1. In its recent judgment in The Kingdom of Bahrain v Shehabi and another [2026] UKSC 25 (“Shehabi”), the Supreme Court of the United Kingdom denied immunity under the State Immunity Act 1978 (“SIA”) to a sovereign State faced with tort claims relating to its alleged remote surveillance of individuals based in the United Kingdom (“UK”).
2. The controversial decision, which was decided by a narrow 3–2 margin, serves to clarify the scope of the so-called “territorial tort exception” to state immunity under Section 5 of the SIA and could potentially give rise to numerous future cases before the English courts.
I. BACKGROUND
3. The case related to two prominent Bahraini pro-democracy activists living in the UK. In 2011, hackers on behalf of the Kingdom of Bahrain allegedly infiltrated the activists’ computers using spyware software. The agents were then able to remotely control the activists’ computers, gain access to files, cameras and microphones and intercept communications. The activists discovered Bahrain’s activities in 2014 and allegedly suffered serious psychiatric injury.
4. In 2023, the activists brought a High Court claim for the tort of harassment under the Protection from Harassment Act 1997. Bahrain filed a plea for state immunity under Section 1 of the SIA, arguing that the decisive acts causing the injury (e., the hacking and installation of spyware) took place in Bahrain, not the UK. Julian Knowles J denied Bahrain’s plea on the basis that under Section 5 of the SIA, there is no immunity for a foreign State in respect of an act causing personal injury in the UK, and there is no requirement that the tortfeasor be present in the UK.
5. Bahrain appealed the High Court’s decision to the Court of Appeal. The Court of Appeal unanimously dismissed the appeal, holding that remote manipulation of a computer from abroad amounts to “an act” within the UK because it interferes with the UK’s territorial sovereignty.2 Bahrain then appealed to the Supreme Court.
II. LEGAL BACKGROUND
6. State immunity is a universally recognised and fundamental principle of international law, rooted in the sovereignty and equality of States.3 In this spirit, Section 1 of the SIA establishes the general rule that “a State is immune from the jurisdiction of the courts of the United Kingdom.” The SIA then contains several exceptions to this general rule, including in Section 5 of the SIA, commonly known as the “territorial tort exception”: a State is not immune in proceedings relating to “(a) death or personal injury; or (b) damage to or loss of tangible property, caused by an act or omission in the United Kingdom.”
7. The historic and international context surrounding the passing of the SIA was also highly relevant in this case. The SIA was intended to codify the customary international law rules of state immunity, but it was also drafted to allow the UK to ratify the Council of Europe’s European Convention on State Immunity 1972 (“ECSI”).4 The corresponding provision to Section 5 of the SIA in the ECSI is Article 11, which stipulates that a State cannot claim immunity if the tortfeasor caused injury or damage while present in the territory of the forum State. This requirement for the tortfeasor’s presence in the forum State is noticeably absent from the SIA, and it was common ground between the parties in this case that Bahrain would have been entitled to immunity under the ECSI.
III. THE SUPREME COURT’S JUDGMENT
8. Following Bahrain’s appeal, the Supreme Court identified and addressed two central issues. First, it sought to clarify whether an “act” under Section 5 of the SIA refers only to the act that caused personal injury or damage, as well as whether every act causing injury or damage must occur in the UK. Second, the Court considered whether Section 5 of the SIA implicitly requires the tortfeasor to be present in the UK at the time of the act causing injury or damage.
B. The Majority: No Immunity in Respect of Hacking Orchestrated from Bahrain
9. The majority of Lord Hamblen, Lord Lloyd-Jones and Lady Simler dismissed Bahrain’s plea of immunity, making several key points.
10. First, the majority held that the wording of Section 5 of the SIA is clear and unambiguous: the test for causation is the same as for any other tort claim, and Section 5 does not require that there be a single causative act. As a result, the majority rejected Bahrain’s assertion that every act causing the injury or damage must be performed in the UK for it to lose its immunity. The activists were only required to prove a causative act in the UK, and the remote manipulation of a computer system located in the UK amounts to such an act.5
11. Second, the majority rejected Bahrain’s argument that Section 5 of the SIA must be interpreted consistently with Article 11 of the ECSI, to which the UK is a party and which requires the tortfeasor’s territorial presence in the UK. While the majority acknowledged that one of the aims of the SIA was to allow the UK to ratify the ECSI, it held that Section 5 of the SIA was never intended to precisely replicate Article 11 into English law. Rather, the majority concluded that Section 5 should be construed as a “clear and deliberate departure from the presence requirement.”6
12. Finally, the majority held that its proposed interpretation of the territorial tort exception would not contravene customary international law, although it stopped short of expressing a firm view of whether the territorial tort exception did amount to a rule of customary international law. Examining international conventions,7 foreign domestic legislation,8 and academic commentary,9 the majority concluded that “state practice has moved in the direction of accepting such an exception.”10 Accordingly, the majority was comfortable that their proposed interpretation of the territorial tort exception in Section 5 of the SIA was consistent with the SIA drafters’ interpretation of customary international law.
A. The Dissenting Justices: Bahrain Is Entitled to State Immunity
13. In an extensive dissent, Lord Leggatt, with whom Lord Burrows largely agreed, explained that he would have recognized Bahrain’s immunity from suit. In his view, the correct interpretation of Section 5 of the SIA was that it only applies where the author of the act causing injury or damage is present in the territory of the UK.
14. While he agreed with the majority that Section 5 of the SIA does not require all “acts” to occur in the UK, Lord Leggatt considered that their interpretation failed to differentiate between an act and its effects. The effects (psychiatric injury to the activists) occurred in the UK, but the wrongful act (hacking the activists’ computers) was committed abroad. Given that Section 5 of the SIA requires that there be an “act … in the UK,” on Lord Leggatt’s view, this “act” can only be performed by an actor territorially present in the UK.11
15. Further, the dissenting Justices considered that Section 5 of the SIA should be interpreted in light of its historical and legislative context, namely the implementation of the ECSI (which requires a territorial presence) into UK law.12 They also strongly disagreed with the majority’s position that their interpretation was supported by customary international law, arguing that there is “a complete absence”13 of State practice in support of a territorial tort exception with no presence requirement. The dissenting Justices concluded that, in their view, the majority’s opinion would leave the UK in breach of its international obligations under the ECSI and customary international law.14
IV. CONCLUSION AND IMPLICATIONS
16. This decision is timely and will likely have significant implications for state immunity going beyond personal injury cases, given that Section 5 of the SIA also covers damage to, or loss of, tangible property.
17. In the current geopolitical climate, with increasing cyberattacks causing damage to essential property and critical infrastructure, the decision in Shehabi may open the door for further claims against sovereign States that carry out hacking operations against parties in the UK.
18. The UK is the world’s third most targeted country for cyberattacks, behind the United States and Ukraine.15 The National Cyber Security Centre estimates that over 75% of targeted cyberattacks on the UK’s national infrastructure last year could be linked to hostile foreign State actors.16 Given this, and the UK’s historical status as a safe haven for political asylum seekers and dissidents targeted by their home States, the English courts may experience a rise in tort claims connected to State-sponsored cyberattacks and hacking.
19. The Supreme Court’s decision further sheds light on dramatically diverging views within the Supreme Court regarding state immunity as a matter of English law and customary international law. Crucially, the question of whether there exists, under customary international law, a territorial tort exception that does not require the tortfeasor’s territorial presence in the forum State was left open by the majority, leaving space for future judicial clarification.
20. The SIA has served as a model for state immunity legislation throughout the common law world (such as the Singaporean State Immunity Act 1979 or the Australian Foreign States Immunities Act 1985). It will be interesting to see whether other common law jurisdictions will take the same approach as the Supreme Court.
