At the end of November 2025, the UK Supreme Court will examine a sensitive case that combines espionage, individual rights and diplomatic law: two Bahraini dissidents, now living in London, claim that in 2011 the Kingdom of Bahrain infiltrated their computers using malicious software, with the aim of exploiting their ideas and violating their rights and they seek damages for the moral harm caused by these actions. But Bahrain invokes state immunity, meaning a foreign state generally cannot be sued in British courts. The outcome of this trial could redefine the boundaries of state responsibility in cases of transnational digital surveillance.
The accusations: what the dissidents allege against Bahrain
Moosa Mohammed and Dr Saeed Shehabi claim that in September 2011 their laptops, which were located in London, were infected with spyware known as FinSpy, software they attribute to the Bahraini government. According to them, the program allowed agents to access their files, communications and emails, and remotely activate the devices microphones or cameras to monitor their activities.
They argue that their privacy was stolen, and the infiltration remained secret for years they did not become aware of it until 2014, when public revelations about similar surveillance affecting journalists exposed the wider scope of the spying. That discovery inflicted a psychological shock with lasting consequences.
They now seek compensation for what they describe as “personal injury”: anxiety, a sense of violated privacy, stress, and trauma resulting from being surveilled without consent. They consider these harms serious and deserving of judicial redress.
The legal framework: when state immunity is challenged
At the heart of this case lies the UK’s State Immunity Act 1978 (SIA 1978), which generally grants immunity to foreign states from being sued in UK courts.However, the Act contains a key exception: when an act committed “in the United Kingdom” causes “personal injury,” the state is not immune.
In this case, lower courts ruled that remotely installing spyware on computers physically located in the UK counts as an “act in the United Kingdom.” Furthermore, they recognised that the psychological harm suffered upon learning of the surveillance qualifies as “personal injury.” Therefore, under those rulings, state immunity would not apply to Bahrain’s case.
Why the case is now before the Supreme Court: key issues and
stakes
After the High Court’s decision in 2023 and the confirmation by the Court of Appeal in 2024 that Bahrain’s immunity claim fails, the kingdom has appealed to the Supreme Court. The Supreme Court must decide whether a digital act executed remotely from abroad, but having effects on devices located in the UK, can legally be considered an act “in the United Kingdom.”
The Court must also determine whether psychological suffering anxiety, stress, violation of privacy qualifies as “personal injury” under the statute’s exception. So far, lower courts have answered affirmatively. The verdict expected on 26–27 November 2025 could set a landmark precedent for many future cyber-surveillance cases involving foreign states and activists living abroad.
Broader stakes: digital surveillance, human rights and state
accountability
If the Supreme Court confirms that UK courts can hear such cases, it would establish that states can be held accountable abroad for acts of digital surveillance committed remotely provided the victims reside in the UK. This would offer recourse to dissidents, journalists,activists and exiles targeted by oppressive regimes.
Such a ruling would likely deter authoritarian governments from deploying spyware tools like FinSpy (or others) against political opponents abroad, knowing they could face damage claims. It would send a strong message in favour of privacy, freedom of expression and protection for political dissidents.Conversely, if state immunity is reaffirmed, it could legitimise systematic transnational surveillance, offering little protection to victims and
marking a serious setback for the defence of individual rights under digital repression.
The judgment before the Supreme Court confronts two principles in tension: the traditional doctrine of state immunity and the modern reality of digital surveillance that crosses borders.The decision could transform how international law addresses cyberintrusions, and reshape the possibility of justice for victims of transnational surveillanc