Introduction

The case of Shehabi & Anor v Kingdom of Bahrain ([2024] EWCA Civ 1158) marks a significant development in the intersection of state immunity and cyber harassment. Brought before the England and Wales Court of Appeal (Civil Division) on October 4, 2024, this case addresses whether the Kingdom of Bahrain can claim immunity from civil proceedings in the United Kingdom after its agents allegedly installed malicious spyware on the computers of UK-based individuals, resulting in psychiatric injury.

The appellants, Dr. Saeed Shehabi and Mr. Moosa Mohammed, are Bahraini nationals residing in the UK, who allege that Bahraini state agents remotely infected their computers with the 'FinSpy' spyware. This intrusion, they argue, not only breached their privacy but also caused them significant psychological harm upon discovering the surveillance.

Central to the case are three pivotal issues:

• Whether a foreign state’s actions constitute an act within the United Kingdom under the State Immunity Act 1978.
• Whether immunity is forfeited only if all infringing acts occur within the UK.
• Whether psychiatric injury qualifies as 'personal injury' under the Act.

Summary of the Judgment

The presiding judge, Mr. Justice Menakel, ruled in favor of the claimants, holding that Bahrain could not invoke state immunity in this instance. The Court determined that the remote installation of spyware by Bahraini agents on computers physically located in the UK constitutes an act within the United Kingdom. Consequently, under section 5 of the State Immunity Act 1978, such acts causing personal injury render a foreign state liable to civil proceedings in the UK courts.

Furthermore, the Court recognized psychiatric injury as a form of 'personal injury' within the meaning of the Act. This interpretation aligns with contemporary English law, which increasingly acknowledges psychological harm as equivalent to physical injury in legal contexts.

Bahrain's appeal, challenging these findings on the grounds outlined, was subsequently dismissed, affirming the lower court's decision and reinforcing the applicability of the State Immunity Act in cases involving cyber intrusions and resultant personal harm.

Analysis

Precedents Cited

The judgment extensively referenced prior cases that have shaped the understanding of state immunity and the scope of personal injury. Notably:

• Al-Masarir v Kingdom of Saudi Arabia ([2022] EWHC 2199 (QB), [2023] QB 475): Addressed similar issues regarding state immunity and acts committed by foreign states within the UK.
• R v Governor of Brixton Prison, ex parte Levin ([1997] QB 65): Examined jurisdictional boundaries concerning acts performed remotely.
• Ashton Investments Ltd v OJSC Russian Aluminium (Rusal) ([2006] EWHC 2545 (Comm), [2007] 1 All ER (Comm) 857): Considered the location of damaging acts in relation to jurisdiction.
• Ogbonna: Pertinent in defining 'personal injury' to include psychiatric harm.

These cases collectively informed the Court's stance that the location of the harmful act—installing spyware remotely—does not negate its occurrence within the UK's jurisdiction when the effects manifest domestically.

Legal Reasoning

The Court's reasoning hinged on the interpretation of section 5 of the State Immunity Act 1978, which stipulates that a state is not immune from proceedings related to personal injury caused by acts within the UK. The key considerations included:

• Act within Jurisdiction: The remote installation of spyware by Bahraini agents on devices located in the UK was deemed an act within the UK, thereby engaging the jurisdiction of UK courts.
• Definition of Personal Injury: Psychiatric injury was upheld as a qualifying form of personal injury, expanding the scope of what constitutes actionable harm under the Act.
• Burden of Proof: The burden was on the claimants to demonstrate that the acts causing injury occurred within the UK's jurisdiction, which they satisfactorily discharged.
• Statutory Interpretation: The principle that statutes are "always speaking" was applied, allowing modern understandings of terms like 'personal injury' to be integrated into the interpretation of the 1978 Act.

The Court emphasized that distinguishing between the location of the perpetrator and the location of the act's effect is both practical and principled, ensuring that state immunity does not provide a shield for acts infringing on the UK’s territorial sovereignty.

Impact

This judgment sets a critical precedent for future cases involving cyber operations by foreign states. Its implications include:

• Enhanced Liability: Foreign states may find themselves more susceptible to civil claims in the UK for cyber intrusions impacting individuals within the country.
• Broadened Scope of Personal Injury: Recognition of psychiatric injury as personal injury under the State Immunity Act may influence similar interpretations in other legal contexts.
• Strengthened Territorial Sovereignty: Reinforces the UK's ability to adjudicate matters where foreign state actions impinge upon its territory, even through remote means.
• Legal Framework Adaptation: Encourages a reevaluation of existing state immunity provisions in light of evolving technological landscapes and methods of state-sponsored harassment.

Overall, the decision emphasizes that state immunity has limits, especially concerning actions that disrupt fundamental personal rights and territorial integrity, thereby aligning domestic law with contemporary challenges in digital security and privacy.

Complex Concepts Simplified

State Immunity

State immunity is a legal doctrine that prevents a sovereign state from being sued in the courts of another sovereign state without its consent. This principle is rooted in the notion of sovereign equality, ensuring that no state is superior to another in legal proceedings.

State Immunity Act 1978

The State Immunity Act 1978 codifies the rules governing when a foreign state can be subject to UK courts. Generally, it provides broad immunity to foreign states but carves out exceptions, such as cases involving personal injury or death caused by acts within the UK.

Personal Injury

Under the Act, 'personal injury' encompasses both physical and psychiatric harm. This broad interpretation means that mental health impacts resulting from violations like unauthorized surveillance can be actionable.

Cyber Harassment

Cyber harassment involves the use of digital means, such as spyware, to harass or surveil individuals. In this context, the installation of spyware constitutes a deliberate act that infringes upon personal privacy and can result in psychological harm.

Burden of Proof

In legal terms, the burden of proof refers to the obligation of a party to prove their assertion. In this case, the claimants needed to demonstrate that Bahraini agents acted within the UK’s jurisdiction to cause personal injury.

Conclusion

The judgment in Shehabi & Anor v Kingdom of Bahrain represents a pivotal affirmation of the State Immunity Act 1978's applicability in the digital age. By recognizing that remote cyber actions can constitute acts within the UK’s jurisdiction and acknowledging psychiatric injury as personal injury, the Court has broadened the scope of actionable violations against foreign states. This decision not only strengthens individuals' legal protections against state-sponsored cyber harassment but also underscores the necessity for states to respect international legal boundaries in their digital operations. As cyber threats evolve, this precedent ensures that state immunity does not become a loophole for egregious violations of personal rights within the UK's territorial waters.