Over the past years, Bahraini authorities have increasingly relied on digital surveillance and spyware as tools to target political dissidents, human rights defenders, and journalists, both inside Bahrain and abroad. These practices have been closely linked to campaigns of arrests, prosecutions, and arbitrary sentences affecting dozens of citizens, while opportunities to hold those responsible accountable have remained extremely limited due to the lack of effective remedies within the country.
However, this reality witnessed an unprecedented development on 27 July 2026, when the United Kingdom Supreme Court issued a landmark ruling rejecting the Kingdom of Bahrain’s attempt to invoke sovereign immunity to dismiss a legal claim brought by two Bahraini dissidents residing in the UK, who accuse the Bahraini authorities of hacking their electronic devices using the spyware program FinSpy.
The ruling does not mean that the court has established Bahrain’s responsibility for the alleged spyware operation, as the court has not yet begun examining the substance of the allegations. However, it represents a significant legal victory, as it removes the obstacle that Bahrain sought to use for years to prevent the case from being heard in the first place. Therefore, for the first time, the ruling opens the way for the examination of evidence and facts related to the use of spyware against Bahraini dissidents before British courts.
The significance of this ruling extends beyond this case alone. It sends a clear message that the use of technology to target dissidents abroad should not provide immunity from accountability, and that states cannot rely on the transnational nature of cyberattacks to evade judicial scrutiny. It also offers victims of digital surveillance real hope that they can seek justice before independent courts when avenues for redress are closed in their own countries.
The importance of the ruling is not limited to the Bahraini case. It is among the first rulings issued by the UK’s highest court that directly address the relationship between the traditional doctrine of sovereign immunity and violations arising from the use of cross-border digital surveillance tools, at a time when such technologies have become one of the primary means of targeting journalists, human rights defenders, and political dissidents in exile.
A Case Spanning More Than a Decade
The case dates back to 2011, when Dr. Said Al-Shehabi, a Bahraini journalist and political activist who has lived in the UK since 1973 and holds British citizenship, and Moosa Mohamed, a Bahraini photographer and human rights activist who has lived in the UK since 2006, alleged that the Bahraini authorities used the FinSpy spyware to hack their laptop computers while they were in the UK.
According to the claim, the spyware enabled its operators to access files and data stored on the devices, intercept text, voice, and video communications, and remotely activate cameras and microphones, allowing them to monitor the claimants’ activities comprehensively without their knowledge or consent. The claim further alleges that the intrusions were carried out from outside the UK, while the targeted devices were located within the country, with the spyware operated through a server based in Bahrain.
The claimants did not discover that their devices had been compromised until 2014, following the publication of information about FinSpy by WikiLeaks and Bahrain Watch. They argued that learning they had been subjected to continuous surveillance caused them significant psychological harm. On that basis, they brought their claim under the UK’s Protection from Harassment Act 1997, seeking compensation for the psychiatric harm resulting from being subjected to ongoing surveillance without their knowledge.
This case does not arise in isolation from the broader situation in Bahrain. For years, international and local human rights organizations have documented the Bahraini authorities’ use of digital surveillance to target journalists, human rights defenders, and political dissidents as part of a wider policy of restricting freedom of expression and suppressing critical voices both inside and outside the country.
How Did Bahrain Attempt to Block the Case?
Since the claim was filed before the High Court in London in 2020, the central issue at this stage was not whether Bahrain had in fact used the FinSpy spyware, but a prior legal question: did the UK courts have jurisdiction to hear the claim in the first place?
Bahrain relied on the doctrine of sovereign immunity, a legal principle that generally protects foreign states from being sued before the courts of other states. Invoking the UK State Immunity Act 1978, Bahrain argued that the alleged hacking operation, if it occurred, was carried out from outside the UK, and that, as a result, UK courts lacked jurisdiction to hear the claim.
Had the Court accepted this argument, the case would have ended before it truly began, and the claimants would never have had the opportunity to present evidence or argue the facts before the court. In other words, Bahrain sought to have the claim dismissed on the basis of sovereign immunity without the Court ever examining the spyware allegations.
Accordingly, the Court was not asked at this stage to determine whether the spyware allegations had occurred or whether Bahrain was responsible. Rather, it was asked to resolve the preliminary question of whether the claim could be heard before the British courts.
However, this argument was rejected at every stage of the proceedings. It was first rejected by the High Court in London, a decision that was upheld by the Court of Appeal in 2024. Bahrain then appealed to the UK Supreme Court, the highest judicial body in the country, seeking to overturn the earlier rulings and maintain its claim to sovereign immunity. In its judgment of 27 July 2026, the UK Supreme Court rejected Bahrain’s appeal by a majority of three to two, confirming that sovereign immunity does not bar the continuation of the case.
Why Did the UK Supreme Court Reject Sovereign Immunity?
From the outset of the case, Bahrain argued that UK courts lacked jurisdiction to hear the claim because the individuals alleged to have carried out the hacking were located outside the UK. According to this argument, the alleged conduct did not occur within UK territory and Bahrain was therefore entitled to sovereign immunity, preventing it from being sued before UK court.
The UK Supreme Court rejected this interpretation, affirming the conclusions previously reached by both the High Court and the Court of Appeal. It held that Bahrain could not invoke sovereign immunity to prevent the claim from proceeding. The Court found that the UK State Immunity Act 1978 contains an exception allowing British courts to hear claims relating to personal injury sustained within the UK.
In this case, the Court concluded that the harm alleged by the claimants, including the psychological harm resulting from continuous surveillance, occurred while they were present in the UK. It also confirmed that the Act does not require the person responsible for the conduct to have been present in the UK, and that reading such a requirement into the legislation would have no basis in either the text of the Act or Parliament’s intent.
The Court also rejected Bahrain’s argument that the location of those who carried out the alleged hacking was the decisive factor, emphasizing that technological developments require a different understanding of digital violations. A cyberattack may be launched from outside a country while targeting individuals and devices located within it and causing harm there. Accordingly, the fact that those responsible for the alleged hacking were outside the UK does not prevent the conduct from being regarded as having occurred within the UK for the purpose of applying the law.
The ruling does not mean that the Court has established the truth of the spyware allegations or Bahrain’s responsibility for them. Those issues remain to be decided and will be examined during the next stage of the proceedings. What the ruling does is remove the legal obstacle Bahrain had relied upon for years to prevent the case from being heard, opening the way for the examination of the technical evidence and the parties’ arguments before the British courts.
A Ruling Setting Limits on Transnational Digital Repression
The significance of this ruling extends beyond the scope of this case, as it establishes one of the first judicial precedents to directly address the relationship between sovereign immunity and transnational digital violations. Had the court accepted Bahrain’s argument, any state could have been able to conduct cyber espionage operations against journalists, dissidents, or human rights defenders residing abroad, and then invoke the fact that those responsible for the intrusion were located outside the targeted state to evade accountability.
Therefore, the importance of this ruling extends beyond a legal dispute between two parties; it addresses one of the most pressing human rights issues of the digital age: can states use technology to target their opponents beyond their borders without being held accountable?
Over the past decade, human rights organizations and digital security experts have documented the growing use of commercial spyware to target journalists, human rights defenders, and political dissidents in exile. These tools enable access to personal files, interception of communications, and the remote activation of cameras and microphones, effectively turning phones and computers into tools of continuous surveillance.
This pattern of violations has become known as “transnational repression,” as it is not limited to persecution within a state’s borders, but extends to monitoring, threatening, and interfering with the activities of dissidents even after they have left their countries. Digital surveillance is not merely a violation of privacy; it also restricts freedom of expression and human rights work, instills fear among victims and their sources, and undermines civil society’s ability to document violations and communicate with victims. This pattern of violations is not limited to digital surveillance, but also includes intimidation, targeting family members, indirect pressure, and other methods used to silence critical voices even after they have left the country.
In this context, the UK Supreme Court’s refusal to allow Bahrain to invoke sovereign immunity represents an important step toward narrowing the space for impunity and ensuring that the cross-border nature of technology does not become a means of obstructing victims’ access to justice.
More Than a Spyware Case… A Test of State Accountability
The ruling issued by the UK Supreme Court represents an important legal milestone in the course of the case, but it does not resolve the dispute. The court must still examine the substance of the claim, assess the technical and digital evidence, determine whether the intrusion actually occurred, identify those responsible, and establish whether it gives rise to legal liability.
Nevertheless, the importance of the ruling lies in its affirming of a crucial principle: sovereign immunity must not become a shield preventing states from being held accountable for transnational digital violations. It also sends a message to victims that the use of technology to target them does not necessarily make access to justice impossible, even when domestic remedies in their own countries are unavailable.
The impact of this ruling is likely to extend to future cases concerning the use of government spyware and cross-border cyberattacks, including claims brought by journalists, human rights defenders, and political dissidents living abroad. This may contribute to narrowing the space for impunity in the digital sphere.
The claimants welcomed the ruling, considering it an important turning point in the course of the case and a message that extends beyond their personal dispute. Dr. Said Al-Shehabi stated: “This is not only a victory for us, but for everyone targeted by authoritarian states beyond their borders. The court’s message is clear: states that violate human rights on British soil will be held accountable.” Moosa Mohamed added: “The era of abusing victims while hiding behind state immunity is over.”
Human rights organizations and experts also welcomed the ruling, considering it an important legal precedent in addressing the use of government spyware against dissidents and activists in exile. Ida Aduwa, a lawyer at Leigh Day, which represents the claimants, described the ruling as opening an important legal discussion on state responsibility for the use of intrusive surveillance technologies against human rights defenders and civil society members abroad, emphasizing that technological advancement should not provide states with a new means of evading accountability.
For its part, Americans for Democracy & Human Rights in Bahrain (ADHRB) affirms that this ruling represents an important step toward limiting impunity for transnational digital violations and sends a clear message that the use of spyware against activists and dissidents must not remain beyond judicial scrutiny.
The organization calls on Bahraini authorities to cease the use of surveillance and spyware technologies against human rights defenders, dissidents, and journalists, ensure respect for the rights to privacy and freedom of expression, and conduct an independent investigation into all allegations of digital surveillance and hold those responsible accountable. It also urges UK authorities to continue ensuring victims’ access to justice and to prevent sovereign immunity from being used as a means of evading accountability for serious human rights violations.
