The UK Supreme Court has dismissed an appeal by Bahrain claiming state immunity, allowing a lawsuit by two political activists to proceed. The ruling establishes that countries using spyware on people in the UK can be sued.
The lawsuit was filed by Dr Saeed Shehabi and Moosa Mohammed, Bahraini activists living in London. They allegedly suffered psychological harm after their laptops were infected with FinSpy spyware while they were in the UK. The infection occurred in September 2011.
The activists believe the operation was authorized and directed by the Bahraini government. FinSpy is a commercial spyware produced by the now defunct Munich-based company FinFisher GMBH. This type of software has been used against journalists and activists in several countries.
Legal precedent on remote acts
The core of the legal dispute centered on whether remote cyber operations constitute an act within British jurisdiction. The court determined that the remote infection of devices from abroad constitutes an 'act in the UK' according to the ruling.
Bahrain had previously challenged the case at the High Court and the Court of Appeal, both of which ruled against them. The UK Supreme Court upheld the rulings of the lower courts.
With the immunity challenge rejected, the case is expected to return to the High Court for a full trial. Stanley Kwenda serves as the Strategic Communications Advisor at Amnesty International.