U.K. Supreme Court Opens Door for Spyware Victims to Sue Foreign States
UK Supreme Court ruled Bahrain not immune from spyware litigation, letting two dissidents pursue claims over FinSpy hacking; case returns to the High Court.
The UK Supreme Court ruled in The Kingdom of Bahrain v. Shehabi that Bahrain is not immune from litigation over its alleged use of FinSpy spyware against two Bahraini dissidents living in the UK. Citizen Lab researchers Siena Anstis, Natalia Krapiva, and Kate Pundyk, writing in Lawfare, called the decision a milestone for accountability in transnational repression. The case now returns to the UK High Court, where attribution, causation, and injury must be proven.
- Court removed state immunity as a defense for foreign states' spyware hacking claims.
- Case returns to the UK High Court where attribution, causation, and injury must be proven.
- Citizen Lab authors call the ruling a meaningful victory against digital transnational repression.
Full article220 words · extracted from citizenlab.ca · click to collapse
Opens in a new window
Opens an external site
Opens an external site in a new window
Date Published
September 2, 2026
Last month, the Supreme Court of the United Kingdom issued a highly anticipated decision in The Kingdom of Bahrain v. Shehabi and another (Shehabi). The claimants, two Bahraini dissidents living in the U.K., allegedly suffered psychological harm after Bahrain used FinSpy spyware to hack into their devices. In an important step towards accountability, the court ruled that Bahrain was not immune from litigation arising from the use of the spyware.
Citizen Lab researchers Siena Anstis, Natalia Krapiva, and Kate Pundyk write in Lawfare that this decision is significant for transnational repression. Cross-border hacking is a growing concern, and seeking a remedy is difficult. The Shehabi ruling “provides exiles in the U.K. with greater certainty that claims against foreign states for spyware hacking will be viable at the jurisdictional stage, opening substantive pathways for victims to obtain redress,” according to the authors.
The case will return to the U.K. High Court of Justice, where attribution, causation, and injury must be proven. However, the authors write that “by removing the blunt defense of state immunity from these cases, the U.K. Supreme Court has dealt a meaningful victory to individuals and organizations fighting spyware and other forms of digital transnational repression.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://citizenlab.ca/uk-supreme-court-opens-door-for-spyware-victims-to-sue-foreign-states/