URnetwork
•••

Notes on Internet Privacy

Posts and research from the URnetwork team and community.

RSS
News / AnalysisUnited KingdomBahrainJapanSpainRussiaChinaUnited StatesSaudi Arabia

The Act Was in Britain

On July 27 the UK Supreme Court decided where a hack happens. Three justices said where the computer is; two said where the operator is sitting. The three won, 3–2 — and a state whose spyware lands on a machine in Britain can now be sued in Britain. Nothing has been proved: the ruling is on assumed facts, and the two computers at the centre of it were never examined. Six months earlier another British court had already priced a claim like it at £3,025,662.83, against a state that had stopped answering letters.

URnetwork editorialSan Francisco — August 5, 2026

Twenty-eight words

Section 5 of Britain's State Immunity Act 1978 reads, in full:

"A State is not immune as respects proceedings in respect of— (a) death or personal injury; or (b) damage to or loss of tangible property, caused by an act or omission in the United Kingdom."

Parliament wrote that with an embassy car and a pedestrian in mind. On July 27, 2026, in The Kingdom of Bahrain v Shehabi and another [2026] UKSC 25, five justices decided whether it also reaches a spyware implant pushed from a server in Bahrain onto two laptops in London. Three said yes. Two said that answer puts Britain in breach of international law.

One missing condition

The Act exists partly so Britain could ratify the European Convention on State Immunity (Basle, 1972), whose version of the same exception adds a condition: article 11 requires that the facts occurred in the forum state "and that the author of the injury or damage was present in that territory at the time." Section 5 keeps the first linking factor and drops the second.

The majority — Lord Lloyd-Jones, Lord Hamblen and Lady Simler — held the omission deliberate. The presumption that a statute match its treaty "has no application here because the departure from the treaty scheme is deliberate. In our view, this is determinative of the appeal" (para 74). Then the sentence that changes the law: "an act includes an act done using mechanical, electrical or other automated or remote means… even if the person responsible… is not physically present at the location where the act takes place" (para 131). Courts normally read such statutes narrowly, to keep the state out of trouble. This one read wider on purpose, then declined to decide whether customary international law allowed it, resting on "a reasonable basis" (para 79). A hard rule on a soft foundation.

What was alleged, and how anyone knew

Dr Saeed Shehabi leads the Bahrain Freedom Movement; Moosa Mohammed is a photographer whose Bahraini citizenship was revoked in 2012. Both live in London. From around September 2011, they allege, people acting for Bahrain put FinSpy — sold by Gamma Group — on their computers, the operators sitting abroad and the control server in Bahrain. Speaking to Index on Censorship on July 31, Shehabi described the case as being about "the feeling that nowhere is safe"; Mohammed said he is "chasing accountability."

The acts pleaded as happening in England include overwriting the hard disk, switching on the microphones and cameras, and — memorably — using the devices' battery power. Bahrain needed all of it to be merely the effect of an act in Manama, a distinction the Court of Appeal had already called "artificial and unprincipled."

None of it was visible to the men it happened to. Suspicious emails reached Bill Marczak of Toronto's Citizen Lab in May 2012 — a witness the trial judge called "plainly well-qualified" though parti pris as regards Bahrain. On 25 July 2012 Citizen Lab named the control server, 77.69.140.194, in Batelco's range; that address reappears in the pleadings eight years later, which is the corroboration that does not depend on Marczak. A leaked Gamma archive published in 2014 held a target list the claimants say their laptops are on. That is how they found out — and the discovery, not the surveillance, is the injury they sue for, under a 1997 statute written for stalkers.

Bahrain's answer is narrow and real: the claimants "provided no evidence as to how their computers were alleged to have been infected," and the two computers were never examined — not by Marczak, not by anyone. Infection September 2011, discovery August 2014, claim issued 2020, judgment July 2026: fourteen years and ten months, six of them spent establishing only that a court may look.

The steelman, at full strength

Lord Leggatt's objection is grammatical: people "can only act (or omit to act) where they are spatially located" (para 198), so the operator's acts "all take place in Bahrain" and what happens in London is their effect. Section 5 does not require the injury to occur here either (para 219), so the only British element can be a machine.

Then the hardest sentence in the judgment, on whether any state has ever denied immunity for a tort by an absent agent: "there is a complete absence of any such practice. There is not even a single instance of it" (para 315). The majority concedes it at para 89, and neither party could point to a decided case anywhere going the other way.

Lord Burrows shows the section can be read consistently with article 11, then makes the concession that renders the dissent honest rather than clever (para 339): read the Act "divorced from its public international law context" and you would indeed avoid distinguishing an agent in London from the same surveillance run from a keyboard abroad. "But… it is impermissible for this court, and would constitute an undermining of the rule of law, to adopt a statutory interpretation that contradicts public international law unless Parliament has enacted legislation that clearly requires that." His remedy is a bill, not immunity.

Leggatt also puts the uncomfortable part on the page: at para 175, powers to "target computer equipment abroad" are conferred on Britain's own agencies by Parts 2 and 5 of the Investigatory Powers Act 2016. If the act is where the machine is, GCHQ acts wherever its warrants land. But check the arithmetic before calling it symmetry: on the statutes as enacted — Japan 2009, Spain 2015, Russia 2015, China 2023 — none could mirror Britain's rule without amending its own law. The exposure runs in Britain's favour: an uncomfortable property for a principle to have.

Against all of which, one narrow answer. The divergence was a habit, not a slip — para 68 lists five places where the Act departs from its Convention counterparts. This piece does not claim the majority was right on customary international law; the court declined to decide that. It claims only this: a presence requirement does not make remote intrusion hard to sue, it makes it immune by construction — every implant, forever, in every jurisdiction that adopts it. Kidane v Ethiopia (2017) — which this court summarises at paras 287–290 and calls "particularly close" to these facts — is what that looks like from the victim's side: Ethiopia emailed FinSpy onto a Marylander's computer, and the requirement of an entire tort on US soil left him nothing. Burrows's own objection, note, is about who updates the rule, and it is addressed to Parliament rather than to these two men.

What it unlocks, and the ceiling

Britain has already run this to the end, in a different case. Ghanem Al-Masarir, a Saudi satirist in London, alleged Saudi Arabia put Pegasus on two iPhones. He sued in 2019 on the same section 5 — a different claimant, state and tool — immunity was rejected in 2022, and the state then left, ignoring three costs orders. On 26 January 2026 Mr Justice Saini awarded £3,025,662.83, noting the KSA "has made a deliberate decision not to participate" and that enforcement elsewhere "will be necessary." Because section 13 of the same Act bolts the exit: a state's property "shall not be subject to any process for the enforcement of a judgment" unless it consents in writing or the property is in commercial use. That figure caps this story rather than opening it: jurisdiction is not recovery. You can win, be believed, be priced — and hold a piece of paper.

That ceiling is a design decision, and an American court has said so in terms. Judge Phyllis J. Hamilton's injunction in WhatsApp v. NSO Group became enforceable on 28 January 2026, when a Ninth Circuit panel refused to stay it. Read paragraph 1: "notwithstanding anything herein, neither Defendants' foreign sovereign customers nor Defendants' outside counsel are Prohibited Parties." The court directed the plaintiffs to exclude them, because they "are not before the court … of course an injunction in this case cannot apply to them" — and they were never parties because, as NSO's filings put it, they "cannot be sued due to their sovereign immunity." The most consequential spyware ruling in the United States enjoins the seller's code and, by construction, cannot reach the governments that bought and aimed it. July 27 is the first crack in that.

What we know, and what we don't

Settled: section 5 has no presence requirement, in Britain, from 27 July 2026. Not settled: whether Bahrain did any of it — a jurisdiction ruling on assumed facts, devices never examined, no merits trial listed. Untested: section 5 requires death, personal injury or damage to tangible property, and Al-Masarir succeeded partly in trespass to goods, so whether a claim works for someone surveilled but not made ill has never been argued against a state that turns up to contest it. As a null result of our own search: no enforcement decision appears on Find Case Law as of 5 August 2026, and we could not establish that any of the £3.03 million has been recovered. Note the fragility, too — three English claims, one solicitors' firm, largely one set of counsel. We found no Bahraini response.

What you can actually do

Preserve a suspect device instead of wiping it, and keep suspicious messages with their headers intact. Get any harm documented by a clinician early — the injury is the jurisdictional hook, and the element that decays fastest. Send samples to Citizen Lab or Amnesty's Security Lab, whose analyses courts have accepted, and turn on Android's Advanced Protection or iOS Lockdown Mode before you need them. The lever is narrow: Burrows says Parliament should decide this, Britain has no bill, and section 13 stands until someone amends it — which makes the enforcement gap a legislative choice, not a law of nature.

The trust you don't have to place

Remedies follow attribution, and attribution is infrastructure: sandboxes, sample archives, published indicators, researchers who act without a government's permission and cannot be told to stop. That is also why it worked in court — evidence no single party could be ordered to withdraw. The alleged surveillance produced no symptom. The injury began only when someone else's forensic work told these two men what had been on their laptops since 2011. No prosecutor found it. No platform told them.

The limit, plainly: none of that would have stopped FinSpy in 2011, and a judgment is worth only what a sovereign chooses to pay. But the sequence is on the record. Independent forensics made the harm legible; legibility made the tort arguable; and the argument, fourteen years and ten months later, took the immunity away.

References (6 sources)

References

  • The Kingdom of Bahrain (Appellant) v Shehabi and another (Respondents) [2026] UKSC 25 — judgment and press summary, 27 July 2026; ref UKSC/2024/0152, heard 26–27 November 2025 (supremecourt.uk). Majority Lord Lloyd-Jones, Lord Hamblen, Lady Simler; dissents Lord Leggatt and Lord Burrows. Quotations at paras 68, 74, 79, 89, 131, 175, 198, 219, 287–290, 315, 339. Counsel: Tom Hickman KC (Volterra Fietta) for Bahrain; Timothy Otty KC, Ben Silverstone and Philippa Webb (Leigh Day) for the respondents.
  • State Immunity Act 1978, ss.1, 5, 13, 16(2) (legislation.gov.uk); European Convention on State Immunity art. 11; UN Convention on Jurisdictional Immunities 2004 art. 12 — as quoted at [2026] UKSC 25 paras 22–25.
  • Courts below: [2023] EWHC 89 (KB) (Julian Knowles J, 8 Feb 2023) and [2024] EWCA Civ 1158; [2025] KB 490 (Carr LCJ, Males and Warby LJJ, 4 Oct 2024) — caselaw.nationalarchives.gov.uk.
  • El-Khouri v Government of the United States of America [2025] UKSC 3.
  • Al-Masarir v Kingdom of Saudi Arabia [2022] EWHC 2199 (QB); [2023] QB 475; and [2026] EWHC 119 (KB) (Saini J, 26 Jan 2026; £3,025,662.83; "deliberate decision not to participate").
  • Rukundo and Uwamahoro v Republic of Rwanda [2025] EWHC 1675 (KB) (Master Dagnall, 16 Apr 2025).
  • Kidane v Federal Democratic Republic of Ethiopia, 851 F 3d 7 (D.C. Cir., 14 Mar 2017), as summarised at [2026] UKSC 25 paras 287–290.
  • WhatsApp Inc. v. NSO Group Technologies Ltd., N.D. Cal. 4:19-cv-07123-PJH (Judge Phyllis J. Hamilton): Dkt. 802 (17 Oct 2025, "cannot apply to them" at 14); Dkt. 809 ¶ 1 (the foreign-sovereign-customer carve-out); Ninth Circuit No. 25-7380, stay denied 28 Jan 2026.
  • Citizen Lab, "From Bahrain With Love: FinFisher's Spy Kit Exposed?", Marquis-Boire and Marczak, 25 July 2012 (control server 77.69.140.194, Batelco range).
  • Investigatory Powers Act 2016, Parts 2 and 5 (legislation.gov.uk).
  • Claimant statements: Index on Censorship, "No more hiding behind borders, Bahrain told," Jemimah Steinfeld, 31 July 2026. Counsel line confirmed via Blackstone Chambers case note, 28 July 2026.

Further Discussion

There Is Not Even a Single Instance of It

**Position.** Take the case against this ruling at full strength, because it is strong and it comes from inside the court. On July 27 three judges held that a state whose spyware lands on a computer in Britain loses its immunity there — and the two who dissented say that puts the United Kingdom in breach of international law. Lord Leggatt's objection is not sentimental, it is empirical: on whether any state anywhere has ever denied immunity for a tort committed by an agent who was never present, "there is a complete absence of any such practice. **There is not even a single instance of it**" (para 315). The majority does not dispute that. It concedes it at para 89, and neither party could point to a decided case going the other way. Then look at what the majority did with a statute written to let Britain ratify a treaty: it read section 5 **wider than the treaty, deliberately** — "the departure from the treaty scheme is deliberate. In our view, this is determinative of the appeal" (para 74) — and then **declined to decide** whether customary international law permits the result, resting on "a reasonable basis" for what Parliament did (para 79). Courts read treaty-implementing statutes narrowly precisely to keep the state out of trouble. This one did the opposite and did not test whether it could. And everyone else draws the line the other way: *Kidane v Ethiopia* (2017) reached the opposite result on facts this court itself called "particularly close," and on the statutes as enacted — Japan 2009, Spain 2015, Russia 2015, China 2023 — every one keeps the presence requirement. Worse, Leggatt finds at para 219 that section 5 does not require the *injury* to happen in Britain either, so neither operator nor victim need ever be here: the only British element can be a machine. Lord Burrows puts the constitutional point plainly, and he is not defending Bahrain — he thinks the modern reading may well be right, which is exactly why **Parliament** and not a court should adopt it, because doing otherwise "would constitute an undermining of the rule of law" (para 339). A rule this consequential, invented by three votes to two on a foundation the majority would not test, is a hard rule on a soft foundation. **Headline candidates.** - There Is Not Even a Single Instance of It - Three Judges, No Precedent, One New Rule of International Law - The Court Read the Statute Wider Than Its Treaty — On Purpose - A Hard Rule on a Soft Foundation **Kicker.** Three votes to two, on a reading the majority admits departs from the treaty deliberately — and then refused to decide whether international law allows it. No state has ever done this; not one instance, in the dissent's words the majority accepts. Britain's own agencies are told by statute they may target computers abroad. Burrows even agrees the rule may be right: he just says Parliament, not five judges, should be the one to write it.

A Presence Requirement Makes the Tort Disappear

**Position.** Now read the alternative for what it actually does. A presence requirement does not make suing a state for remote intrusion *hard*. It makes it **immune by construction** — every implant, forever, in every jurisdiction that adopts it — because the whole design of the tool is that nobody has to travel. And that is not a thought experiment: it has a documented victim. In *Kidane v Ethiopia*, Ethiopia emailed FinSpy onto a computer in Maryland, and the Foreign Sovereign Immunities Act's demand for the **entire tort** on US soil left the man with nothing. Same tool, same delivery, opposite result. Choosing the dissent is choosing a world where no remote implant is ever actionable against the state that sent it, anywhere, forever. On the law, the divergence from the treaty was a policy and not a slip: para 68 identifies **five** provisions where the 1978 Act departs from its Convention counterpart in scope or linking factor, and Bahrain's own counsel conceded the departure was deliberate. And note precisely what the dissent concedes — Lord Burrows grants that, read as a living instrument, the statute probably means what the majority says (para 339). The disagreement is about *which institution updates the rule*, not about what the rule should be. That is an argument addressed to Parliament, and Britain has no bill; it is not a reason these two men should lose. Then the number that should end it: **fourteen years and ten months** from alleged infection to a ruling that a court may merely *look* — September 2011 to July 27, 2026 — six of those years spent on jurisdiction alone. And the only reason there was ever a case is that a university lab published a control-server address, **77.69.140.194**, on 25 July 2012, and it reappeared in the pleadings eight years later. Under the dissent's rule all of that ends at year zero. Be honest about the ceiling too: another British court has already priced this kind of claim at **£3,025,662.83**, and section 13 immunises state property from enforcement, while an American injunction expressly excludes NSO's "**foreign sovereign customers**" because they "cannot be sued due to their sovereign immunity." That is the shape of the whole civil route — and July 27 is the first crack in it. **Headline candidates.** - A Presence Requirement Makes the Tort Disappear - Fourteen Years and Ten Months to Be Allowed to Ask - The Buyers Are Named in the Carve-Out - Same Tool, Same Delivery, Opposite Result **Kicker.** The dissent's rule has a victim with a name: Ethiopia emailed spyware to Maryland and the "entire tort" doctrine gave him nothing. Section 5 dropped the presence condition five times over — a policy, not a slip — and Burrows concedes the modern reading is probably right, just not a court's to make. Fourteen years and ten months, six of them spent proving a court may look, and it only happened because a lab published an IP address. Attribution is what made the harm legible. Legibility made the tort arguable.

Comics

#1There Is Not Even a Single Instance of It
#2A Presence Requirement Makes the Tort Disappear