Dr Saeed Shehabi & Anor v The Kingdom Of Bahrain

The Court of Appeal considered whether a foreign State is immune from civil proceedings under section 5 of the State Immunity Act 1978 where agents located abroad remotely install spyware on computers located in the United Kingdom, and the targets suffer psychiatric injury when they discover the surveillance. The court addressed three issues: (i) whether the relevant act occurs in the United Kingdom when remote manipulation of a UK-located device takes place; (ii) whether the section 5 exception requires that all causative acts occur within the United Kingdom; and (iii) whether recognised psychiatric injury falls within ‘personal injury’ in section 5.

The court held that remote manipulation and installation of spyware on a device situated in the United Kingdom are acts in the United Kingdom for the purposes of section 5, because the foreign state in effect interferes with the United Kingdom’s territorial sovereignty and substantive acts occur in both places. It held that section 5 requires only that an act or omission causative of the injury occurs in the United Kingdom, even if other causative acts occur abroad. Finally, the court held that recognised psychiatric injury is included within ‘personal injury’ in section 5, applying the always‑speaking principle of statutory interpretation and domestic authorities (including Ogbonna and related authorities). The appeal was therefore dismissed.

Background and parties: The respondents are two long‑term United Kingdom residents and political activists who alleged that agents of the Kingdom of Bahrain remotely infected their United Kingdom‑located computers with FinSpy spyware, resulting in covert surveillance and, upon discovery, recognised psychiatric injury. Proceedings were brought in the tort of harassment and invoked section 5 of the State Immunity Act 1978 to defeat the State’s immunity plea. The defendant State appealed the High Court’s decision (Knowles J [2023] EWHC 89 (KB)).

Nature of the claim and relief sought: The claim was framed in the tort of harassment under the Protection from Harassment Act 1997, with the claimants seeking civil remedies including damages for anxiety and psychiatric injury and injunctive relief in principle. The preliminary question was jurisdictional: whether the State was immune under the 1978 Act.

Issues for determination:

• whether remote installation and control of spyware on devices located in the United Kingdom amounts to an act in the United Kingdom for the purposes of section 5;
• whether the section 5 exception requires that all acts or omissions causing the injury must occur in the United Kingdom;
• whether recognised psychiatric injury falls within the statutory phrase ‘personal injury’ in section 5.

Court’s reasoning and conclusions: The court analysed the statutory language of section 5 together with the international law and contextual materials. On the first issue the court concluded that the remote manipulation of a UK‑located device is properly to be regarded as an act in the United Kingdom because the substantive effects and interference with territorial sovereignty occur here; authorities on analogous questions of location (for example Levin and Ashton) supported that conclusion. The court rejected the appellant’s reliance on the Computer Misuse Act 1990 and certain foreign authorities as determinative of the meaning of section 5.

On the second issue the court held that the plain wording of section 5 requires only that an act or omission causative of personal injury occur in the United Kingdom; Parliament deliberately omitted language requiring the author to be physically present and did not require that all causative acts take place entirely within the forum. External materials such as the European Convention on State Immunity and the UN Convention were considered but did not displace the clear statutory words.

On the third issue the court applied the ‘always speaking’ principle of statutory interpretation and domestic authorities holding that recognized psychiatric injury falls within the concept of personal injury. The judge’s reliance on Employment Appeal Tribunal decisions (Caramba‑Coker and Ogbonna) and subsequent appellate approval (Zu Sayn‑Wittgenstein‑Sayn) was endorsed. Canadian authorities that construe bilingual domestic legislation to exclude standalone psychiatric injury were treated as founded on domestic bilingual interpretive principles and not persuasive as a guide to the meaning of the 1978 Act.

Procedural posture: This was an appeal from the High Court (Media & Communications List, Knowles J [2023] EWHC 89 (KB)). The Court of Appeal dismissed the State’s appeal.

Other procedural or wider context noted: The court observed that the claimants bore the burden of proving on the balance of probabilities that section 5 applied as a preliminary issue; the High Court found the factual case of infection proven on that basis and that finding was not challenged on appeal. The court also noted, but did not decide, a Respondents’ Notice raising Article 6 and the Human Rights Act 1998 because the appeal failed.

Appeal dismissed. The Court of Appeal upheld the High Court’s conclusion that (1) remotely installing and operating spyware on computers physically located in the United Kingdom constitutes an act in the United Kingdom for the purposes of section 5 of the State Immunity Act 1978; (2) section 5 requires only that an act or omission causative of the injury occur in the United Kingdom and does not require that all causative acts take place entirely within the United Kingdom; and (3) recognised psychiatric injury falls within ‘personal injury’ in section 5. The statutory language, territorial sovereignty considerations and domestic authorities supported these conclusions.

On appeal from the High Court of Justice, King's Bench Division, Media and Communications List (Knowles J), [2023] EWHC 89 (KB). The Court of Appeal ([2024] EWCA Civ 1158) dismissed the defendant State's appeal.