Kingdom of Bahrain v Shehabi [2026] UKSC 25 holds that a foreign state loses its state immunity under section 5 of the State Immunity Act 1978 where its agents, acting from abroad, remotely install spyware on computers located in the United Kingdom and thereby cause psychiatric injury here. The Supreme Court split three to two, with Lord Leggatt and Lord Burrows dissenting, in a judgment handed down on 27 July 2026.
What did the Supreme Court decide on state immunity?
The majority, Lord Lloyd-Jones, Lord Hamblen and Lady Simler, dismissed Bahrain’s appeal against the Court of Appeal’s refusal of immunity, holding that legally causative acts occurred in the United Kingdom so as to bring the claim within the personal injury exception in section 5. The respondents, Dr Saeed Shehabi and Mr Moosa Mohammed, are Bahraini pro-democracy activists resident in the UK who allege that from around September 2011 persons acting for Bahrain infected their computers with the FinSpy surveillance programme, operated from a server in Bahrain, and that they suffered psychiatric injury on discovering the surveillance in 2014. Their claim is brought in harassment under the Protection from Harassment Act 1997. The appeal proceeded on assumed facts as a preliminary issue, so nothing in the judgment decides the underlying allegations, which Bahrain has not admitted and which remain to be tried.
What is the section 5 personal injury exception?
Section 1 of the 1978 Act confers a general immunity on foreign states in the courts of the United Kingdom, and section 5 removes it for proceedings in respect of death or personal injury caused by an act or omission in the United Kingdom. The battleground was territorial. Bahrain argued that the provision requires the state’s agent to have been physically present here, or at least that every act causing the harm must have been performed here, and it pointed to article 11 of the 1972 European Convention on State Immunity, which expressly requires the author of the injury to have been present in the forum state. The majority read section 5 as straightforward language requiring only an act in the United Kingdom that is legally causative of the injury, and treated Parliament’s omission of any express presence requirement, with the Convention text before it, as deliberate. Remotely manipulating a computer that sits in England is, on ordinary language, an act done in England.
Analogies carried the point. Treating what happens abroad as the act and what happens in England as merely its effect was, the majority said, artificial, no more persuasive than describing a drone strike or a remotely detonated bomb as conduct located wherever the operator happened to sit. On customary international law, the majority found a substantial and growing body of state practice supporting a territorial tort exception that reaches sovereign acts, while accepting that no previous case had removed immunity where the wrongdoer never entered the forum state at all.
What would the dissent have held?
Lord Leggatt and Lord Burrows would have allowed the appeal. On their analysis, an act is located where the actor is: a shooter standing in state A who hits a victim in state B acts in state A, and the injury in state B is the effect of the act rather than the act itself, so a Bahraini official operating spyware from Bahrain acts in Bahrain. Lord Leggatt also separated the international law question in two, asking first whether custom permits denying immunity for sovereign torts committed in the forum territory, and secondly whether any such exception extends to officials who remain abroad while their acts take effect remotely, and he found the state practice relied on by the majority went to the first proposition rather than the second. The division is a clean one between locating an act by its author and locating it by where the operation is directed and takes effect, and it will be studied wherever similarly worded exceptions exist.
The decision defines when a foreign state can be sued in England for transnational surveillance causing injury here, and it is the first ruling by a leading national court to deny immunity for state spyware operations. Claims by dissidents, journalists and others targeted with tools such as FinSpy or Pegasus while in the UK now have a clear route past the immunity bar, without needing to show that any agent ever set foot in the country. Practitioners advising on sovereign risk should also note the majority’s reading of the Act’s relationship with the European Convention, which will shape argument on the other exceptions.
What happens next?
The immunity question is now settled and the harassment claim can proceed to trial, where the assumed facts will finally be tested against the evidence. The ruling was one of two Supreme Court judgments delivered on 27 July and first noted in our roundup of that day’s hand-downs; its commercial companion on FRAND jurisdiction is covered separately today, and claimants weighing proceedings against foreign states will still need to navigate the service regime discussed in our guide to serving out of the jurisdiction. The judgment is on the Supreme Court’s website and the statutory scheme is in the State Immunity Act 1978.