GHANEM AL-MASARIR v KINGDOM OF SAUDI ARABIA

The personal-injury exception in section 5 of the State Immunity Act 1978 applies to acts or omissions in the United Kingdom regardless of whether they are sovereign or private in character. The exception is engaged where at least one substantial and efficacious act or omission in the United Kingdom causatively contributes to the injury or damage; the entire tort need not occur there. The claimant bears the burden of establishing the exception on the balance of probabilities at the inter partes stage. A foreign state may therefore be liable to proceedings concerning spyware, assault or other governmental conduct occurring in the United Kingdom, subject to proof of attribution and causation.

The claimant, a Saudi dissident resident in England, brought claims against the Kingdom of Saudi Arabia for misuse of private information, harassment, trespass to goods and assault. He alleged that Saudi agents infected his iPhones with Pegasus spyware and later assaulted him in London. The Kingdom applied for a declaration of state immunity under section 1 of the State Immunity Act 1978 and to set aside service out of the jurisdiction.

The issues included whether the alleged conduct was excluded from section 5 because it was sovereign in character, whether the injury was caused by acts in the United Kingdom, whether the Kingdom was responsible for the alleged actors, and whether the claim was too speculative to proceed.

1. Application dismissed. The Kingdom’s application for a declaration of immunity and consequential relief was refused. The claim was to proceed.
2. Section 1(1) of the State Immunity Act 1978 confers general immunity, subject to the statutory exceptions. Section 5 is concerned with death, personal injury and damage to or loss of tangible property caused by an act or omission in the United Kingdom.
3. The words “act or omission” in section 5 bear their ordinary meaning. Parliament did not limit the exception to acts done jure gestionis. Section 5 therefore applies to acts done jure imperii as well as private acts, provided its other requirements are met. The alleged installation of spyware and assault were not excluded merely because they might be sovereign or governmental acts.
4. The statutory reference to “an act or omission” does not require every causative act to occur in the United Kingdom. It is sufficient that a substantial and efficacious act or omission in the United Kingdom caused the requisite injury or damage, even if other causative conduct occurred abroad. The United States “entire tort” approach under different legislation was not applicable.
5. The claimant bore the burden of proving that the section 5 exception applied on the balance of probabilities. On the evidence, including the expert evidence concerning Pegasus and the KINGDOM operator, the claimant established the responsibility of the Kingdom for the spyware attack to the requisite standard.
6. The circumstantial evidence also established, at this stage, the Kingdom’s responsibility for the London assault. The court considered the political context, the prior spyware attack, timing, the surrounding circumstances, the alleged statements, and the weaknesses in the defendant’s hearsay evidence. A trial might produce a different result after disclosure and cross-examination, but the claim had a coherent and realistic basis and was not an abuse of process.

First-instance decision. The judgment does not state any prior appellate decision in this litigation.