The Kingdom of Bahrain v Shehabi and another [2026] UKSC 25 (27 July 2026)

Executive summary

The Supreme Court decided an appeal about the scope of section 5 of the State Immunity Act 1978. It held that the state-immunity exception can apply where an act or omission in the United Kingdom causes death, personal injury, or damage to tangible property, on the pleaded facts of alleged spyware hacking of the respondents’ computers in the UK.

Key points

• Parties: the Kingdom of Bahrain appealed against Shehabi and another; the respondents were UK-based Bahraini opposition figures/activists.
• Issue: whether section 5 SIA applies only if the responsible or precipitating act occurred in the UK, or also where an act in the UK caused the injury/damage.
• Facts assumed: Bahrain’s agents allegedly hacked the respondents’ UK computers with spyware, accessed/exfiltrated information, intercepted communications, and used microphones/cameras to surveil them.
• Holding: the court rejected the appellant’s narrower reading and treated the pleaded UK-linked conduct as within section 5 on the assumed facts.
• Reasoning: the case was about interpretation of the phrase 'caused by an act or omission in the United Kingdom' in the state-immunity statute, in light of the statutory scheme and comparable immunity instruments.
• Sanctions/export-control angle: none expressly addressed; the relevance is to sovereign conduct, cross-border cyber operations, and claims against a state in UK courts.

Why it matters

The decision is relevant to sovereign-risk and national-security analysis because it confirms UK litigation exposure may arise from alleged foreign-state cyber conduct that is carried out remotely but affects persons and devices in the UK. It also shows that state-immunity defenses may not bar claims framed around UK-based injury-causing effects of spyware operations.

Implications

For compliance and litigation strategy, foreign states and their agents face a broader UK jurisdictional risk where cyber operations target people or devices in the UK, even if the operation is initiated abroad. Defendants seeking immunity will need to focus on the statutory wording and the location of the injury-causing act, not only on where the operation was directed or controlled.