Al-Masarir v Saudi Arabia: A route to state accountability for spyware

Background

On 19 August 2022, Knowles J denied Saudi Arabia’s claim to immunity in the case of Al Masarir v Kingdom of Saudi Arabia [2022] EWHC 2199. The claimant was a human rights activist and critic of the Saudi Arabian government who had been residing in the UK. The factual background to his claim was as follows: Mr Masarir claimed that malicious text messages had been sent to two of his iPhones, and spyware known as ‘Pegasus’ had infected his devices after Mr Masarir had clicked the link in those messages (Al Masarir, [14]). Mr Masarir alleged that Saudi Arabia was responsible for hacking his devices and operating the spyware, which had allowed it to, inter alia, spy on texts and calls and track the location of the phone. Mr Masarir also alleged that he had been assaulted in Knightsbridge, London; an act which he claimed had been directed or authorised by the Defendant or its officials  (Al Masarir, [16]).

Mr Masarir sought damages for misuse of private information, harassment, trespass to goods, and assault, resulting in personal injury. Saudi Arabia claimed immunity pursuant to s1(1), UK State Immunity Act (SIA). Mr Masarir argued that the exception to state immunity codified in s. 5, UK SIA applied. s. 5, SIA, provides that “[a] State is not immune as respects proceedings in respect of – (a) death or personal injury; or (b) damage to or loss of tangible property, caused by an act or omission in the United Kingdom.”

Knowles J organised the Judgment by addressing five issues. First, he held that s. 5 SIA could cover both sovereign acts (jure imperii) and private law acts (jure gestionis). Second, he found that the application of s. 5 SIA did not require that the entirety of the tort (causing personal injury etc) occur in the UK. Third, it was “overwhelmingly likely” (Judgment, [171]) that Saudi Arabia had infected Mr Masarir’s devices, and was using Pegasus to spy on him. Fourth, Saudi Arabia was likely responsible for the persons committing the assault, and fifth, there was sufficient evidence to support these points, and such was enough to also proceed with the claim.

Knowles J concluded that the exception in s. 5 SIA applied to remove Saudi Arabia’s immunity.

The future for the s. 5 exception to immunity

In this post, we are concerned with the second issue addressed in the Judgment; namely, the conclusion that s. 5 SIA can operate to limit a foreign state’s immunity where only part of the alleged causing of personal injury occurred in the UK. (The s. 5 exception to immunity is known by different names in various jurisdictions, including the territorial tort exception, personal injury exception or non-commercial tort exception. For ease of reference, we will refer to the s. 5 exception.)

In contending that s. 5 could only apply “where the whole tort causing death, etc, is committed within the UK” (Judgment, [118]), the defendant presented the High Court with the so-called “entire tort” doctrine, originating in the US caselaw on §1605(a)(5) FSIA. In particular the defendant relied on Kidane v Ethiopia ((2017) 551 F.3d 7), the facts of which were notably similar to those at hand. That case concerned a spyware attack on an anti-corruption campaigner who had asylum in the US. The spyware attack allegedly enabled the Ethiopian government to spy on him from abroad. He brought a tort claim against Ethiopia in the US courts, which failed due to the entire tort not occurring on US territory. Knowles J rejected the contention that this case (or any US case on this provision of the FSIA) could be persuasive in the English courts. In affirming that the wording of the US FSIA provision expressly differs from that of the UK, Knowles J stated that, in his view, Parliament’s specification of “an act or omission” did not require that all acts or omissions must occur in the UK (Judgment, [127]).

The reasoning of Al-Masarir has the potential to expand the scope of the exception to immunity across a number of jurisdictions. This is especially likely for states that have legislation with similar wording and legislative histories to that of the SIA. For example: s. 6, South Africa Foreign States Immunities Act 1981; s. 13, Australia Foreign State Immunities Act 1985; s. 7, Singapore State Immunity Act 1979 and s. 7, Malawi Immunities and Privileges Act 1979.

In particular, the UK Parliament’s expansive choice of “an act or omission” (as opposed to the US FSIA’s addition of “tortious”), is also found in the South African, Australian, Singaporean and Malawian legislation, in addition to s. 5, Israeli Foreign State Immunity Law 2008; Article 10, Japanese Act on the Civil Jurisdiction of Japan with respect to a Foreign State 2009; and Article 11, Russia Federal Law No. 297-FZ. This would suggest that the Al-Masarir approach will be influential in these jurisdictions, certainly in comparison with the US “entire tort” doctrine, which reflects the specific working and legislative history of the US FSIA. Some provisions even contain an explicit allowance for a harmful act to occur “in part” within the territory of the forum State, namely the UN Convention on Jurisdictional Immunities of States and their Property (2004, not yet in force), and the laws in Japan and Russia. The approach of the US, therefore, could soon become the exception to the rule, with the UK’s clarification leading the way for the interpretation of this exception to state immunity.

Whether the approach of Knowles J is preferable from a policy perspective will likely be a matter of debate. Clearly, in deciding that only part of the harmful conduct needs to occur in the UK, Al-Masarir has the potential to dramatically expand the actions falling within the exception. For the benefit of UK courts, and for clarity in other jurisdictions, further guidance is required on how exactly Knowles J’s interpretation is to be applied in practice; the “plain meaning” of s. 5 SIA (Judgment, [29]) might not be easily established. For instance, for s. 5 to apply, is there a requisite proportion of harmful conduct that must occur in the UK? Or is it the case that almost the entirety of the tortious act can occur overseas, with only minimal actions and eventual consequences occurring in the UK? Knowles J seems to impose a threshold at paragraph 120; “there has to be an act or omission in the UK which is causative of the requisite damage on more than de minimis basis”, but this would still require greater clarification for the purposes of future application.

Now that we know s. 5 does not require the entire tort to occur in the UK, there are several possibilities for its future application. In the hypothetical situation whereby State A plans and conducts the theft of documents on a computer located in State B, and disseminates these documents in State A, presumably, despite almost all the acts occurring within the sovereign State A’s own territory, it would be stripped of its immunity in light of Al-Masarir. Alternatively, if manufacturers in a factory controlled by State A produce wallboard, which is exported to State B and used to construct properties, when this wallboard causes odours, blackening of silver items, and skin and eye irritation, can State A be sued? This was denied in the US case of In re Chinese-Manufactured Drywall Products Liability Litigation (2016 168 F.Supp. 3d, 918) under the “entire tort” doctrine, though presumably could now be possible in the UK given the rejection of such a principle. It may eventually follow that the s. 5 exception employed by the UK could be used to strip a state of its immunity when an agent of State A negligently shoots across a boundary, intending to hit another official of State A, who then ducks and causes the bullet to hit and injure a citizen in State B. In this final scenario, there is an act which occurs in the UK that causes the requisite damage (ie. the agent ducking), but is this more than de minimis? Perhaps a suitable threshold might be that the ‘final act’ must occur in the UK, allowing the planning and some of the operation to take place abroad.

That is not to say that we should shy away from Knowles J’s clarification on the scope of s. 5 SIA. In light of the complexities of transboundary cyber actions, it was inevitable that the UK would soon have to confront this question, and in many ways Knowles J has provided a reasonable and realistic answer, allowing citizens to obtain redress for cyber-related harm. This is especially true in light of the immense threat posed to human rights by spyware, with governments increasingly using such tools to, inter alia, stifle and intimidate journalists and activists. Knowles J’s judgment counters these threats by providing a route to state accountability, and will hopefully lead the way for more jurisdicitons to adopt a similar stance.