The case concerned two Bahraini democracy campaigners who fled to the UK and claimed that, in 2011, their computers were remotely infected with spyware operated by a server in Bahrain. The software allegedly enabled surveillance of their files, communications and audio and video activity. After discovering the alleged surveillance through documents published by WikiLeaks in 2014, the activists suffered psychiatric injury.

Bahrain argued that it was protected from the claims by the State Immunity Act 1978, which generally prevents foreign states being sued in UK courts. The activists relied on an exception in section 5 of the Act, which removes immunity for personal injury caused by an act or omission in the UK.

The Supreme Court considered whether this exception required the relevant act causing the injury to have taken place entirely in the UK, and whether the person responsible for the act had to be physically present in the UK.

By a three-to-two majority, the court held that Bahrain was not entitled to immunity. Lord Lloyd-Jones, Lord Hamblen and Lady Simler said the legislation required an act in the UK that caused personal injury, but did not require every act involved in causing the injury to occur in the UK or the person responsible to be present there.

The majority found that the alleged surveillance constituted acts carried out in the UK because it involved hacking computers located in the country and monitoring people within its territory.

The judges said requiring the perpetrators to be physically present in the UK would create “arbitrary distinctions”, pointing to examples including killings carried out remotely by drones or foreign cyberattacks on critical systems.

They concluded that such acts could represent serious interference with UK territorial sovereignty and were not entitled to state immunity.

The appeal was dismissed.

Our sister publication, Scottish Legal News, has published a full summary of the case