Law & Regulation

UK's Top Court Strips Bahrain's Spyware Immunity

The UK Supreme Court ruled 3-2 on July 27 that Bahrain cannot claim state immunity for a 2011 FinSpy hack of London-based activists. The spyware itself was built by a UK company.

Law & RegulationBy Servola Tech Desk2026-08-145 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

UK's Top Court Strips Bahrain's Spyware Immunity

Key takeaways

On July 27, 2026, the UK Supreme Court ruled 3-2 in Kingdom of Bahrain v Shehabi and another ([2026] UKSC 25) that Bahrain cannot claim state immunity for allegedly directing a 2011 FinSpy spyware infection of two London-based activists, Dr Saeed Shehabi and Moosa Mohammed, clearing the case to proceed to a full trial on damages for psychiatric injury.
The majority, Lord Lloyd-Jones, Lord Hamblen and Lady Simler, held that Section 5 of the State Immunity Act 1978 removes immunity for personal injury caused by an act in the UK, and that remotely infecting a computer physically located in Britain counts as an act here even though the operator never set foot in the country; Lord Leggatt and Lord Burrows dissented, arguing the conduct occurred where the operator sat, not where its effects landed.
The spyware in question, FinFisher (also sold as FinSpy), was developed and marketed by Gamma International, a business registered in Andover, UK, according to separate UK export-control litigation brought by Privacy International and research by Citizen Lab, a fact that means this ruling exposes not just foreign governments but a domestic UK supply chain to civil liability for how its product gets used abroad.
The judgment does not decide whether Bahrain actually authorized the hack or set any damages figure; it only removes the immunity defense, so the practical fight over liability and compensation now moves to a full High Court trial, with the ruling's real reach extending to any foreign state's spyware operation against a person physically present in the UK, not just this one case.

What the Supreme Court Actually Decided on July 27

On July 27, 2026, a five-justice panel of the UK Supreme Court split 3-2 in Kingdom of Bahrain v Shehabi and another, cited as [2026] UKSC 25. Lord Lloyd-Jones, Lord Hamblen and Lady Simler formed the majority; Lord Leggatt and Lord Burrows dissented. The case had reached the country's highest court after the High Court and then the Court of Appeal, in [2024] EWCA Civ 1158, both rejected Bahrain's claim to state immunity.

The Supreme Court's majority held that a foreign state is not entitled to immunity from civil proceedings where its agents install spyware on a computer located in the United Kingdom and that causes psychiatric harm, even when the state's own agents never physically entered the country. That clears the case to proceed to a full trial in the High Court, where Bahrain's actual involvement and any damages will be decided on the facts.

The FinSpy Infection Behind the Case

Dr Saeed Shehabi and Moosa Mohammed are Bahraini pro-democracy activists who have lived in London for years. They allege that, beginning around September 2011, agents acting for the Kingdom of Bahrain infected their computers with FinSpy spyware, a surveillance tool capable of harvesting files, communications and keystrokes from an infected device. According to the Supreme Court's case summary, the two activists say they discovered the intrusion around August 2014, through disclosures connected to WikiLeaks and the Bahrain Watch research group, and that discovering they had been under surveillance for years caused them lasting psychiatric harm.

Bahrain's defense throughout the litigation was not that the hack did not happen, but that as a sovereign state it was immune from being sued over it in a UK court at all. That immunity argument, not the underlying facts of the hack, is what the Supreme Court has now rejected.

Why Location Was the Entire Legal Battle

Section 5 of the State Immunity Act 1978 strips a foreign state of immunity for proceedings over personal injury caused by an act or omission in the United Kingdom. The dispute that reached five Supreme Court justices was not whether Shehabi and Mohammed suffered harm, but whether spyware operated from Bahrain and aimed at computers sitting in London counts as an act in the UK at all.

The majority reasoned that the legally relevant conduct is where the operation is carried out against its target, meaning an act can be territorial even when the person directing it never crosses a border themselves; the judgment reportedly drew a comparison to a drone strike or a remote attack on NHS systems, where nobody would seriously argue the harm occurred only where the operator's console happened to sit. Lord Leggatt and Lord Burrows dissented on exactly this point, arguing that an official operating spyware from Bahrain is acting in Bahrain, and that the United Kingdom is merely where the consequences were felt rather than where the act itself took place.

Original Thesis: The Spyware Was Never a Foreign Import

Most coverage of this ruling has focused on what it means for the reach of state immunity into cyber operations. The detail that changes the calculation for UK policy is where FinFisher, also marketed as FinSpy, actually came from. According to litigation Privacy International brought against UK export authorities and research published by Citizen Lab, the spyware was developed and sold by Gamma International, a business registered in Andover in the United Kingdom, operating alongside a Munich-based sister company.

That means this is not simply a precedent about foreign states reaching into Britain from abroad. It is a precedent that lands on a UK-based commercial supply chain, one that has already faced years of separate scrutiny over whether its export licensing for authoritarian buyers complied with UK law. A tool built and marketed from British soil, once sold onward to a foreign government, has now produced a ruling that exposes that government to a UK lawsuit for exactly how the tool got used, which raises the stakes for any UK-domiciled surveillance vendor selling into markets with weak human rights records: the buyer's later conduct can now come back through a British courtroom in a way that also puts uncomfortable scrutiny on where the tool was built.

What Happens Next, and What This Ruling Does Not Do

The Supreme Court did not rule that Bahrain in fact authorized the hack, and it set no damages figure. What it decided is narrower and, in practical terms, more consequential: Bahrain cannot use state immunity to keep the case out of a UK courtroom. The claim now returns to the High Court for a full trial on the merits, where Shehabi and Mohammed will need to prove Bahrain's involvement and the extent of their psychiatric harm.

For any foreign government running, or considering running, a surveillance operation against a person physically present in the UK, immunity is no longer an automatic shield the moment a UK court is asked to hear the claim. And for any UK-based company building tools that make that kind of operation possible, this ruling is a reminder that the exposure does not end at the export license; it can resurface years later as a domestic lawsuit over what a foreign customer did with what it bought.

Frequently asked questions

Did the Supreme Court rule that Bahrain actually hacked the activists?

No. The ruling only removes Bahrain's claim to state immunity, clearing the way for a full trial. Whether Bahrain's agents actually carried out or directed the FinSpy infection, and how much harm resulted, will be decided at that trial on the facts.

Does this ruling apply only to Bahrain, or to any state accused of similar conduct?

The legal principle is general: a foreign state cannot claim immunity for personal injury caused by spyware or similar remote operations against a person or device physically located in the UK, regardless of which state is involved or where its operators were sitting at the time.

What does the UK origin of the FinSpy spyware have to do with this case?

The Supreme Court's ruling concerned Bahrain's immunity, not the spyware maker directly. But separately from this case, UK export-control litigation and independent research have established that FinFisher, marketed as FinSpy, was developed and sold by Gamma International, a company registered in the UK, which means the ruling's practical effect lands on a domestic surveillance supply chain as much as on foreign state customers.

The headline is that Bahrain lost its immunity defense. The harder question for Britain is that the tool at the center of the case was built and sold from British soil in the first place, and this ruling means the country where a spyware maker is registered can no longer assume its foreign customers' conduct stays safely out of a UK courtroom.

UK Supreme Courtstate immunityspywareFinFisherGamma Internationalsurveillance law

EU Court Locks In DMA Rules for All Six Gatekeepers

The General Court dismissed Apple's DMA gatekeeper appeal on July 8. The real precedent isn't about Apple losing - it closes a procedural escape route for all six designated gatekeepers.

5 min read

Law & Regulation

First Rival App Store Enters Google Play in 10 Years

Aptoide's app store is now installable directly inside Google Play in the US under a court-ordered program - here is what it means for EU and UK Android distribution strategy under the DMA.

4 min read

Decisions

The Third Pivot Was the Warning Magic Leap Missed

Magic Leap filed a WARN notice for 193 layoffs effective 1 October 2026, its fourth strategic pivot after $4 billion raised. The lesson is the pattern, not the pivot.