UK Court Rejects Bahrain's Sovereign Immunity Claim in Spyware Lawsuit
The UK Supreme Court has ruled that Bahrain cannot use sovereign immunity to block a lawsuit alleging state-sponsored hacking and the use of spyware against dissidents.
In a landmark decision, the United Kingdom's Supreme Court has denied Bahrain's claim of sovereign immunity, allowing a lawsuit to proceed against Bahraini officials accused of using sophisticated spyware to target dissidents. The ruling, delivered on Monday, permits two individuals, Saeed Shehabi and Moosa Mohammed, to pursue damages for alleged mental harm suffered due to the Bahraini government's actions.
Shehabi and Mohammed, who reside in the UK, allege that Bahraini government agents secretly installed FinSpy spyware on their laptops, likely around 2011. This alleged intrusion allowed officials to monitor their activities, including communications with Bahraini political prisoners, journalists, and torture victims. The court's opinion detailed that the hacking provided "access to and exfiltration of information on the computers, interception of communications conducted using the computers and use of the computers’ microphones and cameras to surveil the respondents."
The court found that this "course of conduct, which involved monitoring the respondents’ activities on a wide-ranging basis and by highly intrusive means" constituted illegal harassment. The claimants reportedly discovered the spyware infection around August 2014, alerted by reports from WikiLeaks and a Bahraini watchdog organization. The Bahraini government has consistently denied the hacking claims and appealed to the UK Supreme Court last year to uphold its assertion of state immunity.
However, the Supreme Court's 3-2 decision determined that because the alleged hacking occurred within the UK, Bahrain's claim of sovereign immunity does not apply. This ruling is significant as it potentially opens the door for individuals to hold states accountable for cyber operations conducted extraterritorially.
FinSpy, also known as FinFisher, is a potent spyware tool described by The Citizen Lab as "sophisticated" and "sold exclusively to governments for intelligence and law enforcement purposes." The company behind FinFisher declared insolvency in 2022 amidst investigations into its business practices.
Moosa Mohammed sought refuge in Britain in 2006 after facing arrest and torture in Bahrain. Saeed Shehabi, a longtime pro-democracy activist and journalist who has lived in the UK since 1973, has been a prominent figure in Bahrain's opposition movement. Shehabi has previously described his legal battle as an example of "the psychological torture that authoritarian regimes exercise transnationally."
This legal precedent could have far-reaching implications for international cybersecurity law, potentially weakening the shield of sovereign immunity for states engaged in covert digital surveillance and hacking operations against individuals within other jurisdictions. The case underscores the growing challenges in attributing and prosecuting state-sponsored cyber activities.