07/10/2024

Court of Appeal upholds ruling that a foreign state can be sued for alleged hacking of computers

On 4 October, the Court of Appeal held in Shehabi and Mohammed v Kingdom of Bahrain [2024] EWCA Civ 1158 that Bahrain is not immune under the UK State Immunity Act (SIA) from claims regarding the use of spyware to infect laptop computers of human rights and pro-democracy activists.

This is the second case to find an exception to sovereign immunity for allegations related to spyware. This case involved the alleged use of ‘FinSpy’, produced by the Gamma Group (also known as FinFisher).

Professor Philippa Webb represented the claimants in the appeal as well as the High Court.

Background

Dr Shehabi is a journalist and activist who is also the founder of a Bahraini political party called Al Wefaq. Mr Mohammed is a photographer and videographer, and an activist for human rights and democracy in Bahrain. Both claimants have been granted asylum and reside in the United Kingdom. They alleged that Bahrain’s servants or agents hacked their computers using FinSpy, and that this amounted to harassment under the Protection from Harassment Act 1997, and that they suffered psychiatric injury as a consequence [11].

Judgment

The SIA provides a general immunity for foreign states from the jurisdiction of the English courts. However, s 5 provides for an exception “as respects proceedings in respect of – (a) death or personal injury; or (b) damage to or loss of tangible property, caused by an act or omission in the United Kingdom”. This exception allowed the claimants’ case to proceed against Bahrain.

There were three grounds of appeal: (1) whether in such circumstances there is an act by the foreign state in the United Kingdom at all; (2) whether immunity is only lost if all the acts by agents of the foreign state take place in the United Kingdom; (3) whether psychiatric injury is ‘personal injury’ within the meaning of s 5.

The Court of Appeal – comprised of the Lady Chief Justice of England and Wales, LJ Males and LJ Warby – found in favour of the claimants on all three grounds.

On ground 1, LJ Males observed that: “In modern terms, the hacking of a person’s computer is equivalent to burglars breaking in and stealing the contents of their safe. Just as the latter is an act within the United Kingdom, so too is the former” [43]. On ground 2, he noted that: “if State A interferes with the territorial sovereignty of State B by doing an act in State B which is liable to cause death or personal injury to persons in State B, it takes the risk that it will be subject to civil proceedings in State B. Such proceedings are in accordance with principles of international comity” [55]. On ground 3, he found the ‘always speaking’ principle applied and in any event, it was “highly probable that when Parliament used the term ‘personal injury’ in the 1978 Act, that term was understood to include standalone psychiatric injury, at any rate in the absence of a settled contrary meaning in international law” [105].

Philippa Webb appeared unled, alongside Ben Silverstone of Matrix Chambers. She was instructed by Martyn Day and Ida Aduwa of Leigh Day.