Location, Location, Location: The UK Supreme Court’s Judgment in Shehabi v. Bahrain

In August 2022, I co-authored a post on the English case of Al-Masarir v. Saudi Arabia [2022] EWHC 2199, where Knowles J held that Saudi Arabia had no immunity under Section 5 of the UK State Immunity Act 1978 (‘UK SIA’) for its use of Pegasus spyware to hack the devices of Mr Al-Masarir, a human rights activist located in the UK. Four years later, the UK Supreme Court handed down its long-awaited judgment in Bahrain v. Shehabi [2026] UKSC 25, bringing an end to debates over whether States enjoy immunity under UK law for transboundary cyber espionage operations.

The Shehabi case concerned the alleged use of a spyware programme known as ‘FinSpy’ by Bahraini agents acting on behalf of the State. From around September 2011 to August 2014, the spyware was allegedly used to hack or infect the computers of two human rights activists located in the UK (including a leading figure in the Bahraini opposition movement) without their knowledge. Bahrain’s alleged use of spyware amounted to harassment under English law, leading to both victims suffering psychiatric injury (Majority Judgment, [5]-[13]). 

In a split decision, the Supreme Court concluded that Bahrain was not entitled to immunity in the claim for harassment. Section 5 of the UK SIA—the ‘territorial tort exception’ to State immunity—applies where “legally causative acts” occur in the UK; and this conclusion is in accordance with customary international law (Majority Judgment, [147]).

While the Supreme Court’s clarification of the meaning of Section 5 is in itself significant—particularly for those jurisdictions that have adopted similarly worded exceptions, including Australia, China, Singapore, and South Africa—in this post, I wish to explore the aspects of the decision that may possess broader significance for international law. First, the Judgment addresses how international law may decide the location of State conduct when States increasingly act remotely. Second, the Judgment considers whether international law requires (or, alternatively, permits) a territorial tort exception for remote acts undertaken in the exercise of sovereign authority. 

Are remotely executed State acts located where the operator is, or where the operation is directed and takes effect? 

Because State cyber operations often span multiple jurisdictions, a central issue before the Supreme Court was what part (if any) of those operations needed to be ‘territorial’ for the exception to apply—a question complicated by the fact that the ‘territorial’ component of the exception differs across instruments.

Section 5 UK SIA provides that a State “is not immune as respects proceedings in respect of—(a) death or personal injury; or (b) damage to or loss of tangible property, caused by an act or omission in the United Kingdom”. 

Compared with other formulations of the territorial tort exception, the UK SIA adopts an ambiguous approach to territoriality. The Act was adopted to (inter alia) allow the UK to ratify the European Convention on State Immunity (‘ECSI’), Article 11 of which provides that a State cannot claim immunity in proceedings relating to personal injury or property damage if: (a) the “facts which occasioned the injury” occurred in the forum State, and (b) the “author of the injury or damage” was present in that State when those facts occurred. A comparable formulation appears in the UN Convention on Jurisdictional Immunities of States and their Property (‘UNCSI’)—which the UK has signed but not ratified, and which has not yet entered into force—provides under Article 12 that a State cannot invoke immunity in proceedings relating to death, personal injury or property damage if: (a) the “act or omission occurred in whole or in part in the territory” of the forum State, and (b) the “author of the act or omission was present in that territory” at the time of the act or omission.

The Majority concluded that, notwithstanding those alternative formulations, Section 5 UK SIA is expressed in “straightforward language”, requiring only “an act” to occur in the UK which is legally causative of personal injury or property damage under the requirements of causation in the area of law concerned (at [45]-[47]). As the surveillance was of persons in the UK by means of the hacking of computers in the UK, the relevant conduct took place in the UK even if it may have been initiated from abroad (at [137]). 

This approach appears to take the view that “an act” under Section 5 occurs, at least partly, where the effects of the conduct are produced: though the State agent may sit in Bahrain, the operation targets systems in the UK, and therefore the legally relevant conduct occurs in the UK because that is where the operation is being carried out against the victim. In another example offered by the Majority, where a murder occurs on UK soil by a drone operated by a State official located abroad, who planted and detonated a bomb, the legally relevant conduct takes place within the UK. And the same conclusion would apply if NHS computer systems were hacked by operatives in a foreign State and put out of operation, causing patients to die (at [146]). The “act” itself can be territorial even where the individual operator never enters the territory. 

By contrast, the dissenting views of Lord Leggatt and Lord Burrows suggest a different conception, distinguishing between an act and its harmful effects. Where a shooter stands in State A and a victim stands in State B, the intuition appears to be that the act (pulling the trigger) occurs in State A, and only the injury occurs in State B. The injury is the effect of the act, not the location of the act itself (Lord Leggatt at [199]; Lord Burrows at [331]). A Bahraini official operating spyware from Bahrain is acting in Bahrain, and the UK’s connection with that act is merely that the consequences are felt there. 

This tension reproduces, in the specific context of State immunity, a broader debate that has arisen in international law regarding the location of State-affiliated cyber activities, and whether such activities may be said to violate the territorial sovereignty of a State when they take place remotely but manifest within that State’s territorial boundaries. Accepting that such a rule exists, Moynihan recognises that the difficulty in establishing such a violation lies in the fact that such activities are “less tangible than the physical presence of an agent on the territory and may be harder to prove” (para 50). 

There have also been debates over whether a certain threshold must be met before State cyber activity can be said to violate another State’s sovereignty. The view taken by the Tallinn Manual 2.0 is that remote cyber intrusions will only violate sovereignty where a certain level of harmful effects (above a de minimis threshold) is caused on the territory of the victim State. This view focuses less on the location of the underlying cyber activity, and instead on where, and to what extent, the harm is felt. The approach taken by the Majority—that a qualifying act occurs in the UK where it originates from an operative abroad but manifests in the hacking of NHS computers and deaths on UK soil—seems to echo this approach in the immunity context.

The division in views on territoriality also raises the question of what role the territorial requirement is performing in this context. Three options arise: first, does the ‘territorial’ component of the exception aim to establish the location of the tortious conduct (hence the different formulations on the location of the author, and on whether “all of”, “part of”, or “an” act most occur in the host State’s territory). Second, is it relevant to establishing the correct jurisdiction for the claim, by establishing which jurisdiction shares a sufficient connection with the dispute? The Majority recognise at [100]-[101] that the requirement of author presence in ECSI and UNCSI serves this purpose, and that the UK SIA’s requirement of an injury or damage caused by an act or omission within the jurisdiction is itself “a powerful linking factor underpinned by the important principle that states have jurisdiction over acts that take place in their own territory” (at [104]). Or third, does the territorial component merely determine when that connection is sufficient to displace the immunity rule? Indeed, the UK SIA occasionally employs jurisdictional linking factors in its formulation of exceptions to the rule contained in Section 1, including references to a contracts or work “performed wholly or partly” in the UK under Section 3(1)(b), and 4(1). 

Is there a customary exception for remote acts undertaken in the exercise of sovereign authority?

A second aspect of the Majority’s reasoning is whether customary international law recognises an exception to acts undertaken by the State in the exercise of sovereign authority (jure imperii), as opposed to an exception limited to non-public acts (jure gestionis). 

In 2012, the ICJ refrained from resolving the question of whether there was, in customary international law at the time, a territorial tort exception applicable to acts jure imperii (Jurisdictional Immunities, at [65]). However, the Majority in Shehabi referred to a “substantial body of state practice” supporting its existence (at [84]), and though it did not need to provide a conclusive view on the matter, concluded that “it certainly appears that state practice has moved in the direction of accepting” such an exception. 

But location may have an interesting role to play here too. Lord Leggatt, in dissent, separates the query into two distinct questions (at [266]): first, does customary international law allow a State to deny immunity for sovereign torts committed in its territory? Second, even if such an exception exists, does it extend to situations where the State official never enters the territory at all? A State may adopt the position of ‘no immunity if your officials commit tortious sovereign acts in my territory’, while rejecting the position of ‘no immunity if your officials remain abroad but their tortious sovereign acts remotely affect persons in my territory’. 

Much of the State practice cited by the Majority ([85]-[92]) involves the first proposition, but not necessarily the second (see Lord Leggatt at [320]). This gives rise to a broader question concerning how custom should be applied in novel circumstances. When new technology creates situations that existing rules never anticipated, should courts (a) extend the existing rule by analogy, (b) treat the situation as governed by a gap requiring new custom to form, or (c) decline to extend the rule until State practice catches up (leaving victims without a remedy in the interim)? In the wider cyber context, the preferred approach arguably seems to favour option (a), with long-standing customary rules increasingly applied to the novel circumstances given form by cyberspace (though some evidence of growing State practice may be cited). The ICJ, for its part, has held that “[r]eliance by a State on a novel right or an unprecedented exception to the principle might, if shared in principle by other States, tend towards a modification of customary international law”, requiring State practice to catch up to novel circumstances.

Conclusion 

The significance of the Supreme Court’s judgment in Shehabi extends beyond the English law of State immunity. Situated against the unsettled international law of cyberspace, the Judgment engages debates of much wider significance and may offer clarity for how those debates develop going forward.

On a broader scale, the Judgment should be celebrated for its establishment of a route to accountability for malicious State cyber operations at a time when debates over the governance of such operations are being stalled at the UN. When the UK is already a target of malicious cyberattacks (75% of which are believed to be linked to hostile State actors), this recognition and willingness to apply domestic law to new realities may be significant in cases to come.