The UK Supreme Court on 27 July 2026 dismissed an appeal by the Kingdom of Bahrain, which had claimed state immunity in a long-running lawsuit brought by two Bahraini political activists living in London. The claimants, Dr Saeed Shehabi and Moosa Mohammed, allege they suffered psychological harm after agents acting on behalf of the Bahraini government infected their laptops with FinSpy spyware while they were in the UK, in September 2011.

The decision, issued in case UKSC 2024/0152, brings an end to Bahrain's jurisdictional challenge at the apex level. Bahrain had previously argued before both the High Court and the Court of Appeal that its actions as a sovereign state placed it outside the jurisdiction of UK courts. Both lower courts ruled against Bahrain. The Supreme Court has now upheld that position.

The case will now return to the High Court, where it is expected to proceed to a full trial on the merits of the claimants' allegations.

The operative finding

At the centre of the ruling is the question of where the alleged wrongful conduct occurred. The Supreme Court established that the remote infection of devices from abroad constitutes an "act in the UK". That characterization determines whether the conduct falls within the exceptions to state immunity under UK law and, with it, whether English courts can hear the claim at all.

The finding carries obvious significance for litigation involving cross-border digital intrusions. Where a state actor deploys spyware against individuals located in the UK — even if the operators and infrastructure sit abroad — the alleged act is now treated as having occurred on UK soil for the purposes of jurisdiction.

Reaction

Stanley Kwenda, Strategic Communications Advisor at Amnesty International, which has supported the claimants, said the ruling "opens new avenues for justice and sends a signal that tech-enabled transnational repression will no longer be tolerated."

"This is an important step for the two claimants and other spyware victims both in the UK and internationally who have been fighting for accountability," Kwenda said. "This ruling provides them with clarity and a clear legal pathway to pursue justice in UK courts. Governments may no longer be able to hide behind state immunity."

He added: "Let this serve as a stark warning that the unlawful cross-border use of invasive surveillance technologies to target human rights defenders will face legal action."

Background to the claim

Dr Shehabi and Moosa Mohammed are prominent Bahraini activists resident in London. They allege their computers were infected with FinSpy in September 2011 by agents acting on behalf of the Bahraini government, and that the operation, which they believe was authorized and directed from Manama, caused them psychological harm.

FinSpy is commercial spyware produced by the now-defunct Munich-based company FinFisher GmbH. Amnesty International has documented its use against journalists and activists in several countries.

What this means for practitioners

The judgment removes the state-immunity defence in this action and sends the dispute to a substantive trial in the High Court. Claimants and defendants in similar cross-border surveillance matters will need to assess how the "act in the UK" characterization shapes forum strategy and exposure. States facing claims in the English courts over remote intrusions directed at individuals present in the UK can no longer rely on immunity to dispose of such actions at the jurisdictional stage. Practitioners advising surveillance-technology vendors, state clients, and victim claimants alike should treat the ruling as settling the jurisdictional framework and focus on the evidentiary questions — attribution, authorization, and causation of harm — that a full trial will now examine.