Professor Philippa Webb KC has represented two human rights activists in a landmark Supreme Court case concerning the alleged use of spyware by a foreign state.
On 27 July 2026, the Supreme Court dismissed Bahrain’s claim to state immunity in Kingdom of Bahrain v Shehabi and Mohammed [2026] UKSC 25. The ruling is the first by a leading national court to find that a foreign state is not immune from legal claims alleging the use of spyware.
Professor Webb represented the claimants in the Supreme Court, the Court of Appeal and the High Court.
The claimants are Dr Shehabi, a journalist, activist and founder of the Bahraini pro-democracy organisation Al Wefaq, and Mr Mohammed, a photographer, videographer and human rights activist. Both have been granted asylum and live in the UK. They allege that servants or agents of Bahrain hacked their computers using the spyware programme FinSpy. They say the alleged hacking amounted to harassment and caused them psychiatric injury.
Under the State Immunity Act 1978, foreign states are generally immune from the jurisdiction of English courts. However, section 5 of the Act provides an exception for cases involving personal injury or damage to tangible property caused by an act or omission in the UK.
By a majority, the Supreme Court held that this exception applied. It concluded that legally significant acts had taken place in the UK, meaning Bahrain could not rely on state immunity to prevent the claims from being heard.
The judgment is likely to be closely examined in other countries with similar legislation, including Australia, China, Singapore, South Africa and Malawi.
Professor Webb said:
“For victims of spyware, the greatest obstacle is often not proving that harm occurred, but finding a forum able to hear their claim. This judgment shows that state immunity does not automatically close the courthouse door.”
The case also highlights a wider challenge being examined by the Oxford Institute of Technology and Justice – a partnership between the Blavatnik School of Government and Clooney Foundation for Justice. Although governments regularly respond to malicious cyber operations through political and diplomatic channels, legal accountability often falls behind.
The Institute’s policy brief 'Legal Accountability for Malicious Cyber Operations' considers how courts, fact-finding processes, attribution and evidence-sharing mechanisms could help strengthen accountability for cyber harms.
The case will also be relevant to the Institute’s forthcoming Cyber Litigation Atlas – an interactive global platform mapping litigation involving spyware, hacking, digital surveillance and other cyber harms. By comparing legal routes across different jurisdictions, the Atlas is intended to support victims, practitioners, courts and policymakers seeking meaningful remedies.
Recent news
