Bahraini agents operating remotely from outside the UK infected the computers of pro-democracy activists in London. The activists (Shehabi and Mohammed) brought a claim in the tort of harassment alleging they suffered psychiatric injury upon learning they had been spied upon. Bahrain alleged that its actions were protected under the English State Immunity Act 1978 (the Act). Shehabi and Mohammed argued state immunity was disapplied by reason of section 5 of the Act: “A State is not immune as respects proceedings in respect of (a) death or personal injury; or (b) damage to or loss of tangible property, caused by an act or omission in the United Kingdom”. Shehabi and Mohammed succeeded in establishing that Bahrain was not entitled to state immunity by reason of section 5 of the Act.

The activists won because the English Court of Appeal held that a statute was “always speaking”, in other words that a statute is not frozen in time at the date of its enactment but – absent compelling reasons to the contrary – should be interpreted to take into account changes that have occurred since its enactment including in respect of technology and the law. Consequently, even if in 1978 English law did not recognise standalone psychiatric injury as a form of personal injury, developments in English law post-1978 made it clear that standalone psychiatric injury fell within personal injury. Section 5 should be interpreted consistent with those developments such that today standalone psychiatric injury fell within the phrase “personal injury” in section 5 of the Act. The Court of Appeal also found as a fall-back that in any event in 1978 English law did recognise standalone psychiatric injury as a form of personal injury and rejected an attempt to rely on unpublished “Notes on Clauses” formulated by government officials and provided to ministers as an aid to statutory interpretation (albeit it was clear the Court would have permitted reliance on official Explanatory Notes published on the passing of an act).

The Court of Appeal further rejected an argument that the acts of the Bahraini agents were not acts “in the United Kingdom”. The Court held that infecting computers in the UK by agents outside the UK were acts committed both within the UK (albeit remotely) and abroad such that section 5 was engaged. The Court noted Ashton Investments v Rusal  where claims in breach of confidence, unlawful means conspiracy and unlawful interference in business were held able in principle to fall within a service out gateway requiring an act to have taken place in the UK. In Rusal  the allegation was that the defendants in Russia had hacked the claimant’s computer system in London to gain confidential and privileged information.

Shehabi v Bahrain  is not simply a case for aficionados of 007 or John Le Carré – in its consideration of statutory interpretation and analysis of remote actions by malevolent cyber actors, the case provides useful authority for commercial claims, particularly in unlawful means conspiracy where cyber activity often spans multiple jurisdictions.