Dr Saeed Shehabi & Anor v The Kingdom Of Bahrain

Under section 5 of the State Immunity Act 1978, remotely manipulating a computer situated in the United Kingdom is an act in the United Kingdom, even where the state agents responsible are abroad. The state loses immunity if a causative act occurs here; every causative act need not occur here.

“Personal injury” includes a recognised psychiatric injury suffered without accompanying physical injury. Distress, anxiety or depression which does not amount to a recognised psychiatric condition is insufficient. The provision is always speaking and applies in the light of contemporary understanding.

Two Bahraini opposition activists alleged that agents of the Kingdom of Bahrain remotely infected their computers in the United Kingdom with FinSpy spyware. They claimed that discovering the surveillance caused recognised psychiatric injury and constituted harassment.

Julian Knowles J held that Bahrain was not immune under section 5 of the State Immunity Act 1978: [2023] EWHC 89 (KB). Bahrain appealed on whether remote hacking was an act in the United Kingdom, whether every causative act had to occur here, and whether standalone psychiatric injury was “personal injury”. The underlying allegations and the preliminary factual findings were not challenged on the appeal.

1. Appeal dismissed. Remote manipulation from abroad of a computer situated in the United Kingdom is an act in the United Kingdom for section 5 of the State Immunity Act 1978. The state agents act both abroad and here. Treating everything occurring on the target computer as merely an effect of conduct abroad would be artificial. The hacking also interferes with the United Kingdom’s territorial sovereignty. The physical location of the state agents is immaterial.

2. Section 5 requires a causative act or omission in the United Kingdom. It does not require every causative act to occur here. Its plain language cannot be displaced by external materials. The European Convention on State Immunity 1972 differed deliberately by requiring the author of the injury to be present in the forum state. The later and unratified United Nations Convention, and United States decisions applying an “entire tort” doctrine under differently worded legislation, did not control the construction of the 1978 Act.

3. A recognised psychiatric injury is “personal injury” under section 5 even without associated bodily injury. Statutes are generally always speaking, and section 5 was not tied to a historical meaning. Both contemporary law and the law as understood around 1978 supported inclusion of psychiatric injury. International materials disclosed no settled narrower meaning. Canadian decisions excluding standalone psychiatric harm depended on the interpretation of bilingual Canadian legislation and were distinguishable.

4. The relevant boundary is between a recognised psychiatric injury and ordinary alarm, fear, anxiety or distress. The latter, without a recognised psychiatric condition, does not constitute personal injury under section 5.

5. The claimants’ alternative argument under article 6 of the European Convention on Human Rights and section 3 of the Human Rights Act 1998 did not require determination.

Warby LJ and Carr LCJ agreed with the reasons of Males LJ.

1. Court of Appeal (Civil Division): The Kingdom of Bahrain’s appeal was dismissed: [2024] EWCA Civ 1158 .
2. High Court, King’s Bench Division: Julian Knowles J held that the claimants had established for the preliminary jurisdictional issue that Bahrain’s agents infected their computers, that remote infection was an act in the United Kingdom, and that recognised psychiatric injury was personal injury under section 5 of the State Immunity Act 1978: [2023] EWHC 89 (KB) .