The Disputes Brief

Technology crosses borders with a freedom and fluidity that people cannot match. State B may be able to prevent State A’s agents from physical entry into its territory and it may be able to penalise them for bad behaviour when they are present. However, to what extent can State B impose the same penalties if State A’s bad actor stays at home, using technology to inflict damage in State B from his bedroom? In the Kingdom of Bahrain v Shehabi and another [2026] UKSC 25, the Supreme Court held that, if State A interferes with the territorial sovereignty of State B by doing an act in State B which causes personal injury or damage to property, it takes the risk that it will be subject to civil proceedings and not entitled to adjudicative immunity.

Summary of the facts

The respondents, two UK-based activists advocating, amongst other things, for democracy in Bahrain, alleged that their computers had been hacked by persons acting on behalf of the State of Bahrain. The spyware enabled the hacker, likely operating from outside the UK: (i) to access, copy, and/or exfiltrate information stored on, available on and/or transmitted by the computers; (ii) to intercept textual, audio, and/or video communications conducted using the computers; and (iii) to use the computers’ microphones and/or cameras to surveil the respondents. Upon learning of what had happened, both respondents claimed that they had suffered psychiatric injuries. The respondents claimed damages for these personal injuries. The appellant, the State of Bahrain, asserted immunity from suit.

The relevant question

The State Immunity Act 1978 (“the Act”) affords states a general immunity from the jurisdiction of the UK courts subject to certain exceptions. One of these exceptions, set out in section 5, is that a state is not immune as respects “proceedings in respect of (a) death or personal injury; or (b) damage to or loss of tangible property, caused by an act or omission in the United Kingdom.”

Ultimately, Bahrain’s argument came down to the submission that, for section 5 of the Act to apply, the act that caused the personal injury or damage to property, or if more than one, all such acts, must take place in the UK. Because the hacking complained of would have been initiated outside the UK, by persons outside the UK, the exception did not apply.

The judgment

The majority of the Supreme Court, Lords Lloyd Jones, Hamblen and Lady Simler, found that section 5 is straightforward, clear and unambiguous: as a matter of ordinary language, there is no requirement in section 5 for “the” act or “all” acts to be in the UK.

The other arguments raised by the appellants did not alter the majority’s view. Two arguments that the majority nevertheless spent some time analysing were:

1. Inconsistency with the European Convention on State Immunity (ECSI): One purpose of the Act was to permit the UK to become a party to the ECSI. Art.11 ECSI corresponds broadly with section 5 but requires a presence in the relevant territory. The majority found that the Act was not intended to implement the ECSI precisely and it departed from the latter’s terms in a number of important respects. Importantly, while it had been open to Parliament to import the language of art.11 ECSI, it had not done so, and such a departure had to be deliberate.
2. Incompatibility with customary international law: The majority held that customary international law did not compel section 5 to be read as containing a presence requirement. It considered that there was at least a reasonable basis for the UK to enact section 5 in the terms it did, while declining to decide finally whether a “territorial tort” exception applicable to sovereign acts is now established as customary international law. In particular, the majority referred to Jurisdictional Immunities of the State (Germany v Italy: Greece intervening) [2012] ICJ Rep 99, in which the International Court of Justice left unresolved the question whether there exists in customary international law a “territorial tort exception” to state immunity which would apply to sovereign acts in the forum state causing death, personal injury or damage to property.

The dissent

In a persuasive dissent, Lord Leggatt (with whom Lord Burrows agreed) found that an act is done where the actor is located, not where its effects are felt: Assuming the pleaded facts to be true, where a computer in England is hacked by a remote operator located in Bahrain, the operator performs various acts by inputting commands to a computer in Bahrain and those acts have effects in England. This finding was, Lord Leggatt noted, consistent with the decision in El-Khouri v Government of the United States of America [2025] UKSC 3, the only linguistic difference being that that El-Khouri referred to “conduct” as opposed to “an act”.

Acknowledging that the use of technology such as spyware raised questions of legal responsibility that did not arise and would not have been contemplated either at the time of the State Immunity Act or the ECSI, Lord Leggatt made five, powerful, points:

1. The legislation must be interpreted in the historical context of the situation which led to its enactment, not on the basis of a judge’s view that a different regime would now be desirable.
2. A rule based on where the agent is located has clarity and certainty. The connection which justifies the exercise of jurisdiction is not that the defendant did any act in the territory of the forum but the fact that harm was caused (or an attempt was made to cause such harm) in that territory. Lord Leggatt asked how the majority would view the situation of a rifle fired by a person standing on the Scottish bank of the Tweed at someone on the English bank? Would they say that the act of shooting takes place in England? If not, Lord Leggatt wondered how that case differed in principle from a computer hacking case.
3. Section 5 is not restricted to death or personal injury or damage to tangible property sustained in the UK. Given that the justification in principle for the departure from immunity in s. 5 must be the sovereignty of the UK over its own territory, it is hard to justify such a departure when neither the victim nor the perpetrator of the wrongful act is present in the UK.
4. Having regard to other cases, Bahrain would have been able to assert immunity successfully if only financial damage had been suffered. There is no principled basis for treating a foreign state as subject to the jurisdiction of the UK courts if its agents hack a computer from abroad and thereby cause psychiatric injury to someone, yet immune from suit if instead such hacking causes massive financial damage in the UK.
5. The presence requirement in art.11 ECSI showed that a territorial-presence rule was not irrational or unprincipled.

Practical takeaway

The immediate effect of the decision is confined by the wording of section 5: the exception applies only to claims in respect of death or personal injury, or damage to or loss of tangible property, and not to pure financial loss. For that reason, the decision may pose limited practical exposure for states in many cyber cases. Its wider significance lies in the majority’s treatment of remote technological conduct. Where a foreign state, acting from abroad, manipulates computers or devices located in the UK in a way that causes legally recognised personal injury or property damage, the relevant acts may be treated as occurring in the UK for the purposes of section 5. That reasoning may prove important in future cases involving spyware, cyber intrusion, drones or other forms of remote state activity.