THE RATIO — one judgment, decoded twice: once for anyone, once for the profession.

In 30 Seconds

Two Bahraini activists living in the UK had spyware planted on their computers, allegedly by agents of Bahrain’s government, capable of switching on their webcams and microphones without their knowledge. Bahrain argued it couldn’t be sued in a UK court at all — foreign states are normally immune from being dragged before British judges. The Supreme Court disagreed, 3-2. Reaching into a computer sitting in Britain, it held, is “an act” in Britain — even if the person doing the reaching never left Bahrain. Old rule, new technology, and a majority willing to say the geography of a keyboard doesn’t matter anymore.

What Actually Happened

(Worth flagging up front: none of this has been proven. The case reached the Supreme Court purely on whether it can be heard at all — the facts below are “assumed” for that purpose, not yet tested at trial.)

Dr Saeed Shehabi has lived in the UK since 1973 and is a well-known pro-democracy journalist and voice of the Bahraini opposition. Mr Moosa Mohammed, a photographer and human rights activist, has lived in the UK since 2006; he was granted refugee status in 2007, and Bahrain revoked his citizenship in 2012.

From around September 2011, the two allege, people acting for the Bahraini government infected their computers with spyware called FinSpy — software that, once installed, could silently copy files, intercept messages and calls, and switch on a device’s own camera and microphone to watch and listen to the person using it, undetected.

Both men found out in August 2014, after WikiLeaks and a Bahrain-focused research group called Bahrain Watch published material exposing the spyware operation. Learning they’d likely been watched for years took a measurable toll: Dr Shehabi was later diagnosed with adjustment disorder, a recognised psychiatric condition, and Mr Mohammed’s own pre-existing adjustment disorder significantly worsened. They sued Bahrain for harassment under the Protection from Harassment Act 1997.

Ordinarily, you cannot sue a foreign government in a British court. This is “state immunity” — a rule, set out in the State Immunity Act 1978, that keeps British judges from sitting in judgment over another state’s conduct, partly out of practical courtesy: if UK courts started putting foreign governments on trial, the UK’s own government could expect the same treatment abroad.

But the immunity isn’t absolute. Section 5 of the Act removes it where a state’s “act or omission” causes personal injury or property damage in the United Kingdom — the so-called territorial tort exception. If a foreign government’s people cause harm while physically doing something on British soil, they don’t get to hide behind their government’s immunity.

Here’s the wrinkle Bahrain leaned on: nobody suggests its agents ever set foot in Britain. The spyware, on the assumed facts, ran from a command server inside Bahrain. So did the “act” happen in Bahrain, where fingers were on a keyboard — or in Britain, where a stranger’s laptop camera quietly blinked on?

What the Court Decided

By a 3-2 majority — Lord Lloyd-Jones, Lord Hamblen and Lady Simler, with Lord Leggatt and Lord Burrows dissenting — the Supreme Court dismissed Bahrain’s appeal, agreeing with both courts below. Section 5, the majority held, doesn’t require the person responsible to be physically present in the UK when the harm occurs. An “act” can be carried out through a device or by remote means; if an agent presses a key in Bahrain and a laptop camera lights up in Britain, the act happens where the intrusion lands.

That’s a notably wider rule than the international treaty the 1978 Act partly implements. Article 11 of the European Convention on State Immunity does explicitly require the “author” of the harm to be present in the UK — and it’s common ground Bahrain’s agents weren’t. The majority’s answer: Parliament knew how to write a presence requirement and chose not to. The gap between the Act and the treaty is deliberate, not an oversight.

The Landmark Line

Boiled down, the core holding is this: an act under section 5 includes conduct carried out by mechanical, electrical, or other automated or remote means, so a person doesn’t need to be standing in the room — or even in the country — for their conduct to count as happening there.

The Court tested this against real-world examples. Everyone agrees that if a foreign state’s agents poison someone on British soil in person — as Russian agents did to Alexander Litvinenko in London in 2006 — that’s exactly the kind of act immunity doesn’t protect. But, the majority reasoned, the harm to Britain is identical if the same killing were instead carried out by a bomb-laden drone flown in and detonated by remote control from abroad — or, closer to this case, if a hospital’s computer systems in Britain were hacked and disabled by operators sitting in another country, endangering patients who never chose to be part of any dispute between states. The Court of Appeal below had called this act/effect distinction “artificial and unprincipled,” and the Supreme Court’s majority agreed: a state shouldn’t escape liability for reaching into Britain just because it used a keyboard instead of a passport.

Why It Matters

If you’re not a lawyer: Britain is home to a large number of journalists, dissidents and human rights defenders who have fled the governments they criticise. This ruling means that if one of those governments keeps spying on someone electronically after they’ve settled in the UK, it can no longer dodge a courtroom purely by pointing out that its hackers stayed home — it will have to answer the claim on the facts. More broadly, this is the law catching up to a world where serious harm doesn’t require anyone to cross a border to cause it.

If you bill by the hour: This is now the leading authority on the territorial tort exception in section 5 SIA 1978 for remote and automated conduct, and it sits in real tension with El-Khouri v Government of the USA [2025] UKSC 3 — a recent extradition case where this same Court said “conduct” normally means what a person does at a location, not effects felt elsewhere. The majority distinguished El-Khouri narrowly, on the different (and binary) wording of section 137 of the Extradition Act 2003; Lord Leggatt’s dissent leaned on it heavily, so expect the act/effects question to keep resurfacing outside state immunity too, in criminal jurisdiction and cross-border tort claims involving remote or automated conduct. The Court also expressly declined to rule on whether denying immunity here was independently required by Article 6 ECHR, since it didn’t need to — that argument remains untested. And with two separately-reasoned dissents running past a hundred paragraphs between them, this reads less like a tidy final word than a 3-2 line drawn in genuinely contested territory; further litigation testing the outer edges (how remote is too remote, what about a human intermediary abroad rather than pure automation) seems likely.

The Dissent, Briefly

Lord Leggatt would have allowed Bahrain’s appeal. In his view, an act happens where the actor’s body is, not where its effects land: typing a command in Bahrain is an act in Bahrain, whatever it triggers thousands of miles away. Blurring that line, he warned, produces unpredictable results — and, more importantly, risks putting the UK in breach of both the international treaty and customary international law, neither of which, on his reading, recognises a territorial tort exception this wide for a state’s official conduct.

Lord Burrows, writing separately, gave ten independent reasons for reading section 5 consistently with the treaty it was meant to implement, and explained separately why he didn’t think the UK was free to depart from the treaty’s presence requirement in the way the majority found it had.

Quick Reference

  • Citation: [2026] UKSC 25, on appeal from [2024] EWCA Civ 1158
  • Bench: Lord Lloyd-Jones, Lord Hamblen, Lady Simler (majority); Lord Leggatt, Lord Burrows (dissenting)
  • Heard: 26–27 November 2025 · Decided: 27 July 2026
  • Counsel: Tom Hickman KC, Robert Volterra, Stephen Donnelly instructed by Volterra Fietta (for Bahrain); Timothy Otty KC, Ben Silverstone, Philippa Webb instructed by Leigh Day (for the respondents)
  • Key paragraphs: [45]–[55] (the interpretive question) · [60]–[75] (comparison with the ECSI treaty; the “deliberate departure”) · [131]–[147] (meaning of “act”; the hypotheticals; applying it to this case) · [154]–[323] (Lord Leggatt, dissenting) · [325]–[358] (Lord Burrows, dissenting)