22/08/2022

High Court rules that a foreign state can be sued for alleged use of spyware

On 19 August 2022, the High Court ruled in Al Masarir v Kingdom of Saudi Arabia [2022] EWHC 2199 that Saudi Arabia is not immune under the UK State Immunity Act (SIA) in a case alleging the use of spyware to infiltrate the iPhones of a prominent human rights activist. This is the first case to find an exception to sovereign immunity for allegations related to spyware.

Professor Philippa Webb represented the claimant, Mr Al-Masarir, a satirist and human rights activist residing in the UK. He alleged that the Saudi regime had infected his two iPhones with spyware known as “Pegasus” acquired from the Israeli company, NSO Group. He said this spyware enabled the “covert and unauthorised accessing” of information stored on and communicated by his phones (Judgment, [15]). Mr Al-Masarir also claimed he was followed and attacked in Knightsbridge, London, by men who were directed or authorised by Saudi Arabia (Judgment, [16]). He brought a claim for damages for personal injury in the form of psychiatric injury resulting from misuse of private information, harassment, trespass to goods, and assault.

The SIA provides a general immunity for foreign states from the jurisdiction of the English courts. However, section 5 SIA provides for an exception “as respects proceedings in respect of – (a) death or personal injury; or (b) damage to or loss of tangible property, caused by an act or omission in the United Kingdom.” It was this exception that allowed Mr Al-Masarir’s case to proceed against Saudi Arabia.

Mr Justice Knowles observed that for the section 5 exception to apply, there had to be “an act or omission in the UK which is causative of the requisite damage on a more than de minimis basis” (Judgment, [120]). He therefore rejected Saudi Arabia’s argument that section 5 requires “each of the acts relied on as causing the personal injury [to have] occurred in the UK” (Judgment, [134]). The Judge noted that where “a computer device located in the UK is manipulated and made to perform operations as a result of electronic instructions sent from a computer/operator located abroad then there is authority for the proposition that this is to be regarded as an act within the UK” (Judgment, [132]).

Taking into account the extensive technical evidence of Dr Marczak of Citizen Lab, Mr Justice Knowles found that Mr Al-Masarir had shown to the requisite standard that his iPhones were infected with spyware, and that Saudi Arabia and/or those for whom it was vicariously liable, were responsible (Judgment, [160]).

The judgment is significant in two respects. First, it has implications for other individuals targeted or hacked by spyware in the UK. There have been reports of the targeting of journalists, politicians, solicitors, dissidents and human rights activists. Second, the judgment opens up the possibility of using the section 5 exception to hold foreign states accountable for acts such as poisoning and kidnapping carried out on UK soil, even if the planning took place abroad.

Philippa Webb was led by Richard Hermer QC of Matrix Chambers and appeared alongside Ben Silverstone (also of Matrix). She was instructed by Martyn Day and Ida Aduwa of Leigh Day.

Read the judgment.

The case has been featured in the press, including:

The Guardian

Rozenberg