British court dismisses Bahrain’s bid to block activists’ spyware lawsuit

Britain's Supreme Court has rejected Bahrain's attempt to invoke state immunity to block a lawsuit filed by two Bahraini dissidents alleging surveillance through spyware. The narrow 3-2 decision, handed down on Monday, establishes a significant legal precedent regarding the liability of foreign governments for cyber operations targeting individuals within UK jurisdiction.

The case involves Saeed Shehabi, a journalist and founder of a Bahraini opposition political party, and Moosa Mohammed, a Bahraini refugee, both resident in the United Kingdom. The two men alleged that the Bahraini government infected their computers in 2011 with FinSpy, a spyware tool capable of logging keystrokes, tracking locations, and monitoring activities remotely. They filed suit in London's High Court in 2020 seeking damages for psychiatric harm.

Bahrain contested the allegations and argued that the hacking occurred outside UK jurisdiction, thereby entitling the state to immunity from suit. The High Court rejected this argument in 2023, a decision upheld by the Court of Appeal in 2024. Bahrain's final appeal to the Supreme Court was dismissed on Monday, with the court determining that the alleged surveillance constituted an act carried out within the UK, as the claimants and their computers were located in Britain when the spyware allegedly took effect.

The ruling permits the case to proceed to trial and contributes to a growing body of litigation examining the liability of states and surveillance firms in Western courts for spyware operations. Similar cases include WhatsApp's ongoing lawsuit in the United States against the NSO Group over Pegasus spyware. Human rights organisations have documented a pattern of Bahrain surveilling dissidents and journalists.