# The Act Was in Britain **Deck:** On July 27 the UK Supreme Court decided where a hack happens. Three justices said where the computer is; two said where the operator is sitting. The three won, 3–2 — and a state whose spyware lands on a machine in Britain can now be sued in Britain. Nothing has been proved: the ruling is on assumed facts, and the two computers at the centre of it were never examined. Six months earlier another British court had already priced a claim like it at £3,025,662.83, against a state that had stopped answering letters. **By:** URnetwork editorial **Dateline:** San Francisco — August 5, 2026 **Category:** News / Analysis --- ## Twenty-eight words Section 5 of Britain's State Immunity Act 1978 reads, in full: > "A State is not immune as respects proceedings in respect of— (a) death or personal injury; or (b) damage to or loss of tangible property, **caused by an act or omission in the United Kingdom**." Parliament wrote that with an embassy car and a pedestrian in mind. On **July 27, 2026**, in *The Kingdom of Bahrain v Shehabi and another* [2026] UKSC 25, five justices decided whether it also reaches a spyware implant pushed from a server in Bahrain onto two laptops in London. Three said yes. Two said that answer puts Britain in breach of international law. ## One missing condition The Act exists partly so Britain could ratify the **European Convention on State Immunity** (Basle, 1972), whose version of the same exception adds a condition: article 11 requires that the facts occurred in the forum state "**and** that the author of the injury or damage was present in that territory at the time." Section 5 keeps the first linking factor and drops the second. The majority — **Lord Lloyd-Jones, Lord Hamblen and Lady Simler** — held the omission deliberate. The presumption that a statute match its treaty "has no application here **because the departure from the treaty scheme is deliberate. In our view, this is determinative of the appeal**" (para 74). Then the sentence that changes the law: "an act includes an act done using mechanical, electrical or other automated or remote means… even if the person responsible… is not physically present at the location where the act takes place" (para 131). Courts normally read such statutes *narrowly*, to keep the state out of trouble. This one read wider on purpose, then declined to decide whether customary international law allowed it, resting on "a reasonable basis" (para 79). A hard rule on a soft foundation. ## What was alleged, and how anyone knew **Dr Saeed Shehabi** leads the Bahrain Freedom Movement; **Moosa Mohammed** is a photographer whose Bahraini citizenship was revoked in 2012. Both live in London. From **around September 2011**, they allege, people acting for Bahrain put **FinSpy** — sold by Gamma Group — on their computers, the operators sitting abroad and the control server in Bahrain. Speaking to *Index on Censorship* on **July 31**, Shehabi described the case as being about "the feeling that nowhere is safe"; Mohammed said he is "chasing accountability." The acts pleaded as happening in England include overwriting the hard disk, switching on the microphones and cameras, and — memorably — **using the devices' battery power**. Bahrain needed all of it to be merely the *effect* of an act in Manama, a distinction the Court of Appeal had already called "artificial and unprincipled." None of it was visible to the men it happened to. Suspicious emails reached **Bill Marczak** of Toronto's **Citizen Lab** in May 2012 — a witness the trial judge called "plainly well-qualified" though *parti pris* as regards Bahrain. On **25 July 2012** Citizen Lab named the control server, **77.69.140.194**, in Batelco's range; that address reappears in the pleadings eight years later, which is the corroboration that does not depend on Marczak. A leaked Gamma archive published in 2014 held a target list the claimants say their laptops are on. That is how they found out — and the discovery, not the surveillance, is the injury they sue for, under a 1997 statute written for stalkers. Bahrain's answer is narrow and real: the claimants "provided no evidence as to how their computers were alleged to have been infected," and **the two computers were never examined — not by Marczak, not by anyone.** Infection September 2011, discovery August 2014, claim issued 2020, judgment July 2026: **fourteen years and ten months**, six of them spent establishing only that a court may look. ## The steelman, at full strength **Lord Leggatt**'s objection is grammatical: people "can only act (or omit to act) where they are spatially located" (para 198), so the operator's acts "all take place in Bahrain" and what happens in London is their effect. Section 5 does not require the *injury* to occur here either (para 219), so the only British element can be a machine. Then the hardest sentence in the judgment, on whether any state has ever denied immunity for a tort by an absent agent: "there is a complete absence of any such practice. **There is not even a single instance of it**" (para 315). The majority concedes it at para 89, and neither party could point to a decided case anywhere going the other way. **Lord Burrows** shows the section *can* be read consistently with article 11, then makes the concession that renders the dissent honest rather than clever (para 339): read the Act "divorced from its public international law context" and you would indeed avoid distinguishing an agent in London from the same surveillance run from a keyboard abroad. "But… it is impermissible for this court, and would constitute an undermining of the rule of law, to adopt a statutory interpretation that contradicts public international law unless Parliament has enacted legislation that clearly requires that." His remedy is a bill, not immunity. Leggatt also puts the uncomfortable part on the page: at para 175, powers to "**target computer equipment abroad**" are conferred on Britain's own agencies by Parts 2 and 5 of the Investigatory Powers Act 2016. If the act is where the machine is, GCHQ acts wherever its warrants land. But check the arithmetic before calling it symmetry: on the statutes as enacted — Japan 2009, Spain 2015, Russia 2015, China 2023 — none could mirror Britain's rule without amending its own law. The exposure runs in Britain's favour: an uncomfortable property for a principle to have. Against all of which, one narrow answer. The divergence was a habit, not a slip — para 68 lists five places where the Act departs from its Convention counterparts. This piece does not claim the majority was right on customary international law; the court declined to decide that. It claims only this: a presence requirement does not make remote intrusion hard to sue, it makes it **immune by construction** — every implant, forever, in every jurisdiction that adopts it. *Kidane v Ethiopia* (2017) — which this court summarises at paras 287–290 and calls "particularly close" to these facts — is what that looks like from the victim's side: Ethiopia emailed FinSpy onto a Marylander's computer, and the requirement of an **entire tort** on US soil left him nothing. Burrows's own objection, note, is about *who* updates the rule, and it is addressed to Parliament rather than to these two men. ## What it unlocks, and the ceiling Britain has already run this to the end, in a different case. **Ghanem Al-Masarir**, a Saudi satirist in London, alleged Saudi Arabia put **Pegasus** on two iPhones. He sued in 2019 on the same section 5 — a different claimant, state and tool — immunity was rejected in 2022, and the state then left, ignoring three costs orders. On **26 January 2026** Mr Justice Saini awarded **£3,025,662.83**, noting the KSA "has made a deliberate decision not to participate" and that enforcement elsewhere "will be necessary." Because **section 13** of the same Act bolts the exit: a state's property "shall not be subject to any process for the enforcement of a judgment" unless it consents in writing or the property is in commercial use. That figure caps this story rather than opening it: jurisdiction is not recovery. You can win, be believed, be priced — and hold a piece of paper. That ceiling is a design decision, and an American court has said so in terms. Judge Phyllis J. Hamilton's injunction in *WhatsApp v. NSO Group* became enforceable on **28 January 2026**, when a Ninth Circuit panel refused to stay it. Read paragraph 1: "notwithstanding anything herein, neither Defendants' **foreign sovereign customers** nor Defendants' outside counsel are Prohibited Parties." The court *directed* the plaintiffs to exclude them, because they "are not before the court … of course an injunction in this case cannot apply to them" — and they were never parties because, as NSO's filings put it, they "cannot be sued due to their sovereign immunity." The most consequential spyware ruling in the United States enjoins the seller's code and, by construction, cannot reach the governments that bought and aimed it. July 27 is the first crack in that. ## What we know, and what we don't Settled: section 5 has no presence requirement, in Britain, from 27 July 2026. Not settled: whether Bahrain did any of it — a jurisdiction ruling on **assumed facts**, devices never examined, no merits trial listed. Untested: section 5 requires death, personal injury or damage to tangible property, and *Al-Masarir* succeeded partly in **trespass to goods**, so whether a claim works for someone surveilled but not made ill has never been argued against a state that turns up to contest it. As a null result of our own search: no enforcement decision appears on Find Case Law as of 5 August 2026, and we could not establish that any of the £3.03 million has been recovered. Note the fragility, too — three English claims, one solicitors' firm, largely one set of counsel. We found no Bahraini response. ## What you can actually do Preserve a suspect device instead of wiping it, and keep suspicious messages with their headers intact. Get any harm documented by a clinician early — the injury is the jurisdictional hook, and the element that decays fastest. Send samples to Citizen Lab or Amnesty's Security Lab, whose analyses courts have accepted, and turn on Android's Advanced Protection or iOS Lockdown Mode *before* you need them. The lever is narrow: Burrows says Parliament should decide this, Britain has no bill, and section 13 stands until someone amends it — which makes the enforcement gap a legislative choice, not a law of nature. ## The trust you don't have to place Remedies follow attribution, and attribution is infrastructure: sandboxes, sample archives, published indicators, researchers who act without a government's permission and cannot be told to stop. That is also why it worked in court — evidence no single party could be ordered to withdraw. The alleged surveillance produced no symptom. The injury began only when someone else's forensic work told these two men what had been on their laptops since 2011. No prosecutor found it. No platform told them. The limit, plainly: none of that would have stopped FinSpy in 2011, and a judgment is worth only what a sovereign chooses to pay. But the sequence is on the record. Independent forensics made the harm legible; legibility made the tort arguable; and the argument, fourteen years and ten months later, took the immunity away. --- ## References - *The Kingdom of Bahrain (Appellant) v Shehabi and another (Respondents)* [2026] UKSC 25 — judgment and press summary, 27 July 2026; ref UKSC/2024/0152, heard 26–27 November 2025 (supremecourt.uk). Majority Lord Lloyd-Jones, Lord Hamblen, Lady Simler; dissents Lord Leggatt and Lord Burrows. Quotations at paras 68, 74, 79, 89, 131, 175, 198, 219, 287–290, 315, 339. Counsel: Tom Hickman KC (Volterra Fietta) for Bahrain; Timothy Otty KC, Ben Silverstone and Philippa Webb (Leigh Day) for the respondents. - State Immunity Act 1978, ss.1, 5, 13, 16(2) (legislation.gov.uk); European Convention on State Immunity art. 11; UN Convention on Jurisdictional Immunities 2004 art. 12 — as quoted at [2026] UKSC 25 paras 22–25. - Courts below: [2023] EWHC 89 (KB) (Julian Knowles J, 8 Feb 2023) and [2024] EWCA Civ 1158; [2025] KB 490 (Carr LCJ, Males and Warby LJJ, 4 Oct 2024) — caselaw.nationalarchives.gov.uk. - *El-Khouri v Government of the United States of America* [2025] UKSC 3. - *Al-Masarir v Kingdom of Saudi Arabia* [2022] EWHC 2199 (QB); [2023] QB 475; and [2026] EWHC 119 (KB) (Saini J, 26 Jan 2026; £3,025,662.83; "deliberate decision not to participate"). - *Rukundo and Uwamahoro v Republic of Rwanda* [2025] EWHC 1675 (KB) (Master Dagnall, 16 Apr 2025). - *Kidane v Federal Democratic Republic of Ethiopia*, 851 F 3d 7 (D.C. Cir., 14 Mar 2017), as summarised at [2026] UKSC 25 paras 287–290. - *WhatsApp Inc. v. NSO Group Technologies Ltd.*, N.D. Cal. 4:19-cv-07123-PJH (Judge Phyllis J. Hamilton): Dkt. 802 (17 Oct 2025, "cannot apply to them" at 14); Dkt. 809 ¶ 1 (the foreign-sovereign-customer carve-out); Ninth Circuit No. 25-7380, stay denied 28 Jan 2026. - Citizen Lab, "From Bahrain With Love: FinFisher's Spy Kit Exposed?", Marquis-Boire and Marczak, 25 July 2012 (control server 77.69.140.194, Batelco range). - Investigatory Powers Act 2016, Parts 2 and 5 (legislation.gov.uk). - Claimant statements: *Index on Censorship*, "No more hiding behind borders, Bahrain told," Jemimah Steinfeld, 31 July 2026. Counsel line confirmed via Blackstone Chambers case note, 28 July 2026. --- ## Publication notes (for the supervisor) Winner of the August 5 slate (edition 01), selected over 19 other fully-developed candidates; the scored comparison is in `blog-research/2026-08-05-01/group-critique.md` (composite 9.05, ahead of candidate-10 "The Only Source Was Eight Companies" at 8.90, candidate-15 at 8.80 and candidate-01 at 8.775). Every candidate carries a research pack, eight successive drafts, a holes file, a self-critique and an iteration log of 26–38 named passes — 600 passes across the slate against a required 20 each, verified by script. Executed as the board directed: a single-thesis piece, with the 07+09+08 spyware triptych three desks proposed **forbidden** on the ground that it swaps a restatable thesis for "accountability is patchy." Exactly one absorption was permitted and taken — the *WhatsApp v. NSO* Dkt. 809 ¶ 1 sovereign-customer carve-out from candidate-09, placed immediately after "Jurisdiction is not recovery," which converts the section 13 concession from a shrug into the argument. The board's ten-item cut list was applied (rebuttal folded into the steelman; "The mirror" compressed to one paragraph rather than deleted, per risk 8, because deleting the piece's own exposure would make it advocacy), and its two restorations made: the 31 July claimant quotations, and the trespass-to-goods line in the ledger. **Length, reported honestly.** The board set a hard ceiling of 1,600 body words. The filed piece measures **1,762** — 162 over (re-measured 11 August 2026; this note said 1,795 / 195 over, which was true when filed, before later editing removed 33 words). The draft came down 546 words from 2,341, and the remaining overage is the point at which further cutting would have breached either the board's own must-not-cut list or one of its fifteen numbered risk mitigations. Two of its ten cuts conflict with its own register: cut 2 asks for 100 words out of "The mirror" while risk 8 forbids deleting it, and cut 6 asks the *Kidane* passage down to one sentence while risk 10 requires attributing that holding to the Supreme Court's own summary at paras 287–290 because the opinion could not be retrieved. Where the two collided, the risk register won, on the view that an accurate piece 195 words long is a better failure than a short one that overclaims. Flagged rather than hidden, per the standard the board applied to the two desks that misreported their own counts. Risk register applied literally. "On assumed facts" is in the deck, not just the ledger; every allegation is graded; "the two computers were never examined — not by Marczak, not by anyone" is verbatim; Marczak's *parti pris* is quoted from the trial judge with the corroboration that does not depend on him; the comparative statute reading is dated inline so a reader can check it; £3,025,662.83 is labelled a different claimant, state and tool and used to cap rather than carry the story; the enforcement gap is reported as a null result of our own search rather than as a claim about Saudi Arabia; *Kidane* is attributed to the Supreme Court's own summary because the opinion itself could not be retrieved; the "first apex court anywhere" overclaim is not made; and the coda's network-tool list was cut per the board's ruling, keeping the attribution-infrastructure argument that actually operated in this case. Ten premises of the desk's own candidate slate were disproved by the desks during development and are recorded in `candidate-slate.md`; all ten were credited rather than penalised in scoring. The highest self-score on the slate (candidate-10, 9.0) did not win, and the reason is recorded. Held for later editions with fresher hooks: candidate-10 (12 and 31 August deadlines), candidate-15 (10–12 August, when the TRIS standstill lapses), and candidate-09 (20 August contempt hearing). Two opposing hot takes in HOT-TAKES.md: HT1 argues that three judges made Britain the world's spyware court on a rule they concede no state has ever applied; HT2 argues that a presence requirement is a design decision that makes the tort disappear by construction.