Crossing Digital Borders: The English Court of Appeal's Ruling in Shehabi v Bahrain

The English Court of Appeal has recently handed down judgment in Shehabi & Anor v Kingdom of Bahrain [2024] EWCA Civ 1158 (Shehabi), affirming the first instance decision to apply the exception to state immunity in section 5 of the State Immunity Act 1978 (the SIA 1978). Notably, this is the highest appellate decision to date that treats hacking initiated abroad as an act 'in' the UK for the purposes of the SIA 1978.

This judgment also has relevance beyond the specific issue of state immunity. It holds implications for individuals and organisations with a significant digital footprint, or those whose online activities have a significant effect within the UK, even if they are operating from abroad. The decision signals a pragmatic approach from the English courts to what may otherwise be a highly technical question: where does a digital act take place if the 'start' and 'end' points are in different states?

BACKGROUND

In 2022, the claimants sought to bring a claim against the Kingdom of Bahrain under the Protection from Harassment Act 1997 for alleged hacking of their computers. In the High Court, the judge found on the basis of expert evidence that the claimants had discharged the burden of proof that their computers had been infected by spyware by Bahrain's "servants or agents", who infected the Claimants' laptops with the spyware program 'FinSpy'.  This permitted the state to access much, if not all, of the data processed on those laptops, including eavesdropping via the laptops' microphones and cameras.  The Claimants alleged that they suffered personal injury as a result, in the form of psychiatric injury.

On jurisdiction, the High Court rejected Bahrain's claims that it was entitled to immunity from civil proceedings. Bahrain challenged this ruling, bringing the matter before the Court of Appeal. The appeal focused on the interpretation of section 5 of the SIA 1978, which provides an exception to state immunity for proceedings brought in respect of personal injury. Bahrain also appealed the High Court's finding that the claimants' psychological injuries, such as anxiety and adjustment disorders, qualified as personal injuries under section 5, thus denying Bahrain immunity.

This issue of whether states can claim immunity under the SIA 1979 in cases of state-sponsored hacking had been addressed in a previous case, Al-Masarir v Saudi Arabia [2022] EWHC 2199 (Al-Masarir), presided over by the same first instance judge. However, since Saudi Arabia's appeal was dismissed for a failure to comply with a security costs order, Shehabi is the first case on similar facts to reach the Court of Appeal.

S5 STATE IMMUNITY ACT 1978

Section 5 State Immunity Act 1978 provides an exception in the following form:

                         5.           Personal injuries and damage to property.

                                       A State is not immune as respects proceedings in respect of—

                                           (a) death or personal injury; or

                                           (b) damage to or loss of tangible property,

                                       caused by an act or omission in the United Kingdom.

The key issue in Shehabi is the correct interpretation of section 5 of the SIA 1978 and the scope of the exception to state immunity in cases of personal injury under English law. Unlike the approach taken by Saudi Arabia in Al-Masarir, Bahrain did not argue that its actions were purely sovereign in nature and therefore exempt from section 5. This is because section 5 has previously been held to apply irrespective of such an argument, focusing solely on whether acts took place in the UK and caused personal injury.

Instead, Bahrain argued that:

1. 1. The alleged spying did not take place in the UK because the hacking was perpetrated abroad. Thus, the acts did not fall under section 5 SIA 1978 but rather within Bahrain's exclusive jurisdiction. Consequently, for a UK court to decide the matter would violate the principle of sovereign equality and the jurisdiction which flows from it, which are safeguarded by the principle of state immunity. As a result, state immunity remains and should prevent UK courts from having jurisdiction.  
   2. In the alternative, even if the court determined that the spying took place, at least in part, within the UK, section 5 of the SIA 1978 would only apply if all of the acts complained of occurred within the UK. Since the alleged hacking was initiated in Bahrain, section 5 does not apply to conduct perpetrated in this manner.
   3. As a further alternative, the 'standalone' psychiatric injury complained of does not constitute personal injury under section 5 SIA 1978 and thus English courts lack jurisdiction.

decision – 'always speaking' plain language?

On each of the three issues, the Court of Appeal emphasized that the fundamental approach to statutory interpretation should be based on the 'clear and unambiguous' statutory language, taking into account any societal and legal changes since the law was passed – a concept known as the statute 'always speaking'.

For example, in relation to the first issue, the court's conclusion that Bahrain's agents committed acts in the UK and abroad was not based on the intricate technical details of how the hacking was carried out, but rather on a straightforward reading of the language used in the SIA 1978. Similarly, on the second issue, the Court found that section 5 did not require acts to take place solely in the UK — again based on the 'plain and ordinary meaning' of the statute. As Males LJ emphasised:

…the English proceedings will be concerned with the act of infecting the claimants' computers within the United Kingdom. The fact that the agents who caused this to happen were located in Bahrain at the time, if that proves to be the case, is immaterial.

The Court also made clear that the appeal would fail even if psychiatric injury had been the only effect of the state's acts, finding that both English legal precedents and the international understanding of 'injury' have evolved over the past few decades to recognize that a diagnosed psychiatric illness is indeed a form of personal injury.

COMMENT

In this case, the Court of Appeal found the hacking to be an act within the UK based on a straightforward interpretation of the SIA 1978. However, the precise location of a digital act can be ambiguous in other contexts, such as where no relevant statute is available, and this, in turn, may give rise to complex jurisdictional questions. This broader issue is currently being explored by the Law Commission in its report on Digital assets and Electronic Transfer Documents in private international law: which court, which law? For example, the Law Commission has noted in this context the particular challenges in pinpointing the geographical location of activities related to virtual asset trading platforms. While the pragmatic approach in Shehabi offers some potential guidance on these complex jurisdictional issues, many questions remain open.

Shehabi may also be relevant to claimants seeking permission to serve claim forms out of the jurisdiction. Although it recognised that the context of state immunity is very different, the court drew on Ashton Investments Ltd v OJSC Russian Aluminium (Rusal) [2006] EWHC 2545 (Comm), in which the defendants – in Russia – had allegedly hacked into the claimant's computer system in London to obtain confidential information. The claimant in that case needed to demonstrate that the harm occurred within the UK or was the result of actions taken within the UK in order to be able to serve the claim form on the Russian defendants under the Civil Procedure Rules. The High Court found that 'the attack emanated from Russia but [was] directed at the server in London and that is where the hacking occurred', and accordingly permitted service out of the jurisdiction. Such 'natural and appropriate use of language' was approved by the Court of Appeal in this case and offers scope for future claimants to bring English court proceedings where hacking is directed at infrastructure in England and Wales.