Factual and Procedural Background
The appeal concerns whether a foreign state whose agents, located abroad, remotely install spyware on computers of individuals in the United Kingdom, causing psychiatric injury upon discovery, is entitled to immunity from civil proceedings. This depends on whether such proceedings are "in respect of personal injury caused by an act or omission in the United Kingdom" under section 5 of the State Immunity Act 1978. The original judge decided in favor of the claimants, prominent pro-democracy activists residing in the UK, who allege that the defendant state infected their computers with spyware from abroad, causing harassment and psychiatric injury. The defendant state appeals this decision.
The claimants allege that spyware known as "FinSpy" was installed on their UK-based devices remotely by agents of the defendant state, allowing covert surveillance and data extraction. The defendant denies these allegations, but the judge found the claimants had discharged their burden of proof on the balance of probabilities regarding infection. The claimants frame their case under the tort of harassment.
The appeal also references a materially similar earlier case decided by the same judge, involving a different foreign state, where overlapping but distinct arguments were made.
Legal Issues Presented
- Whether there is an act by the foreign state in the United Kingdom when spyware is installed remotely from abroad.
- Whether immunity is lost only if all acts by agents of the foreign state take place in the United Kingdom.
- Whether psychiatric injury constitutes "personal injury" within the meaning of section 5 of the State Immunity Act 1978.
Arguments of the Parties
Appellant's Arguments
- The act of infecting the claimants' computers took place abroad, where the agents instigated the hacking, not in the United Kingdom.
- The judge conflated the act and its effects by treating remote manipulation as an act within the UK.
- Reliance on the European Court of Human Rights decision in Wieder v United Kingdom to argue that surveillance acts occur where communications are intercepted, not where the device is located.
- The Computer Misuse Act 1990 supports the position that unauthorized access by a foreign actor occurs abroad, with jurisdiction only if significant links to the UK exist.
- Submission that all acts causing personal injury must occur wholly in the UK for immunity to be lost, based on Article 11 of the European Convention on State Immunity (ECSI), international comity, the act of state doctrine, the UN Convention on Jurisdictional Immunities, and US case law regarding the Foreign Sovereign Immunities Act 1976.
- Psychiatric injury claims must be linked to physical injury to constitute "personal injury" under section 5; standalone psychiatric injury is excluded.
- Reliance on Notes on Clauses from the Bill's passage and Canadian case law to support a narrower interpretation of "personal injury".
Respondents' Arguments
- Remote manipulation of a computer located in the UK is an act within the UK; the foreign state commits acts both abroad and in the UK.
- No requirement in section 5 that the actor be physically present in the UK.
- Interpretation supported by statutory language, international law principles, and case law on jurisdiction and extradition.
- Psychiatric injury, including standalone recognized psychiatric injuries, constitutes "personal injury" under section 5.
- The "always speaking" principle of statutory interpretation applies, allowing modern understanding of "personal injury" to include psychiatric injury.
- Notes on Clauses are not admissible aids to statutory interpretation.
- Claims of harassment causing distress do not automatically amount to personal injury absent recognized psychiatric injury.
Table of Precedents Cited
| Precedent |
Rule or Principle Cited For |
Application by the Court |
| JH Rayner (Mincing Lane) Ltd v Department of Trade and Industry [1989] Ch 72 |
Burden of proof on claimants to establish exception to state immunity on balance of probabilities. |
Cited to affirm claimants' burden to prove act or omission in the UK attributable to the state. |
| Hayden v Dickenson [2020] EWHC 3291 (QB) |
Ingredients and principles of the tort of harassment under Protection from Harassment Act 1997. |
Used to frame the claimants' harassment claim and assess its legal viability. |
| R v Governor of Brixton Prison, ex parte Levin [1997] QB 65 |
Location of act for jurisdictional purposes; remote manipulation of computer is act where computer is located. |
Supported conclusion that hacking a UK computer from abroad is an act in the UK. |
| Ashton Investments Ltd v OJSC Russian Aluminium (Rusal) [2006] EWHC 2545 (Comm) |
Acts causing damage can be considered to occur where damage is sustained, not only where act originates. |
Reinforced that hacking directed at UK servers occurs in the UK. |
| Al-Masarir v Kingdom of Saudi Arabia [2022] EWHC 2199 (QB), [2023] QB 475 |
Rejected argument that section 5 applies only to private law acts, not sovereign acts; supports interpretation of section 5 exceptions. |
Followed as precedent on interpretation of section 5 and state immunity exceptions. |
| Al-Adsani v Government of Kuwait (1996) ILR 536 |
Section 5 of the State Immunity Act 1978 is "as plain as plain can be"; immunity exceptions are comprehensive and not subject to overriding considerations. |
Supported the clear and unambiguous interpretation of section 5. |
| Jones v Ministry of the Interior of the Kingdom of Saudi Arabia [2006] UKHL 26, [2007] 1 AC 270 |
Confirmed comprehensive and clear nature of State Immunity Act 1978; immunity applies unless exception clearly established. |
Reinforced approach to statutory interpretation and immunity exceptions. |
| Benkarbouche v Embassy of the Republic of Sudan [2017] UKSC 62, [2019] AC 777 |
Interpretation of immunity exceptions should not be restrictive; exceptions amount to qualification of immunity principle. |
Supported broad reading of exceptions to immunity in section 5. |
| General Dynamics United Kingdom Ltd v State of Libya [2021] UKSC 22, [2022] AC 318 |
Context of international law principles underlying state immunity; importance of sovereign equality and territorial sovereignty. |
Provided international law context for interpreting section 5. |
| Wieder v United Kingdom (2024) 78 EHRR 8 |
Territorial scope of state jurisdiction includes interception of communications passing through the state; supports territorial interference concept. |
Considered but found supportive of the claimants' position that acts occur where interference happens. |
| Pepper v Hart [1993] AC 593 |
Admissibility of parliamentary statements as aids to statutory interpretation. |
Confirmed parliamentary statements relied on were inadmissible in this case. |
| R (O) v Secretary of State for the Home Department [2022] UKSC 3, [2023] AC 255 |
Authoritative explanation of statutory interpretation principles. |
Guided interpretation of section 5 as clear and plain language to be understood in context. |
| News Corp UK & Ireland Ltd v Revenue & Customs Commissioners [2023] UK 7, [2024] AC 89 |
Statutes are "always speaking" and should be interpreted in light of modern developments. |
Applied to interpret "personal injury" to include psychiatric injury. |
| Zu Sayn-Wittgenstein-Sayn v His Majesty Juan Carlos de Borbón y Borbón [2022] EWCA Civ 1595, [2023] 1 WLR 1162 |
Confirmed psychiatric injury constitutes personal injury within section 5; distinguished claims for distress alone. |
Supported inclusion of recognized psychiatric injury within "personal injury". |
| Schreiber v Federal Republic of Germany [2002] 3 RCS 269 (Canada) |
Canadian interpretation of "personal injury" limited to injury linked to physical harm. |
Considered but distinguished as domestic Canadian law, not international law. |
| Kazemi v Iranian Republic of Iran [2014] 3 SCR 176 (Canada) |
Confirmed Schreiber; psychological distress must be linked to physical injury for personal injury exception. |
Considered but not determinative for UK law. |
| R v Ireland [1997] UKHL 34, [1998] AC 147 |
Recognition that "personal injury" includes standalone psychiatric injury under English law. |
Supported modern interpretation of "personal injury". |
| Military Affairs Office of the Embassy of the State of Kuwait v Caramba-Coker [2003] UKEAT/1054/02 |
Psychiatric injury constitutes personal injury under section 5. |
Relied on to support claimants' case on psychiatric injury. |
| Federal Republic of Nigeria v Ogbonna [2011] UKEAT/585/10, [2012] 1 WLR 139 |
Confirmed psychiatric injury is personal injury within section 5. |
Relied on by the judge and affirmed in appeal court. |
Court's Reasoning and Analysis
The court considered the statutory language of section 5 of the State Immunity Act 1978 and concluded that the remote installation of spyware on computers located in the United Kingdom constitutes an act within the United Kingdom. The court rejected the appellant’s argument that the act occurs only where the foreign agents are located, finding it artificial to separate the act from its effects when the territorial sovereignty of the United Kingdom is interfered with.
The court relied on analogous cases in extradition and jurisdiction to support this interpretation, emphasizing that the essence of the act occurs where the target device is located. It found that the statutory language is clear and unambiguous that immunity is lost if an act or omission causing personal injury occurs in the UK, even if other causative acts occur abroad. The court rejected the argument that all acts must occur in the UK for immunity to be lost, interpreting the indefinite article "an act or omission" as allowing for some acts abroad.
Regarding whether psychiatric injury is "personal injury" under section 5, the court applied the "always speaking" principle of statutory interpretation, recognizing that statutes are to be interpreted in light of modern scientific and legal understanding. It held that recognized psychiatric injury does constitute personal injury, relying on domestic case law and rejecting the narrower Canadian interpretation as based on domestic bilingual statutory interpretation principles rather than international law.
The court found no compelling international law authority to exclude psychiatric injury from the meaning of personal injury in section 5. It also rejected reliance on parliamentary Notes on Clauses as inadmissible aids to interpretation. The court distinguished claims for distress or anxiety alone from claims for recognized psychiatric injury, confirming that only the latter fall within the scope of personal injury for state immunity exceptions.
In relation to the act of state doctrine and international comity, the court held that these principles are distinct from state immunity and do not protect a foreign state from proceedings where it commits an act within the United Kingdom that infringes territorial sovereignty, regardless of where the agents are physically located.
Holding and Implications
The court DISMISSED THE APPEAL.
This means that the foreign state defendant is not immune from civil proceedings in the United Kingdom in respect of personal injury caused by acts or omissions occurring in the United Kingdom, even if some acts are committed abroad. Psychiatric injury caused by such acts qualifies as personal injury within the meaning of section 5 of the State Immunity Act 1978. The decision affirms the jurisdiction of UK courts over claims involving remote spyware installation on UK devices by foreign states and clarifies the interpretation of state immunity exceptions under the Act. No new precedent beyond the interpretation of existing statutory provisions and application of established principles was created.