Dr Saeed Shehabi v The Kingdom of Bahrain

Hearing dates: 29 & 30 July 2024

Approved Judgment

This judgment was handed down remotely at 10.00am on Friday 4 th October 2024 by circulation to the parties or their representatives by e-mail and by release to the National Archives.

The issue on this appeal is whether a foreign state whose agents, located abroad, cause spyware to be installed remotely on the computers of individuals located in the United Kingdom, causing those individuals psychiatric injury when they discover that the state has been spying on them in this way, is entitled to immunity from civil proceedings. That depends on whether the proceedings from which the state claims to be immune are ‘in respect of … personal injury … caused by an act or omission in the United Kingdom’ within the meaning of section 5 of the State Immunity Act 1978.

Three issues have been argued on this appeal:

(1) whether in such circumstances there is an act by the foreign state in the United Kingdom at all;

(2) whether immunity is only lost if all the acts by agents of the foreign state take place in the United Kingdom; and

(3) whether psychiatric injury is ‘personal injury’ within the meaning of section 5.

The judge, Mr Justice Julian Knowles, decided these issues in favour of the claimants. The defendant state, the Kingdom of Bahrain, appeals.

Another case, decided by the same judge on materially the same facts six months earlier, was Al-Masarir v Kingdom of Saudi Arabia [2022] EWHC 2199 (QB), [2023] QB 475. The arguments in that case overlapped with, but were not the same as, the arguments in the present case. In Al-Masarir Saudi Arabia argued that section 5 did not apply to acts done by a state in the United Kingdom in the exercise of sovereign or governmental authority, but only to acts of a private law nature. Mr Justice Julian Knowles rejected that argument. Saudi Arabia appealed, but the appeal was dismissed before it could be heard because Saudi Arabia failed to comply with an order for security for costs. Bahrain does not advance this argument in the present case. In the present case Bahrain contends that psychiatric injury does not amount to ‘personal injury’ within the meaning of section 5. That was not an argument advanced by Saudi Arabia in Al-Masarir.

The State Immunity Act 1978 framework

The legal framework within which the issues arise was common ground. Section 1(1) of the State Immunity Act 1978 Act is headed ‘General immunity from jurisdiction’ and provides:

‘A State is immune from the jurisdiction of the courts of the United Kingdom except as provided in the following provisions of this Part of this Act.’

The effect of this provision is that, in order for a state to be subject to the jurisdiction of the courts of the United Kingdom, the proceedings must be of a kind specified in sections 2 to 11 of the Act. If none of those provisions apply, the court lacks jurisdiction.

Relevant for present purposes is section 5, headed ‘Personal injuries and damage to property’, which provides:

‘5. A State is not immune as respects proceedings in respect of–

(a) death or personal injury; or

(b) damage to or loss of tangible property,

caused by an act or omission in the United Kingdom.’

The burden of proving that the claim falls within section 5 as one of the exceptions to the general immunity provided by section 1 lies on the claimants. This must be established on the balance of probabilities as a preliminary issue: JH Rayner (Mincing Lane) Ltd v Department of Trade and Industry [1989] Ch 72, 193–194 (Lord Justice Kerr) and 252 (Lord Justice Ralph Gibson). It was common ground between the parties that the act or omission referred to in section 5 must be an act or omission of the state or of those for whom the state is responsible.

The claimants' case

The claimants, who describe themselves as pro-democracy activists, are prominent members of the Bahraini opposition movement. The first claimant, Dr Saeed Shehabi, is a journalist and activist who is also the founder of a Bahraini political party called Al Wefaq. He has lived in the United Kingdom since 1973. He was granted asylum in 1985 and British citizenship on 14 ^th June 2002.

The second claimant, Mr Moosa Mohammed, is a Bahraini citizen, but has lived in the United Kingdom since 2006. He was granted refugee status on 7 ^th August 2007 and has been granted indefinite leave to remain here.

The claimants' case is that from around September 2011 Bahrain's servants or agents, likely operating remotely from outside the United Kingdom, hacked – or infected – their computers with a spyware program called ‘FinSpy’ while they and their computers were in the United Kingdom; that this amounted to harassment under the Protection from Harassment Act 1997; that they suffered psychiatric injury as a consequence when they learned that their computers had been hacked in this way; that this amounts to personal injury within section 5 of the State Immunity Act 1978; and therefore that Bahrain is not immune.

Spyware is a type of computer program which allows a remote operator to take control of a target's device (e.g. their computer or mobile phone) and then to use that device to carry out surreptitious remote eavesdropping and surveillance of the target by the collection and transmission to a remotely located server of video, audio and data. The spyware program is usually deposited on the target's device by the target unwittingly opening an infected email or attachment that has been sent by the remote operator. FinSpy is one such program.

The claimants' case is that the operation of that spyware resulted in the covert and unauthorised accessing by Bahrain of information stored on, or communicated or accessible via, the claimants' laptops. This has enabled Bahrain to collect much, if not all, of the data processed on the laptops, including messages, emails, calendar records, instant messaging, contacts lists, browsing history, photos, databases, documents and videos. It has also permitted Bahrain to track the location of the claimants via their laptops, to intercept calls made on them, and to eavesdrop on the claimants by covert use of the laptops' microphones and cameras.

Bahrain denies the claimants' allegations, but the judge found, on the basis of expert evidence, that the claimants had discharged the burden upon them of proving on the balance of probabilities that their computers were infected by spyware by Bahrain's servants or agents. It will be open to Bahrain to challenge that conclusion at trial, but it has not been challenged on this appeal.

It appears that the claimants learned of the hacking of their computers in or around August 2014 when WikiLeaks published on its website documents concerning Bahrain's use of FinSpy and an organisation called Bahrain Watch identified the claimants as targets of such hacking.

Harassment

The claimants frame the case in the tort of harassment. The ingredients of that tort were described by Mr Justice Nicklin in Hayden v Dickenson [2020] EWHC 3291 (QB) as follows:

‘40. s.1 Protection from Harassment Act 1997 (“PfHA”) provides, so far as material:

“(1) A person must not pursue a course of conduct — (a) which amounts to harassment of another, and (b) which he knows or ought to know amounts to harassment of the other.

(1A) [omitted]

(2) For the purposes of this section …, the person whose course of conduct is in question ought to know that it amounts to … harassment of another if a reasonable person in possession of the same information would think the course of conduct amounted to harassment of the other.

(3) Subsection (1) does not apply to a course of conduct if the person who pursued it shows –

(a) that it was pursued for the purpose of preventing or detecting crime,

(b) that it was pursued under any enactment or rule of law or to comply with any condition or requirement imposed by any person under any enactment, or

(c) that in the particular circumstances the pursuit of the course of conduct was reasonable.”

41. s.3 provides that any actual or apprehended breach of s.1(1) may be the subject of a civil claim by anyone who is or may be the victim of the course of conduct. Remedies in a civil claim include interim and final injunctions and damages for “any anxiety caused by the harassment and any financial loss resulting from the harassment”: s.3(2).

42. s.7(2) provides: “References to harassing a person include alarming the person or causing the person distress”; and in subsection (3) (b): “A ‘course of conduct’ must involve, in the case of conduct in relation to a single person (see section 1(1)), conduct on at least two occasions in relation to that person.” Conduct can include speech (s.7(4)).

43. A defendant has a defence if s/he shows: (i) that the course of conduct was pursued for the purpose of preventing or detecting crime; and/or (ii) that in the particular circumstances the pursuit of the course of conduct was reasonable (s.1(3)).

44. The principal cases on what amounts to harassment are: Thomas v News Group Newspapers [2002] EMLR 4; Majrowski v Guy's and St Thomas's NHS Trust [2007] 1 AC...