If a foreign state, operating from abroad, plants spyware on a computer in Britain, can the victim sue here — or does state immunity block the claim because the state’s agents were not physically present in the UK when they acted? On 27 July 2026 a divided Supreme Court held that state immunity did not bar the claim. In The Kingdom of Bahrain v Shehabi [2026] UKSC 25, the Court held, by a majority of three to two, that section 5 of the State Immunity Act 1978 contains no requirement that the foreign state’s agent be physically present in the United Kingdom. The underlying allegations remain to be proved.
What the case was about
Section 5 of the SIA removes a foreign state’s immunity for proceedings in respect of death, personal injury or property damage “caused by an act or omission in the United Kingdom” (para 20). The two respondents — Bahraini pro-democracy activists long resident in the UK — allege that, on facts assumed to be true for this preliminary issue, agents of the Kingdom of Bahrain operating remotely from abroad infected their UK-based computers with “FinSpy” spyware and used it to conduct covert surveillance; the respondents allege that learning of that conduct subsequently caused them psychiatric injury (paras 4, 8, 12–13). Bahrain claimed immunity, arguing that section 5 should be read like article 11 of the European Convention on State Immunity, which applies only where “the author of the injury or damage was present” in the forum state when the relevant facts occurred (paras 3, 22, 59). Because its agents had acted from outside the UK, Bahrain said, the exception could not bite. The High Court and the Court of Appeal (Males LJ) both rejected that argument (para 30); Bahrain appealed.
What the Supreme Court decided
By a majority — Lord Lloyd-Jones, Lord Hamblen and Lady Simler — the Court dismissed the appeal (para 148). Section 5 requires a legally causative act in the UK; it does not require that act to be the sole, initiating or “precipitating” cause, that every causative act occur here, or that the responsible actor be physically present (paras 45–55). The words “an act … in the United Kingdom” are capable of including an act carried out through a device or by automated or remote means. Accordingly, the remote manipulation from abroad of a computer located in the UK can itself be an act in the UK (paras 131–132).
The majority considered the omission of article 11’s presence requirement from section 5 to be clear and deliberate (paras 60, 73–75). On the assumed facts, ten pleaded classes of acts occurred on the respondents’ computers in the UK, involving infection, access, exfiltration and surveillance (paras 135–137). Those acts amounted to legally causative acts in the UK, bringing the claim within section 5 (para 147). The majority drew support from an earlier hacking case in which remotely accessing a London computer was compared to opening a safe “from afar” (paras 140–141).
Lord Leggatt and Lord Burrows dissented. They considered that section 5 should be interpreted consistently with article 11 and customary international law as requiring the foreign state’s agent to be present in the UK. On that interpretation, the alleged acts were performed where the agents operated their computers, while only their effects occurred here; both would have allowed Bahrain’s appeal (paras 154, 323–324, 359).
Why it matters
- Physical presence is not required for an act in the UK. A foreign state need not send an agent across the border: the remote manipulation of a computer located here can itself constitute a legally causative “act … in the United Kingdom”. Mere foreign conduct with consequences here would not necessarily be enough (paras 47, 58, 131–141).
- A deliberate divergence from the treaty model. The majority read section 5 as intentionally broader than article 11 of the ECSI, Parliament having omitted the presence requirement, so the domestic exception outstrips the convention (paras 60, 73–75); the dissenters saw that same divergence as putting the UK out of step with its international obligations (paras 149, 359).
- A binding but closely divided ruling. The majority’s interpretation is authoritative, but the three-to-two division exposes a fundamental disagreement about the relationship between statutory language, treaty interpretation and customary international law. The dissents are likely to shape future argument about the scope of section 5 and any consideration of legislative reform (paras 154, 323–324, 358–359).
Free to search across 25 official UK databases — no account needed. Explore the authorities behind this case:
Read the full judgment: The Kingdom of Bahrain v Shehabi and another [2026] UKSC 25 (full text on Search the Law).