The UK Supreme Court has rejected Bahrain's spyware immunity argument, allowing two dissidents living in Britain to continue a damages claim over alleged state hacking of their laptops.
Saeed Shehabi and Moosa Mohammed say Bahraini officials covertly put FinSpy spyware on their computers, probably in 2011, and then used the access to monitor their work with political prisoners, journalists and torture survivors. They argue the surveillance caused psychiatric harm and that Bahrain should pay damages.
The court split 3-2 in Monday's ruling. The majority found that Bahrain could not rely on state immunity because the alleged intrusion took place in the United Kingdom. Bahrain has denied the hacking allegations, according to The Record. Bahrain's Global Communication Office did not immediately respond to The Record's request for comment.
Why did the UK Supreme Court reject Bahrain's immunity claim?
State immunity can shield foreign governments from being sued in UK courts, but there are exceptions. In this case, the Supreme Court said the alleged conduct fell outside that protection because the hacking was said to have happened in the UK.
According to the court opinion, the alleged compromise gave Bahrain access to data on the laptops, let officials remove information from them, intercept communications, and use the computers' microphones and cameras for surveillance. The court described the alleged monitoring as broad and highly intrusive, and said it met the legal threshold for harassment.
That finding does not decide whether Bahrain installed the spyware. It decides that the lawsuit can proceed despite the kingdom's immunity claim, which Bahrain's leaders brought to the Supreme Court last year.
What is FinSpy?
FinSpy, also called FinFisher, is surveillance software. The Citizen Lab has described it as sophisticated spyware sold only to governments for intelligence and law enforcement use.
Spyware of this kind matters because it turns an ordinary computer into an intelligence source. If the allegations are proved, the attackers did not need to seize the laptops or persuade the targets to hand over files. They could collect material and watch communications through the compromised devices themselves.
FinFisher declared insolvency in 2022 while investigations into its business practices were under way.
Who brought the case?
Mohammed came to Britain as a refugee in 2006 after, according to his lawyers, Bahraini police arrested and tortured him. Shehabi has lived in the UK since 1973 and is a pro-democracy activist and journalist who has held a leadership role in Bahrain's opposition movement.
The two men say they discovered the alleged infections around August 2014 after seeing reports from WikiLeaks and a Bahraini watchdog group, according to the Supreme Court opinion.
Shehabi said in 2023 that his "long and gruelling pursuit of justice" showed "the psychological torture that authoritarian regimes exercise transnationally." The Supreme Court's decision gives that pursuit a route back through the UK courts, where the factual dispute over the alleged hacking remains to be tested.
This story draws on original reporting from The Record.
