UK Supreme Court Rejects Bahrain’s State Immunity in FinSpy Spyware Case

The UK Supreme Court has dismissed an appeal brought by Bahrain, ruling that remote spyware infections originating from abroad can constitute a direct legal act within the United Kingdom. The decision marks a pivotal moment in cross-border accountability, clearing the path for a long-running lawsuit to proceed to a full trial in the High Court.

The legal battle centers on two prominent Bahraini political activists living in London, Dr. Saeed Shehabi and Moosa Mohammed. The claimants allege that their personal computers were infected with FinSpy spyware in September 2011 by agents acting on behalf of the Bahraini government. They maintain that the covert surveillance operation caused them significant psychological harm while they were residing in the UK.

For years, Bahrain challenged the lawsuit in the High Court and the Court of Appeal, arguing that its actions as a sovereign state were fully protected by state immunity from the jurisdiction of UK courts. Both lower courts rejected that defense, prompting Bahrain to escalate the challenge to the nation’s highest court, which has now upheld those earlier judgments.

Establishing Jurisdiction Over Cross-Border Cyber Surrogates

By determining that a remote digital intrusion launched from outside the country qualifies as an act executed within British territory, the ruling bypasses traditional jurisdictional roadblocks that often shield foreign intelligence operations.

Amnesty International welcomed the decision, pointing to its broader implications for digital safety and civil liberties. Stanley Kwenda, a strategic communications advisor for the organization, noted that the judgment dismantles barriers that governments have historically used to evade scrutiny.

“In establishing that the remote infection of devices from abroad constitutes an ‘act in the UK’, this ruling opens new avenues for justice and sends a signal that tech-enabled transnational repression will no longer be tolerated,” Kwenda said in a statement. “This is an important step for the two claimants and other spyware victims both in the UK and internationally who have been fighting for accountability.”

The Global Reach of Commercial Surveillance Software

The software was developed by FinFisher GmbH, a Munich-based company that has since become defunct following widespread scrutiny and legal challenges over the proliferation of its products to authoritarian regimes.

The UK Supreme Court decision now provides a clear legal pathway for victims of such technology to seek civil damages and judicial remedies in British courts without running aground on blanket claims of state immunity.

“This ruling provides them with clarity and a clear legal pathway to pursue justice in UK courts,” Kwenda added. “Governments may no longer be able to hide behind state immunity. Let this serve as a stark warning that the unlawful cross-border use of invasive surveillance technologies to target human rights defenders will face legal action.”

Next Steps in the High Court

With the Supreme Court’s dismissal of Bahrain’s appeal, the case is scheduled to return to the High Court. The proceedings will now advance toward a full trial, where both parties will present evidence regarding the alleged deployment of the spyware and the extent of the psychological and personal harm suffered by the claimants.

Further updates on hearing dates and procedural schedules will be released through official court channels as the litigation progresses.