Factual and Procedural Background
This case concerns state immunity. The Claimants sued the Defendant, the Kingdom of Bahrain, for damages for psychiatric injury allegedly caused by spyware infection on their laptops, which enabled surreptitious surveillance. The Defendant applied for an order declaring immunity under the State Immunity Act 1978 (SIA 1978), or alternatively to set aside prior orders permitting service out of jurisdiction, and to dismiss the claims for want of jurisdiction. The hearing focused solely on the state immunity issue.
The Claimants allege that the Defendant's agents remotely infected their UK-based laptops with spyware called FinSpy, causing harassment under the Protection from Harassment Act 1997 and resulting psychiatric injury. The Defendant denies hacking and disputes attribution.
The Claimants rely on expert evidence from a research fellow specializing in spyware used by governments, who analyzed data including hacked internal documents of the spyware producer, linking the Defendant to the infection of the Claimants' devices. The Claimants are UK residents and activists opposing the Defendant's regime.
The Defendant's former solicitor stated that the jurisdiction application does not address the merits of the claims but reserves rights to raise other defenses if jurisdiction is established.
Legal Issues Presented
- Whether the Defendant is immune from the jurisdiction of the UK courts under s 1(1) of the State Immunity Act 1978 in respect of the Claimants' claims.
- Whether the exception to immunity in s 5 of the SIA 1978 (relating to death or personal injury caused by an act or omission in the UK) applies to the Claimants' claims.
- Whether infection of a UK-located computer with spyware from abroad constitutes an act "in the United Kingdom" under s 5.
- Whether the Claimants have discharged the burden of proving on a balance of probabilities that their computers were infected by the Defendant's agents.
- Whether psychiatric injury qualifies as "personal injury" for the purposes of s 5 of the SIA 1978.
- Whether the Claimants have demonstrated on the balance of probabilities that they suffered psychiatric injury caused by the spyware infection.
- Whether the Defendant's construction of s 5 complies with international law and the European Convention on Human Rights, particularly Article 6 (right of access to court).
Arguments of the Parties
Defendant's Arguments
- The claims do not relate to an act "in the United Kingdom" as required by s 5(a) of the SIA 1978 because the acts were committed remotely from abroad.
- The alleged psychiatric injuries do not constitute "personal injury" under s 5(a) of the SIA 1978, which should be limited to physical injury.
- The Claimants have not proven on the balance of probabilities that their computers were infected by the Defendant or its agents.
- Reliance on international instruments (Basle Convention, UN Convention) and US case law supports a requirement that the entire tort or the tortious act must occur within the forum state for immunity to be disapplied.
- Article 6 ECHR considerations do not require a different interpretation of s 5.
Claimants' Arguments
- s 5 of the SIA 1978 does not require the presence of the Defendant or all acts to have occurred in the UK; a single act or omission in the UK that causally contributes more than minimally suffices.
- Infecting a UK-based computer remotely from abroad constitutes an act "in the United Kingdom" because the essence of the act occurs where the computer is located and manipulated.
- Psychiatric injury is included within the meaning of "personal injury" under s 5, supported by domestic case law.
- The expert psychiatric evidence establishes that the Claimants suffered recognized psychiatric injuries as a result of the infection and surveillance.
- The absence of a presence requirement in s 5 is deliberate, distinguishing it from international treaties cited by the Defendant.
- To accept the Defendant's construction would lead to absurd and unjust results, denying remedy for serious torts committed against persons within the UK.
Table of Precedents Cited
| Precedent |
Rule or Principle Cited For |
Application by the Court |
| Jones v Ministry of the Interior of the Kingdom of Saudi Arabia [2007] 1 AC 270 |
Confirms that State immunity applies unless an exception in SIA 1978 applies. |
Used to affirm that jurisdiction depends on exceptions to immunity under the Act. |
| Benkharbouche v Embassy of the Republic of Sudan [2019] AC 777 |
Confirms SIA 1978 as a complete code on state immunity. |
Supported the proposition that if no exception applies, immunity is absolute. |
| JH Rayner (Mincing Lane) Ltd v Department of Trade and Industry [1989] Ch 72 |
Burden of proof on claimant to show exception to immunity on balance of probabilities. |
Applied to require Claimants to prove exception applies preliminarily. |
| London Steam Ship Owners' Mutual Insurance Assoc Ltd v Kingdom of Spain [2020] 1 WLR 4943 |
Applied standard of proof for state immunity exceptions. |
Confirmed application of balance of probabilities test. |
| Al-Adsani v Government of Kuwait (No 2) (1996) 107 ILR 536 |
Discusses scope of state immunity and exceptions under SIA 1978. |
Used to compare interpretations of s 5 and international conventions. |
| Al-Masarir v Kingdom of Saudi Arabia [2022] EWHC 2199 (QB) |
Similar issues on state immunity and spyware attacks. |
Judgment considered together, supporting interpretation of s 5. |
| Heiser and others v Islamic Republic of Iran [2019] EWHC 2074 (QB) |
Interpretation of "act in the UK" and presence requirement in s 5. |
Distinguished and limited in application; not determinative here. |
| Ashton Investments Ltd v OJSC Russian Aluminium (RUSAL) [2007] 1 All ER (Comm) 857 |
Test for tort committed within jurisdiction for service out of jurisdiction. |
Supported the view that hacking of devices in jurisdiction from abroad is an act in the jurisdiction. |
| Vidal-Hall v Google Inc [2014] 1 WLR 4155 |
Privacy torts involving data collection from users in jurisdiction. |
Analogous support for acts done in jurisdiction via remote activity. |
| Lloyd v Google LLC [2019] 1 WLR 1265 |
Similar to Vidal-Hall on data protection and jurisdiction. |
Reinforced principle of acts in jurisdiction via remote data collection. |
| R v Governor of Brixton Prison ex parte Levin [1997] QB 65 |
Remote manipulation of computer in one jurisdiction from another. |
Held act occurs where computer is located, supporting Claimants’ position. |
| Military Affairs Office of the Embassy of Kuwait v Caramba-Coker [2003] UKEAT 1054_02_1004 |
Psychiatric injury constitutes personal injury under s 5. |
Supported Claimants’ argument on psychiatric injury. |
| Federal Republic of Nigeria v Ogbonna [2012] 1 WLR 139 |
Confirmed psychiatric injury falls within personal injury for s 5. |
Affirmed domestic law interpretation supporting Claimants. |
| Schreiber v Canada (Attorney General) [2002] 3 SCR 269 |
Canadian interpretation limiting personal injury to physical injury. |
Considered but distinguished as not persuasive for English law. |
| Argentine Republic v Amerada Hess (1989) 488 US 428 |
US FSIA entire tort rule requiring entire tort to occur in US. |
Considered but found inapplicable to SIA 1978 interpretation. |
| Kidane v Ethiopia (2017) 851 F 3d 7 |
US FSIA case denying jurisdiction for torts partially occurring abroad. |
Considered but rejected as persuasive authority for this case. |
| Ben-Rafael v Islamic Republic of Iran [2015] EWHC 3203 (QB) |
Composite acts partially in jurisdiction may satisfy s 5. |
Supported Claimants’ interpretation of s 5. |
| Bourhill v Young [1943] AC 92 |
Recognition of psychiatric injury as personal injury. |
Supported inclusion of psychiatric injury in personal injury. |
| R v Chan-Fook (1994) 99 Cr App R 147 |
Psychiatric injury can constitute bodily harm where clinically recognized. |
Reinforced psychiatric injury as personal injury. |
| Page v Smith [1996] AC 155 |
Physical and psychiatric injuries treated equivalently for tort claims. |
Supported broad meaning of personal injury. |
| R v Ireland [1998] AC 147 |
Psychiatric injury included within "bodily harm" for criminal offences. |
Supported recognition of psychiatric injury in law. |
| Corinna Zu Sayn-Wittgenstein-Sayn v His Majesty Juan Carlos Alfonso Victor María de Borbón y Borbón [2022] EWCA Civ 1595 |
Clarified that claims for harassment without recognized psychiatric injury do not qualify as personal injury under s 5. |
Differentiated claims for distress from claims for personal injury. |
| La Générale des Carrières et des Mines v FG Hemisphere Associates LLC [2012] UKPC 27 |
SIA 1978 gives broad effect to Basle Convention but does not replicate it precisely. |
Supported interpretation that presence requirement is not in s 5. |
Court's Reasoning and Analysis
The court examined the interpretation of s 5 of the State Immunity Act 1978, focusing on whether the Defendant’s acts were “in the United Kingdom” and whether psychiatric injury is “personal injury” within the meaning of that section. The court rejected the Defendant’s submission that the presence of the state actor in the UK is required or that all causative acts must occur within the UK. Instead, it held that a single relevant act or omission in the UK causative of the injury on more than a minimal basis suffices.
The court distinguished s 5 from international treaties (Basle Convention and UN Convention), noting that Parliament deliberately omitted a presence requirement, thus s 5 must be interpreted on its own terms. It acknowledged the persuasive but non-binding nature of foreign (especially US) jurisprudence under the Foreign Sovereign Immunities Act, which requires the entire tort to occur within the forum state. The court found that this approach is inapplicable due to different statutory language and legislative history.
Regarding remote hacking, the court held that infecting a computer physically located in the UK via spyware implanted from abroad constitutes an act in the UK. This was supported by domestic case law on jurisdictional gateways and analogous cases involving remote control of computers.
The court accepted the Claimants had discharged the burden of proof on the balance of probabilities that their computers were infected by spyware operated by the Defendant’s agents, based on detailed expert forensic evidence and the hacked internal documents of the spyware producer.
On the meaning of personal injury, the court found that domestic law consistently includes psychiatric injury within “personal injury” for s 5 purposes. It relied on Employment Appeal Tribunal decisions and high authority in criminal and civil law confirming that recognized psychiatric illness qualifies as personal injury. The court rejected the Defendant’s reliance on Canadian and international materials that sought to limit personal injury to physical injury, finding them unpersuasive and inconsistent with settled English law.
The Claimants’ expert psychiatric evidence was accepted as sufficient to establish recognized psychiatric injury caused by the spyware infection and surveillance.
The court did not need to address the Claimants’ alternative argument based on Article 6 of the European Convention on Human Rights, as it found in their favor on the primary issues.
Holding and Implications
The court DISMISSED the Defendant's application for state immunity and for dismissal of the claims for want of jurisdiction.
This means that the court has jurisdiction to hear the Claimants' claims under the exception in s 5 of the State Immunity Act 1978. The decision confirms that remote spyware infection of computers located in the UK amounts to an act "in the United Kingdom" and that psychiatric injury is encompassed within "personal injury" for the purposes of the Act.
No new precedent beyond the specific statutory interpretation and application to the facts of this case was established, but the judgment reinforces the principle that state immunity exceptions under the SIA 1978 must be construed in accordance with domestic statutory language and settled domestic law on personal injury, rather than by importing requirements from international treaties or foreign statutes.