available here.

Bahrain appealed to the Supreme Court.

The Statutory Framework

The SIA gives effect in English law to the restrictive doctrine of state immunity. The general immunity from jurisdiction is in section 1(1), SIA, which provides that:

“A State is immune from the jurisdiction of the courts of the United Kingdom except as provided in the following provisions of this Part of this Act.”

As noted above, the exception at issue in this case is in section 5, SIA, which provides:

“A State is not immune as respects proceedings in respect of— (a) death or personal injury; or (b) damage to or loss of tangible property, caused by an act or omission in the United Kingdom.”

The issue before the Supreme Court was whether spyware remotely deployed by agents of a State located abroad could constitute an “act … in the United Kingdom” within the meaning of section 5.

Although the factual background concerned allegations of cyber surveillance, the appeal turned principally on principles of statutory interpretation.

The Supreme Court’s Decision

The Supreme Court dismissed Bahrain’s appeal by a majority of 3–2. 

The majority reasoning

The majority (Lord Lloyd-Jones, Lord Hamblen and Lady Simler gave the leading judgment) addressed multiple legal issues.  This article focuses on the Court’s interpretation of section 5 of the SIA, its analysis of the relationship between the SIA and the ECSI and its observations on customary international law.

The interpretation of section 5, SIA

• The majority began by emphasising that the starting point was the language of section 5. Consistent with principles of statutory interpretation, the Court sought to ascertain Parliament's intention by considering the statutory wording in its ordinary meaning, read in its wider statutory context and purpose. 
• Section 5 is expressed in straightforward language. It requires an act in the UK which is causative of personal injury or damage to property. Rejecting Bahrain’s submission, the wording does not require “the” act or “all” acts to be in the UK and, further, there is no express requirement of presence in the UK for the author of the relevant act.
• This interpretation does not entail reading in words into section 5, SIA.
• The word “act” should not be read as meaning only the initiating, precipitating or responsible act or omission.  In tort claims, there is no requirement that there will only be one causative act capable of giving rise to a cause of action and it would be odd if section 5, SIA, applied a different test of causation from tort law.
• Attempts to make a rigid distinction between an act and its effect can lead to artificial results.

The impact of Article 11, ECSI

• The Court noted that the words of section 5 must be understood in their wider statutory context and the purpose of the SIA.  The Court acknowledged that one purpose of the SIA was to enable the UK to ratify the ECSI. However, it emphasised that the SIA was intended to give broad effect to the Convention, not to reproduce it verbatim.
• Article 11 of the ECSI removes immunity only where: (i) the facts occasioning the injury or damage occurred within the forum State; and (ii) the author of the injury or damage was present within that territory at the time when those facts occurred. 
• Neither of those requirements appears in section 5. Instead, Parliament substituted different language, referring simply to "an act or omission in the United Kingdom".
• The majority held that this difference was deliberate. Had Parliament intended to import a physical presence requirement, it could readily have done so. Its omission was therefore highly significant. The Court concluded that section 5 was not reasonably capable of bearing the same meaning as Article 11. 
• Accordingly, the presumption that domestic legislation should, where possible, be interpreted consistently with an international convention (derived from The Eschersheim [1976] 1 WLR 430) had no application because Parliament had intentionally departed from the Convention's wording.

Customary international law

• Having concluded that the natural meaning of section 5 favoured the respondents, the Court considered whether that interpretation was displaced by customary international law. This issue was considered in light of the declaration made by the UK under Article 24(1) of the ECSI, the effect of which is that the UK may deny immunity in wider circumstances than those identified in the ECSI provided that in doing so it does not deny immunity in respect of sovereign acts for which customary international law requires immunity.
• The Court found that there was a basis in customary international law for the UK to conclude that it could lawfully give effect to a territorial tort exception in section 5, which did not distinguish between sovereign and non-sovereign acts and which employed a different jurisdictional linking factor from that contained in article 11 of the ECSI.

The dissenting judgments

The minority (Lord Leggatt, with whom Lord Burrows agreed) would have allowed the appeal.

Lord Leggatt accepted that section 5 required interpretation in its statutory context but fundamentally disagreed with the majority's understanding of where an "act" occurs. In his view, an act is ordinarily performed where the actor is physically located, even though its consequences may be experienced elsewhere. 

Accordingly, if a Bahraini agent enters commands into a computer in Bahrain which subsequently causes spyware to operate on computers located in the UK, the acts occurred in Bahrain; only their effects occurred within the UK.

Lord Leggatt considered that the majority's reasoning conflated acts with their effect, thereby undermining the certainty and coherence of section 5. He further considered that Parliament had adopted different drafting from Article 11 ECSI simply as a more economical drafting technique, not because it intended to create a materially broader exception to immunity. 

Comment

This decision has significant implications for practitioners advising on state immunity issues, particularly in cases involving cyber operations and other forms of (alleged) remote wrongdoing:

1. The judgment makes clear that where it is alleged that a state has directed harmful cyber activity within the UK, the section 5 exception may be engaged.
2. The judgment has the potential to apply beyond spyware to other forms of remote interference, such as an explosion caused by a drone remotely controlled from abroad or remotely caused data breaches, where the harmful operation takes place on a system or device within the UK.
3. The close 3–2 division demonstrates that this was a difficult question of statutory interpretation. The dissenting judgment is likely to remain influential in future cases involving emerging technologies and cross-border digital conduct.

The Kingdom of Bahrain (Appellant) v Shehabi and another (Respondents) [2026] UKSC 25