IC Technology & Surveillance — 2026-09-05

UK Supreme Court Opens Door for Spyware Victims to Sue Foreign States Over Digital Transnational Repression

BLUFLondon-based dissidents now hold a viable civil litigation pathway against foreign governments conducting spyware operations on UK soil, raising the cost of digital transnational repression.

The UK Supreme Court ruled on 27 July that the Kingdom of Bahrain is not entitled to state immunity under section 5 of the State Immunity Act 1978 in a civil suit brought by two Bahraini dissidents, Dr Saeed Shehabi and Moosa Mohammed, over alleged FinSpy spyware hacking of their UK-based computers 1. The respondents allege Bahrain-linked agents, operating from outside the UK, infected their devices from around September 2011, and that they suffered psychiatric injury after learning of the hacking in 2014 via WikiLeaks and Bahrain Watch publications 1. The ruling upholds prior decisions by the High Court and Court of Appeal rejecting Bahrain's immunity claim and returns the case to the High Court of Justice, where attribution, causation, and injury remain to be proven 12. The judgment ([2026] UKSC 25) was decided by a narrow 3-2 majority, with dissenting Justices Leggatt and Burrows warning that the majority's reading of the territorial tort exception places the UK in breach of customary international law and its treaty obligations under the European Convention on State Immunity 1. Citizen Lab researchers writing in Lawfare characterized the decision as removing "the blunt defense of state immunity" in spyware-hacking cases brought by exiles in the UK 2.

Analysis
The 3-2 ruling narrows rather than eliminates sovereign immunity, letting the Bahraini dissidents' hacking claims reach a merits trial for the first time and giving other UK-based exiles targeted by state-linked spyware a tested jurisdictional pathway, provided the hacking state's agents acted from outside UK territory. Bahrain can still defeat the underlying claim by contesting attribution and causation, so the decision establishes forum access rather than liability, and dissenting justices warned the majority's reading breaches customary international law and treaty obligations. Reporting rests on the Supreme Court's own judgment, with Citizen Lab's Lawfare commentary serving as secondary analysis rather than independent reporting. Five weeks on, no hearing date has emerged, leaving redress prospects for exiles narrower than victory framing suggests, while foreign governments surveilling diaspora critics in London now face civil-litigation exposure that didn't previously exist.

2 sources

The Kingdom of Bahrain (Appellant) v Shehabi and another (Respondents) - UK Supreme Court
U.K. Supreme Court Opens Door for Spyware Victims to Sue Foreign States - Citizen Lab