The UK Court of Appeal determines that the Kingdom of Bahrain does not have immunity in a spyware case

Summary 

The Court of Appeal has upheld the High Court’s earlier judgment that the Kingdom of Bahrain (“Bahrain”) is not entitled to state immunity from a personal injury claim arising from allegations that it has committed espionage in the UK. Our article reflecting on the High Court’s earlier judgment is discussed here.

The facts of the case are unusual, although not unprecedented.  The claimants, described as pre-democracy activists and members of the Bahraini opposition movement, allege that spyware was installed on their computers, located in England, by agents of Bahrain located abroad. The claimants allege that they suffered psychiatric injury upon discovering that they were being spied on.

Upholding the High Court’s judgment, the Court of Appeal unanimously held that the alleged acts occurred within the UK and, therefore, Bahrain was not entitled to immunity under the State Immunity Act 1978 (the “SIA”) because section 5 of the SIA (“section 5”) applied. This decision underscores the English courts’ position on the territorial application of state immunity in cases involving acts committed by the agents of a foreign state in this jurisdiction and, specifically, in the context of the use of spyware on electronic devices located in this jurisdiction.

The Factual Background

The claimants have brought a claim in harassment, under the Protection from Harassment Act 1997, against Bahrain and they have alleged that from around September 2011 their computers were hacked or infected by Bahrain’s agents, who were operating outside the UK, with a spyware program called FinSpy. The claimants allege that they have suffered psychiatric injury which constitutes personal injury within the exception to state immunity under section 5 and, therefore, Bahrain is not immune from suit.

The allegations are denied by Bahrain.

The Legal Issues

The following three issues were argued before the Court of Appeal:

1. Does the remote installation of spyware on the computers of individuals located in the UK, by agents of a foreign state who are located abroad, qualify as an act by the foreign state in the UK? (Ground of Appeal 1)
2. Is immunity only lost if all the acts by agents of the foreign state take place within the UK, or is it sufficient if only some acts occur within the UK? (Ground of Appeal 2)
3. Is psychiatric injury 'personal injury' within the meaning of section 5? (Ground of Appeal 3)

As noted above, Mr Justice Julian Knowles had ruled in favour of the claimants on these issues.

The legal framework relevant to this case is well known, but they are worthwhile repeating. Section 1 of the SIA provides that “A State is immune from the jurisdiction of the courts of the United Kingdom except as provided in the following provisions of this Part of this Act.” For a state to be subject to the jurisdiction of the courts of the UK, the proceedings must fall within an exception to immunity specified in sections 2 to 11 of the SIA. It follows that if no exception applies, the courts of the UK will lack jurisdiction.

The relevant exception in this case is that under section 5 which provides that:

“A State is not immune as respects proceedings in respect of- (a) death or personal injury; or (b) damage to or loss of tangible property,  caused by an act or omission in the United Kingdom.”

The Court of Appeal’s judgment

Ground of Appeal 1

On appeal, Bahrain submitted that when an individual, based abroad, uses a computer to infect another computer located in the UK with spyware, the relevant act is to be regarded as having taken place abroad and not in the UK for the purposes of section 5. In support of those submissions, Bahrain relied on:

• The recent judgment of the European Court of Human Rights (“ECtHR”) in Wieder v United Kingdom (2024) 78 EHRR 8 (which held that an act of surveillance comparable to the alleged hacking in this case occurs where the communications are intercepted and examined, not where the target’s computer is located).
• The Computer Misuse Act 1990 which, Bahrain submitted, recognises that when an individual abroad obtains unauthorised access to a computer in the UK, the offending acts are committed abroad.  

In response, the claimants submitted that it was unrealistic to suggest that no acts occurred in the UK. The claimants contended that Bahrain’s submissions conflated the act with the actor, and there is no requirement in section 5 for the actor to be present in the UK.

The Court of Appeal held that, as a straightforward use of language, remotely manipulating a computer in the UK from abroad constitutes an act within the UK. The reality is that the agents of the foreign sate commit acts both in the UK and abroad. The Court of Appeal concluded that a foreign state who acts in this way has interfered with the territorial sovereignty of the UK, and it makes no difference where the agents of the foreign state are located. The Court of Appeal found that neither Wieder v United Kingdom nor the Computer Misuse Act supported Bahrain’s case.

Ground of Appeal 2

The judge had held that the plain grammatical meaning of section 5 was that immunity would not apply if an act or omission causing personal injury occurred in the UK, even if other causative acts took place abroad, which followed the judge’s earlier judgment in Al-Masarir v Kingdom of Saudi Arabia [2022] EWHC 2199 (QB), which we discussed here.

In its submissions, Bahrain was critical of the judge’s approach and contended that too much reliance had been placed on the grammatical meaning of section 5. Bahrain submitted that all of the acts causing the personal injury had to occur in the UK for section 5 to apply. Bahrain raised multiple points in support of its position, including that the purpose of section 5 was to implement into domestic law the provisions of Article 11 of the European Convention on State Immunity 1972 (“ECSI”) which provides that the author of the injury or damage must be present in the forum state at the time when the injury or damage occurred. 

Unsurprisingly, the claimants submitted that the judge was correct to regard the meaning of section 5 as clear.

The Court of Appeal agreed with the judge that the language in section 5 is clear and unambiguous. Turning to Bahrain’s reliance of Article 11 of the ECSI, the Court of Appeal described it as simplistic and inaccurate to say that the purpose of the SIA was to implement the ECSI as a matter of domestic law.  Rather, the true position is that the SIA gave broad effect to the ECSI, but departed from it in several respects, including section 5 which clearly diverges from the equivalent provision in the ECSI.    Section 5 is concerned with an “an act” of the foreign state, and the requirement for “the author of the injury or damage” to be present in the forum state was deliberately omitted from section 5.  As such, the Court of Appeal regarded the terms of Article 11 of the ECSI as of “no real help” in interpreting section 5.

Ground of Appeal 3

The judge had held that psychiatric injury constitutes personal injury within the meaning of section 5, relying on two earlier judgments of the Employment Appeal Tribunal (Military Affairs Office of the Embassy of the State of Kuwait v Caramba-Coker [2003] UKEAT/1054/02 and Federal Republic of Nigeria v Ogbonna [2011] UKEAT/585/10).

On appeal, Bahrain submitted that “standalone” psychiatric injury was not within the meaning of “personal injury” under section 5, however, Bahrain accepted that there would be no immunity for an act in the UK causing psychiatric injury  associated with physical injury.  Whilst accepting that English courts regard “personal injury” as including both physical and psychiatric injury, Bahrain asserted that this approach should not be applied to the SIA because that approach was not clearly established in 1978 (when the SIA was enacted).

The claimants argued that, as a matter of statutory interpretation, section 5 should not be tied to concepts of “personal injury” as they were understood in 1978 (relying on the “always speaking principle”). In addition, the claimants relied on the EAT’s decision in Ogbonna, they asserted that even in 1978 “personal injury” was understood as including standalone psychiatric injury under English law and, further, there was no settled international law concept of personal injury that excluded a stand-alone psychiatric injury.

The Court of Appeal accepted the claimants’ submissions in full, and concluded that:

• A general principle of statutory interpretation is that a statute is not frozen in time at the date of its enactment. As English law regards psychiatric injury as falling within personal injury, so too must section 5 be interpreted in that way, unless there are compelling reasons not to do so.
• There is strong persuasive authority (the Court of Appeal’s decision in Zu Sayn-Wittgenstein-Sayn v HM Juan Carlos de Borbón y Borbón [2022] EWCA Civ 1595, which approved Ogbonna) that a standalone claim to have suffered a recognised psychiatric injury is a claim for personal injury within section 5.
• The claimants were able to show that even in 1978 “personal injury” was considered in English law as encompassing standalone psychiatric injury and, therefore, it is highly probable that the reference to “personal injury” in the SIA was understood in that way.
• There is no recognised meaning in international law to the phrase “personal injury” that restricts the natural meaning of those words in domestic law.

Comment

It is noteworthy that the Court of Appeal was provided with a substantial volume of material by the parties, spanning more than 2,600 pages, covering international law and comparative law from the US and Canada.  Whilst the Court of Appeal appeared to indicate that the true meaning of section 5 is capable of being understood without reference to this extensive volume of material, the judgment also illustrates how parties use international law and comparative law as guidance when interpreting the provisions in the SIA.

The Court of Appeal's judgment endorsed the comprehensive and detailed analysis provided by Mr Justice Knowles in the lower court, and the judgment makes abundantly clear that the words in section 5 are clear and mean what they say. Of particular interest are Lord Justice Males’ comments that it is “too simple” and “inaccurate” to say that the purpose (or even a purpose) of the SIA was to implement the ECSI as a matter of domestic law.  Going forward, these comments by the Court of Appeal may have an impact on the interpretation of the provisions of the SIA and cause practitioners to be more cautious about seeking to compare the effect and operation of equivalent provisions in the SIA with those in the ECSI, particularly where there are significant differences between the provisions in the SIA and the ECSI. 

The judgment reinforces the principle that English courts are prepared to disapply state immunity when the alleged acts of a foreign state interfere with the territorial sovereignty of the UK, even when some of the acts in question occur abroad.

Dr Saeed Shehabi Moosa Mohammed v The Kingdom of Bahrain, [2024] EWCA Civ 1158

Article co-authored by Hanisha Kanani, Trainee Solicitor (Solicitor Graduate Apprentice) at CMS.