The Court of Appeal decision of Shehabi v Kingdom of Bahrain [2024] EWCA Civ 1158 is a fascinating appeal concerning a host of issues, from state immunity to statutory interpretation, and surveillance. The key issue was whether a foreign state whose agents, located abroad, caused spyware to be installed remotely on the devices of individuals in the United Kingdom (causing those individuals psychiatric injury upon discovering the state had been spying on them), was entitled to immunity from civil proceedings.
The claimants' case was that in September 2011, Bahrain's servants or agents, who operated remotely from outside the UK, hacked their computers with a spyware program called FinSpy. The claimants argued that this amounted to harassment under the Protection from Harassment Act 1977. Expert evidence supported the claimants' contention that the discovery of the hacking of their computers caused them a psychiatric injury. The first claimant was alleged to have suffered an adjustment disorder, whilst the second claimant was alleged to have suffered an exacerbation of an existing adjustment disorder.
The legal framework within which the issues arose was common ground between the parties. Section 1(1) of the State Immunity Act 1978 Act is headed 'General immunity from jurisdiction' and provides:
"A State is immune from the jurisdiction of the courts of the United Kingdom except as provided in the following provisions of this Part of this Act."
In essence, this means that in order for a state to be subject to the jurisdiction of the UK courts, the proceedings must be of a kind specified in sections 2-11 of the Act, and if the provisions contained therein do not apply, then the court lacks jurisdiction.
Section 5 reads as follows:
"A State is not immune as respects proceedings in respect of–
(a) death or personal injury; or
(b) damage to or loss of tangible property,
caused by an act or omission in the United Kingdom."
The crux of the claimants' position was that their psychiatric injuries amounted to personal injury within section 5 of the State Immunity Act 1978, and therefore Bahrain was not immune.
There were three main issues:
- Whether in such circumstances there was an act by the foreign state in the United Kingdom at all;
- Whether immunity was only lost if all the acts by agents of the foreign state took place in the United Kingdom;
- Whether psychiatric injury was "personal injury" within the meaning of section 5.
At first instance, the case was decided in favour of the claimants. Mr Justice Julian Knowles held that remote manipulation from abroad of devices located in the UK was an act within the UK. Further, the judge held that the plain meaning of section 5 was that immunity would not apply if an act or omission causing personal injury took place in the UK, even if other causative acts took place abroad. He followed his earlier judgment in Al-Masarir v Kingdom of Saudi Arabia [2022] EWHC 2199 (QB), [2023] QB 475. On the third issue, the judge held that psychiatric injury did fall under "personal injury" within the meaning of section 5. The Kingdom of Bahrain appealed.
Lord Justice Males gave the leading judgment in the Court of Appeal, dismissing all three grounds of appeal (Lord Justice Warby and Lady Carr of Walton-on-the-Hill CJ agreed.)
Ground 1 – was there an act by the foreign state in the United Kingdom?
The first ground of appeal was that the judge in the court below was wrong to hold that the alleged acts of computer surveillance took place in the UK rather than abroad. Lord Justice Males considered that as a straightforward use of language, remote manipulation from abroad of a device on UK soil was an act within the UK. At [34] he stated:
"The true position in such a case is that the agents of the foreign state commit acts both in this country and abroad. To distinguish between what happens abroad and what happens here, characterising the former as an act and the latter as merely the effect of the act, is artificial and unprincipled. The reality is that a foreign state which acts in this way is interfering here with the territorial sovereignty of the United Kingdom."
He agreed with Mr Justice Julian Knowles that what was said in R v Governor of Brixton Prison, ex parte Levin and Ashton Investments Ltd v OJSC Russian Aluminium (Rusal) was helpful. However, Lord Justice Males was careful to emphasise that this was not because those cases set out applicable legal principles – and it would be dangerous to incorporate principles of extradition law or the procedure governing service out of the jurisdiction, into the context of state immunity. These cases were helpful because they demonstrate on comparable facts that to characterise the act of hacking as taking place in the UK is a natural and appropriate use of language. In Levin an applicant had used his personal computer in St Petersburg to access a US bank's computer at Parsipenny in the state of New Jersey in order to transfer funds into bank accounts controlled by him. The US sought his extradition from the UK. The applicant argued that the appropriate of funds had taken place in Russia where his keyboard was situated and therefore the English courts had no jurisdiction. The Divisional Court rejected this. In the present case, the essence of what Bahrain's agents are alleged to have done was done in the UK where the claimants' devices were hacked. In modern terms, the hacking of a person's computer was equivalent to burglars breaking into someone's home and stealing the contents of their safe.
On the statutory interpretation points arising out of this ground, Lord Justice Males found that The Computer Misuse Act 1990 was of no assistance in interpreting section 5 of the State Immunity Act 1978. Firstly, the contents of the two Acts were completely disparate. Secondly, the Computer Misuse Act was passed 12 years after the 1978 Act. As such, the way in which Parliament chose to legislate for computer misuse in the 90's could shed no light on whether section 5 was engaged in circumstances where a computer in the UK was hacked from overseas.
Ground 2 – must all the acts by agents of the foreign state take place in the United Kingdom?
The second ground of appeal was that the exception to immunity in section 5 of the 1978 Act required that each and every act or omission causing injury that formed the basis of liability must occur in the United Kingdom. On appeal, it was held that the language of section 5 was clear in this respect. A foreign state did not have immunity for personal injury caused by an act in the UK even if other causative acts took place outside of the UK. Since the provision was deemed to be unambiguous – there was no scope to arrive at an alternative interpretation based on external aids put forward by counsel for the appellant. The claimants' interpretation of section 5 was in line with the fundamental principles of international law on which state immunity was based. Lord Justice Males stated powerfully, at [55]:
"Accordingly, if State A interferes with the territorial sovereignty of State B by doing an act in State B which is liable to cause death or personal injury to persons in State B, it takes the risk that it will be subject to civil proceedings in State B. Such proceedings are in accordance with principles of international comity."
Ground 3 – was psychiatric injury "personal injury" within the meaning of section 5?
In my view, the outcome on ground three is not surprising. The appellant had accepted that there would be no immunity for an act in the United Kingdom causing psychiatric injury if this was associated with physical injury but proposed that "standalone" psychiatric injury did not fit the meaning of "personal injury" in section 5 of the 1978 Act. The respondent's position was accepted as the correct one, that being the application of the "always speaking" principle, i.e. section 5 of the 1978 Act should not be tied to concepts of "personal injury" as they were understood in 1978. The Court of Appeal accepted the nub of the respondent's position, seeing no reason to suppose that section 5 of the 1978 Act was intended to be "tied to an historic or frozen interpretation". Moreover, the court recognised that the law of state immunity was undergoing flux.
What next?
The conclusion of this appeal is that the court has jurisdiction to hear the claim, as Bahrain cannot claim state immunity. My favourite part of the judgment is Lord Justice Warby's astute concluding remarks, arguably the most intriguing part of the decision [120]:
"A claim for damages for harassment by spying is unusual. At first sight it seems paradoxical. A course of conduct cannot amount to harassment of another unless it comes to their attention and has an impact upon them. Commonly, that is what the perpetrator intends. Spies, on the other hand, typically act surreptitiously, hoping and intending that their activities will go undetected by the target." He notes that such a claim is not unprecedented (Al-Masarir).
Whilst we await further developments in this line of case law, the appeal stands as a useful touchstone on complex issues of international comity in a personal injury landscape.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
