Remote Cyber Intrusions into UK Computers Can Constitute “Acts in the United Kingdom” under Section 5 of the State Immunity Act 1978

1. Introduction

In The Kingdom of Bahrain v Shehabi and another [2026] UKSC 25, the United Kingdom Supreme Court considered the scope of the tort exception to state immunity in section 5 of the State Immunity Act 1978 (“SIA”).

The respondents, both Bahrain-linked pro-democracy and human rights activists living in the United Kingdom, alleged that agents of the appellant state remotely infected their UK-based computers with spyware. The alleged spyware enabled covert access to data, interception of communications, and surveillance through microphones and cameras. The respondents claimed that, after discovering the surveillance, they suffered psychiatric injury.

The central question was whether proceedings for personal injury were barred by state immunity, or whether the claim fell within section 5 of the SIA, which removes immunity for death, personal injury, or tangible property damage “caused by an act or omission in the United Kingdom”.

2. Summary of the Judgment

By a 3–2 majority, the Supreme Court dismissed the appeal. Lord Lloyd-Jones, Lord Hamblen and Lady Simler held that:

  • section 5 does not require the “responsible”, “initiating” or “precipitating” act to occur in the UK;
  • section 5 does not require every causative act to occur in the UK;
  • section 5 does not require the foreign state’s agent to be physically present in the UK;
  • remote manipulation of a computer located in the UK may itself be an “act … in the United Kingdom”; and
  • on the assumed facts, the alleged hacking, installation, operation, exfiltration and surveillance through UK-based devices constituted legally causative acts in the UK.

Lord Leggatt and Lord Burrows dissented. They would have interpreted section 5 consistently with article 11 of the European Convention on State Immunity, requiring the author of the act to be present in the forum state.

3. The New Legal Principle

The decision establishes that, for section 5 of the SIA, an “act … in the United Kingdom” is not confined to the physical conduct of a human agent present in the UK. A foreign state may lose immunity where its agents, acting remotely from abroad, cause legally relevant cyber operations to occur on computers located in the UK and those acts cause personal injury or qualifying property damage.

4. Precedents Cited and Their Role

4.1 Statutory interpretation authorities

The majority applied the orthodox approach to statutory interpretation from R (Quintavalle) v Secretary of State for Health [2003] UKHL 13; [2003] 2 AC 687 and R (O) v Secretary of State for the Home Department [2022] UKSC 3; [2023] AC 255: the court must identify Parliament’s purpose through the statutory language, read in context.

The court also referred to R (PACCAR Inc) v Competition Appeal Tribunal [2023] UKSC 28; [2023] 1 WLR 2594 and R v Secretary of State for the Environment, Transport and the Regions, Ex p Spath Holme Ltd [2001] 2 AC 349 to emphasise that citizens should be able to rely on statutory wording. The majority held that section 5’s language was clear: it requires a causative act in the UK, not physical presence of the actor.

4.2 State immunity framework

Argentum Exploration Ltd v The Silver and all Persons Claiming to be Interested in, and/or Have Rights in Respect of, the Silver [2024] UKSC 16; [2025] AC 555 was cited for the history and purpose of the SIA: to create a detailed statutory regime reflecting restrictive state immunity.

General Dynamics United Kingdom Ltd v State of Libya [2021] UKSC 22; [2022] AC 318 was important for the principle that the SIA must be understood against two international law values: sovereign equality of states and the territorial sovereignty of the forum state.

Benkharbouche v Embassy of the Republic of Sudan [2017] UKSC 62; [2019] AC 777 was relied on for the idea that the grant of immunity and the statutory exceptions must be read as an “organic whole”. The majority used this to reject an overly narrow reading of section 5.

4.3 International law and the territorial tort exception

The Supreme Court considered Jurisdictional Immunities of the State (Germany v Italy) [2012] ICJ Rep 99. The International Court of Justice confirmed the fundamental nature of state immunity but left unresolved whether customary international law recognises a general territorial tort exception for sovereign acts, except in the specific context of armed conflict.

The majority drew from that case the need to balance state immunity with territorial sovereignty. Where a foreign state causes operations to occur within the UK, the UK’s territorial sovereignty is engaged.

4.4 Earlier section 5 and hacking-related cases

Al-Masarir v Kingdom of Saudi Arabia [2022] EWHC 2199 (QB); [2023] QB 475 was a key domestic authority. It had held that section 5 does not require all causative acts to occur in the UK and that a substantial causative act in the UK is sufficient. The Supreme Court broadly endorsed that approach, though it avoided adding an extra “more than de minimis” gloss.

Ashton Investments Ltd v OJSC Russian Aluminium (RUSAL) [2007] 1 All ER (Comm) was used by analogy. In that case, hacking a London server from abroad was treated as involving substantial acts in London. The Supreme Court found the analogy persuasive: remote access to a UK computer may be an act in the UK.

R v Governor of Brixton Prison, Ex p Levin [1997] QB 65 also supported the majority’s approach. The Divisional Court had treated remote interference with a US computer from abroad as conduct effectively occurring where the computer was operated upon.

By contrast, El-Khouri v Government of the United States of America [2025] UKSC 3; [2025] AC 845 and R v Governor of Pentonville Prison, Ex p Osman [1990] 1 WLR 277 were not treated as determinative. The majority distinguished them as extradition cases involving different statutory language and context.

4.5 Comparative case law

The appellant relied on US authorities such as Kidane v Federal Democratic Republic of Ethiopia (2017) 851 F 3d 7 and Democratic National Committee v Russian Federation (2019) 392 F Supp 3d 410, where US courts applied the “entire tort” doctrine and rejected claims based on remote cyber activity. The Supreme Court held that these cases were not persuasive for UK law because the US statute uses different wording and has a distinct legislative history.

Kazemi Estate v Islamic Republic of Iran 2014 SCC 62, [2014] 3 SCR 176 and Schreiber v Federal Republic of Germany and the Attorney General of Canada 2002 SCC 62 were considered in relation to Canadian state immunity law. The Supreme Court held that the Canadian statutory language was materially different from section 5 of the SIA.

4.6 Foreign act of state doctrine

The court also addressed, though did not ultimately rely on, foreign act of state principles. It referred to Belhaj v Straw [2017] UKSC 3; [2017] AC 964, Maduro Board of the Central Bank of Venezuela v Guaidó Board of the Central Bank of Venezuela [2021] UKSC 57; [2023] AC 156, and Buttes Gas and Oil Co v Hammer (No 3) [1982] AC 888.

The majority concluded that the proceedings would not require the English court to adjudicate on the validity of sovereign acts within Bahrain’s own territory. The alleged wrongdoing was the interference with computers and persons in the UK.

5. Legal Reasoning

5.1 Natural meaning of section 5

The majority focused on the words “caused by an act or omission in the United Kingdom”. It held that the phrase requires:

  • a legally causative act or omission;
  • that act or omission to occur in the UK; and
  • the proceedings to concern death, personal injury, or tangible property damage.

It does not require the actor to be physically present. Nor does it require the UK act to be the first, last, dominant, or exclusive cause.

5.2 Remote cyber acts and territorial sovereignty

The court rejected a rigid distinction between an act abroad and its “effects” in the UK. Where spyware is installed, executed and operated on a UK computer, the foreign state is not merely producing distant consequences; it is causing processes and interferences to occur within UK territory.

The majority considered it artificial to treat the foreign operator’s keystrokes abroad as the only acts, while treating the installation, running, access and surveillance on UK devices as mere effects.

5.3 Relationship with the European Convention on State Immunity

Article 11 of the European Convention on State Immunity contains an express presence requirement: the author of the injury or damage must be present in the forum state. Section 5 of the SIA does not.

The majority held that this omission was deliberate. The SIA broadly reflected the Convention but did not copy it precisely. Article 24 of the Convention permitted contracting states to maintain and develop broader domestic immunity regimes, subject to customary international law limits.

Therefore, the court refused to read a presence requirement into section 5.

5.4 Customary international law

The majority did not finally decide whether customary international law now recognises a general territorial tort exception for sovereign acts. It held that there was at least a sufficient basis for Parliament to enact section 5 in the form it did.

It also observed that the presence requirement in international instruments may be more about jurisdictional restraint than the inherent nature of state immunity.

5.5 Application to the pleaded facts

The pleaded acts included transmitting executable files, installing spyware, running spyware, accessing memory, storing information, using network interfaces, exfiltrating data, activating microphones and cameras, and recording keystrokes. These operations occurred on computers located in England.

On the assumed facts, those acts formed a course of surveillance in the UK and were legally causative of the respondents’ alleged psychiatric injury. The section 5 exception therefore applied.

6. The Dissents

Lord Leggatt and Lord Burrows would have allowed the appeal. Their central view was that an act occurs where the actor is located, not where its consequences are felt.

They considered section 5 capable of being read consistently with article 11 of the European Convention on State Immunity, thereby requiring the author of the injury to be present in the UK. They warned that the majority’s approach risks putting the UK in breach of international law by creating a transboundary tort exception for sovereign acts.

The dissenting judgments placed greater weight on:

  • the presumption that legislation should be interpreted consistently with treaty obligations;
  • the historical purpose of the SIA as implementing the European Convention on State Immunity;
  • the need for certainty in locating acts; and
  • the absence of clear state practice recognising a no-presence cyber tort exception to state immunity.

7. Impact of the Judgment

7.1 Cyber operations and state immunity

This is a major ruling for cyber-surveillance litigation. Foreign states cannot automatically claim immunity merely because the human operator acted from abroad. If the relevant cyber operations occur on UK-based devices and cause qualifying injury or damage, section 5 may apply.

7.2 Modernisation of territoriality

The judgment adapts territorial concepts to modern technology. It recognises that a state can interfere with UK territorial sovereignty through remote digital means, just as it could through agents physically present in the UK.

7.3 Limits remain

The ruling does not abolish state immunity in cyber cases. Claimants must still show:

  • a qualifying injury or tangible property damage;
  • a legally causative act or omission in the UK;
  • attribution to the foreign state; and
  • a viable underlying cause of action.

Pure economic loss, data loss alone, or non-personal injury claims may fall outside section 5.

7.4 Future disputes

Future cases may test how far the principle extends: for example, attacks on servers, critical infrastructure, medical systems, or devices temporarily located in the UK. Courts will need to distinguish legally causative UK acts from remote, incidental, or non-operative technological effects.

8. Complex Concepts Simplified

  • State immunity: the rule that one state is generally not subject to another state’s courts.
  • Restrictive immunity: the modern doctrine that immunity generally applies to sovereign acts, but not necessarily to commercial or private-law acts.
  • Acta jure imperii: sovereign or governmental acts.
  • Acta jure gestionis: commercial or private-law acts.
  • Territorial tort exception: an exception allowing claims against a foreign state where injury or damage is caused by acts sufficiently connected to the forum territory.
  • Causation: the legal requirement that the act relied on must be a legally effective cause of the injury, not merely trivial or remote.
  • Consistent interpretation: the principle that courts try to interpret statutes consistently with international obligations where the wording permits.
  • Foreign act of state: a separate doctrine under which courts may avoid ruling on certain sovereign acts of foreign states within their own territory.

9. Conclusion

The Kingdom of Bahrain v Shehabi and another [2026] UKSC 25 is a landmark decision on state immunity and cyber activity. The Supreme Court held that remote hacking of computers located in the UK can amount to an “act … in the United Kingdom” for section 5 of the SIA.

The judgment is significant because it prevents foreign states from relying on physical distance alone to preserve immunity where alleged cyber operations occur within UK territory and cause personal injury. It aligns the territorial tort exception with the realities of modern digital interference, while leaving important questions for future cases about causation, attribution, and the limits of cyber-based territorial acts.