Dr Saeed Shehabi & Anor v The Kingdom of Bahrain

This case is principally about state immunity. The Claimants have sued the Defendant, the Kingdom of Bahrain, for damages for personal injury in the form of psychiatric injury which they say they suffered as a result of the infection of their laptop computers with spyware by the Defendant, which enabled it to conduct surreptitious surveillance on them.

The Defendant applies for an order declaring that: (a) it is immune from the jurisdiction of this Court in relation to the Claimants’ claims, pursuant to s 1(1) of the State Immunity Act 1978 (SIA 1978); (b) alternatively, an order setting aside the relevant parts of the orders of Master Sullivan dated 30 November 2020 and 22 February 2021, by which leave to serve out of the jurisdiction was granted; (c) in either case, declaring that the Court does not have jurisdiction to hear the claims, and dismissing the claims for want of jurisdiction. The hearing on 22 February 2022 was listed only to hear and decide on the state immunity issue.  (The other procedural issues and matters may need to be resolved at a later date should the case proceed with which I am not concerned.)

Section 1(1) in Part 1 of the SIA 1978 Act is headed ‘General immunity from jurisdiction’ and provides:

“A State is immune from the jurisdiction of the courts of the United Kingdom except as provided in the following provisions of this Part of this Act.”

The effect of this provision is that in order for a state to be subject to the jurisdiction of the courts of the UK, the proceedings must be of a kind specified in the exceptions to immunity listed at ss 2 to 11 of the SIA 1978. If none of those exceptions apply then the court lacks jurisdiction: Jones v Ministry of the Interior of the Kingdom of Saudi Arabia [2007] 1 AC 270, [9]; Benkharbouche v Embassy of the Republic of Sudan [2019] AC 777, [39].

Relevant for present purposes is s 5, which provides:

“5.

A State is not immune as respects proceedings in respect of –

(a)

death or personal injury; or

(b)

damage to or loss of tangible property,

caused by an act or omission in the United Kingdom.”

It is common ground that the burden of proving that the claim falls within s 5 as one of the exceptions to the immunity provided by s 1 lies on the Claimants and not the Defendant. At this stage it will not suffice for the Claimants to show a ‘good arguable case’. The question of whether the exception applies is to be determined on the balance of probabilities as a preliminary issue: JH Rayner (Mincing Lane) Ltd v Department of Trade and Industry [1989] Ch 72, 193-194 (Kerr LJ) and 252 (Ralph Gibson LJ), applied in London Steam Ship Owners' Mutual Insurance Associated Limited v Kingdom of Spain [2020] 1 WLR 4943, 4956 at [30] per Henshaw J. See also Al-Adsani v Government of Kuwait(No 2) (1996) 107 ILR 536, 545.

This judgment covers some similar (but not identical) territory to that which I addressed in Al-Masarir v Kingdom of Saudi Arabia [2022] EWHC 2199 (QB). Readers may find it helpful to consider the two judgments together. The bundles in this case are very lengthy. Both cases raise (or raised) some difficult legal and factual issues.

The Claimants maintain that the Defendant’s servants or agents, likely operating remotely from outside the UK, hacked – or infected – their computers with a spyware program called ‘FinSpy’ whilst they and their computers were in the UK; that this amounted to harassment under the Protection from Harassment Act 1997; that they suffered psychiatric injury as a consequence; that this amounts to personal injury within s 5 of the SIA 1978; and therefore the Defendant is not immune.

Spyware is a type of computer program which allows a remote operator to take control of a target’s device (eg, their computer or mobile phone) and then to use that device to carry out surreptitious remote eavesdropping and surveillance of the target by the collection and transmission to a remotely located server of video, audio and data. The spyware program is usually deposited on the target’s device by them unwittingly opening an infected email or attachment that has been sent by the remote operator. FinSpy is one such program. It is produced by a company called Gamma Group (also known as FinFisher).

In this case, [15] of the Claimants’ Skeleton Argument asserts that:

“15.

The operation of that spyware resulted in the covert and unauthorised accessing by the Defendant of the Claimants’ information stored on, or communicated or accessible via their laptops. This has enabled the Defendant to collect much, if not all, of the data processed on the laptops, including messages, emails, calendar records, instant messaging, contacts lists, browsing history, photos, databases, documents and videos. It has also permitted the Defendant to track the location of the Claimant via their laptops and to intercept calls made on them. It has permitted the surveillance of the Claimants by covert use of the laptops’ microphones and cameras …”

The Defendant denies hacking and makes a reservation in relation to attribution (Defendant’s Skeleton Argument at [22]-[24]).

The first witness statement of Magnus Boyd, the Defendant’s former solicitor, dated 28 September 2021, stated at [4] that the application regarding jurisdiction:

“ … does not engage in any way or require consideration of the merits (if any) of the Claimants’ claims. Accordingly, I do not respond to the substance of those claims, or the Claimants’ evidence in support of them, in this witness statement. However, the Kingdom of Bahrain’s position as regards state immunity and the appropriateness of the EoT [extension of time] Orders is expressly without prejudice to points that The Kingdom of Bahrain may later raise in these proceedings, if contrary to its position the English Court has jurisdiction over the claims, and the Kingdom of Bahrain is required to defend them in due course. In particular, The Kingdom of Bahrain reserves its position as to whether the claims ought to be dismissed or struck out for other reasons, even if the Court has jurisdiction over them.”

Obviously, therefore, the following factual summary is not agreed.

The First Claimant is a pro-democracy activist and journalist. He is a leader of the Bahrain Freedom Movement and founder of a Bahraini pro-democracy organisation called Al Wefaq. Since 1973, and at all times material to his claim, he has lived in the UK. He was granted asylum in 1985 and British citizenship on 14 June 2002. In exile he is a leading figure in the Bahraini opposition movement.

The Second Claimant was born in Bahrain on 5 March 1981. He is a photographer and videographer and an activist for human rights and democracy in Bahrain. Since 2006, and at all times material to this claim, he has lived in the UK, where he was granted refugee status on 7 August 2007. He has been granted indefinite leave to remain in the UK.

In support of their hacking claim the Claimants rely upon a witness statement dated 3 July 2020 from Dr Bill Marczak, a research fellow at the Citizen Lab, Toronto, Canada. Citizen Lab is an interdisciplinary laboratory based at the Munk School of Global Affairs & Public Policy, University of Toronto, focusing on research and development at the intersection of information and communication technologies, human rights, and global security.

Dr Marczak conducts research into nation-state use of spyware and hacking tools to conduct espionage against journalists, dissidents, and civil society targets. He is also a post-doctoral researcher in Computer Science at the University of California, Berkeley, and has authored a number of peer-reviewed papers on computer security. I relied on his evidence in Al-Masarir.

In his witness statement for this case at [5] he says:

“I focus on companies that sell spyware and hacking tools and services directly and exclusively to governments, including GG/FinFisher (based in the UK and Germany), Hacking Team (based in Italy), and Cyberbit and NSO Group (both based in Israel). These companies typically represent that their spyware products are intended to be used by governments for tracking serious organized crime or terrorists.”

Dr Marczak co-founded Bahrain Watch, which is a collective focusing on investigations, research, and analysis about Bahrain. Dr Marczak is not an expert witness under the CPR (as Professor Sarooshi KC for the Defendant rightly pointed out), but he is plainly well-qualified, and I attach weight to his witness statement, whilst having due regard to the fact that he is parti pris so far as Bahrain is concerned. However, I also note that Dr Marczak’s evidence was recently admitted and relied upon by the President of the Family Division (not in relation to Bahrain), who found him to be an impressive witness who had presented a detailed, logical account, supported by the core data that he had found, which led to the conclusion that there was strong evidence that three phones in that case had been hacked by spyware and a further three phones had probably also been infiltrated: Re Al M (Fact-finding) [2021] EWHC 1162 (Fam), [139], [171].

Paragraph 13 of the Particulars of Claim avers in relation to the infection of the First Claimant’s computer (the SS computer) with FinSpy:

“… It is properly to be inferred that this infection was carried out, directed, authorised and/or caused by the Defendant and/or its employees, officials and/or agents acting on its behalf, and that from around September 2011 until a date which is not currently known to the First Claimant, the Defendant and/or its employees, officials and/or agents acting on its behalf:

13.1.

Accessed, copied and/or exfiltrated information stored on, available on and/or transmitted by the SS Computer. Such information included the First Claimant’s files, photographs, videos, emails, messages, passwords and other online / web-based information.

13.2.

Intercepted in real-time, and/or after-the-event, on textual, audio and/or video communications conducted using the SS Computer.

13.3.

Used the SS Computer’s microphone and/or camera to record and surveil the First Claimant (including while he was in his home) as well as other activities and matters occurring within the proximity of the SS Computer.”

Similar averments are made in respect of the Second Claimant’s computer (the MM computer).

Paragraph 41 pleads as follows under the heading ‘Exception to immunity from jurisdiction’:

“ 41. These proceedings are in respect of personal injury caused by acts or omissions in the UK. Accordingly the Defendant is not immune from jurisdiction as respects the proceedings. The acts in the UK include the following:

41.1.

Transmitting executable files for installing FinSpy on the SS Computer and the MM Computer (“the Devices”), which were at all material times located in England.

41.2.

Installing FinSpy on the Devices, including by overwriting the hard disk and/or Master Boot Record with malicious code.

41.3.

Running the spyware on the Devices.

41.4.

Executing FinSpy to the Devices’ Central Processing Units, and reading data to, and writing it from, the Devices’ Random Access Memory.

41.5.

Storing information gathered by the spyware on the Devices’ hard disks.

41.6.

Using the Devices’ computer network interface controller to send and receive data via a wired or wireless network and telecommunications equipment within the UK.

41.7.

Using the Devices’ battery power to transmit and receive data and commands, and to use other hardware components in the Devices.

41.8.

Exfiltrating or causing to be exfiltrated information held on, available from and/or transmitted via the Devices.

41.9.

Activating or causing to be activated the Devices’ microphones and/or cameras, and recording information with the same.

41.10.

Recording and transmitting keystrokes and mouse movements made on the Devices.”

The Claimants’ pleaded case on harassment is as follows:

“42.

From about 6 September 2011 until a date which is currently unknown to the Claimants, the Defendant and/or its employees, officials or agents acting on its behalf have engaged in courses of conduct which have been directed at each of the Claimants, which have amounted to harassment of each of them and which the Defendant and/or its employees, officials and/or agents acting on its behalf knew or ought to have known amounted to harassment of each of them, within the meaning of section 3 of the Protection from Harassment Act 1997 (“PHA 1997”). The courses of conduct consisted of the following:

42.1.

surreptitiously implanting or installing spyware on the Claimants’ electronic devices;

42.2.

exfiltrating or causing to be exfiltrated information from the devices;

42.3.

sending messages to third parties falsely purporting to be from the Claimants;

42.4.

surreptitiously activating or causing to be activated the devices’ microphones and/or cameras;

42.5.

conducting covert audio and/or video surveillance of the Claimants through the devices’ microphones and/or cameras, including while they were in their own homes; and/or

42.6.

covertly monitoring the Claimants’ activities on a wide-ranging basis and by highly intrusive means.

43.

The courses of conduct were oppressive and unacceptable in that they:

43.1.

amounted to an egregious violation of each of the Claimants’ private lives;

43.2.

involved a comprehensive and insidious intrusion into each of the Claimants’ communications and personal and work-related information, including their work on highly sensitive political matters in Bahrain;

43.3.

were carried out entirely in secret, depriving the Claimants of any knowledge of the information taken from them; and

43.4.

have caused severe distress, anxiety and fear to each of the Claimants.”

The Claimants’ case on personal injury is couched in the following terms:

“The First Claimant

44.

By reason of the matters set out at paragraphs 42 to 43 above, the First Claimant has suffered personal injury.

Particulars of Personal Injury

44.1.

As a result of the infection of the SS Computer with FinSpy, the accessing / exfiltration of his information, and his surveillance, by and/or on behalf of the Defendant, and the First Claimant’s discovery of those matters, the First Claimant developed adjustment disorder.

The First Claimant relies on the expert report of Dr Martin Baggaley, Consultant Psychiatrist, dated 18 April 2019.

45.

In consequence of his personal injury, the First Claimant has suffered financial loss, as set out in the Schedule of Loss.

The Second Claimant

46.

By reason of the matters set out at paragraphs 42 to 43 above, the Second Claimant has suffered personal injury.

46.1.

As a result of the infection of the MM Computer with FinSpy, the accessing/exfiltration of his information, and his surveillance, by and/or on behalf of the Defendant, and the Second Claimant’s discovery of those matters, the Second Claimant underwent a significant exacerbation of the adjustment disorder from which he suffered.

The Second Claimant relies on the expert report of Dr Martin Baggaley, Consultant Psychiatrist, dated 14 April 2019.

47.

In consequence of his personal injury, the Second Claimant has suffered financial loss, as set out in the Schedule of Loss.”

Adjustment disorder is a maladaptive response to a psychosocial stressor. It is classified as a mental disorder in the leading diagnostic manuals, DSM-5 and ICD-11. The maladaptive response usually involves otherwise normal emotional and behavioural reactions that manifest more intensely than usual (considering contextual and cultural factors), causing marked distress, preoccupation with the stressor and its consequences, and functional impairment. I will come back to Dr Baggaley’s evidence later.

This application by the Defendant raises the following overarching submissions (Defendant’s Skeleton Argument, [10]). It says that the immunity exception in s 5(a) of the SIA 1978 does not apply to theseclaims because:

I note, as do the Claimants at [22] of their Skeleton Argument, that the Defendant in this case does not argue that even assuming it was responsible for the pleaded spyware attacks (which, as I have said, it denies), the acts in question were done by it jure imperii (ie, they were of a sovereign or governmental character), and thus that it is immune on that basis, because s 5 of the SIA 1978 only covers acts done jure gestionis (ie, acts of a private nature). This argument was advanced by the Kingdom of Saudi Arabia in Al-Masarir (which in part also concerned an alleged spyware attack), however I rejected it for the reasons I set out at [51]-[117] of that judgment.

I also note that the submission that psychiatric injury is not personal injury within s 5 was not advanced by Saudi Arabia, even though part of Mr Al-Masarir’s case was also that he had suffered psychiatric injury as a result of his devices being hacked with spyware.

Although the burden lies on the Claimants, by agreement Professor Sarooshi KC addressed me first, and Mr Hermer KC then replied for the Claimants.

Professor Sarooshi KC broke his submissions down into five parts, as follows:

This last strand of the Defendant’s argument was a response to an alternative argument advanced on behalf of the Claimants in the event that I am against them on their primary argument (namely, on its plain meaning, s 5 does apply on the facts of this case so that the Defendant is not immune). The Claimants contend that to hold the Defendant immune would violate their right of access to a court in violation of Article 6 of the ECHR.

In summary, Professor Sarooshi KC submitted that in order for the Claimants to bring themselves within s 5, they have to show on the balance of probabilities that: (a) the alleged acts occurred; (b) the acts emanated from a person or persons acting at the behest of the Defendant, or for whom the Defendant is otherwise vicariously responsible; (c) all of the acts occurred within the UK; (d) that personal injury – ie physical injury - resulted from them.

The Defendant relies on the propositions that ‘[t]he act or omission (or facts) which cause the injury or damage must occur in the territory of the state of the forum. Where the death, personal injury, etc, occurs is irrelevant’ (Heiser and others v Islamic Republic of Iran [2019] EWHC 2074 (QB), [152] per Stewart J), and, ‘[u]nlike the crime or civil tort of conspiracy, section 5 expressly founds the exception to State immunity on an act or omission in the United Kingdom’ (Ibid, [155]).

It submits that this construction of s 5 is supported by Article 11 of the European Convention on State Immunity (the Basle Convention) (ETS No 74) and the United Nations Convention on Jurisdictional Immunities of States and Their Property (2004) (the UN Convention).

Article 11 of the Basle Convention provides:

“A Contracting State cannot claim immunity from the jurisdiction of a court of another Contracting State in proceedings which relate to redress for injury to the person or damage to tangible property, if the facts which occasioned the injury or damage occurred in the territory of the State of the forum, and if the author of the injury or damage was present in that territory at the time when those facts occurred.”

Specifically in relation to s 5, the Defendant said that s 5 implemented Article 11. The Defendant pointed in support to what the European Court of Human Rights said in Al-Adsani v United Kingdom (2001) 34 EHRR 11, [22], when referring to Article 11 of the Basle Convention, namely that s 5, ‘… was enacted to implement the 1972 European Convention on State Immunity …’.

The Defendant submitted that while the wording of s 5 and Article 11 is not exactly the same, the interpretation and application of s 5 in Al-Adsani and Heiser achieves the same result, namely that pursuant to s 5 the defendant State’s act that causes personal injury must have taken place in UK territory for the exception to apply, and the fact that personal injury may have occurred in the UK is irrelevant.

Article 12 of the UN Convention (entitled ‘Personal injuries and damage to property’) provides:

“Unless otherwise agreed between the States concerned, a State cannot invoke immunity from jurisdiction before a court of another State which is otherwise competent in a proceeding which relates to pecuniary compensation for death or injury to the person, or damage to or loss of tangible property, caused by an act or omission which is alleged to be attributable to the State, if the act or omission occurred in whole or in part in the territory of that other State and if the author of the act or omission was present in that territory at the time of the act or omission.”

As to the UN Convention, it relies on the Yearbook of the International Law Commission, 1991, Vol II Part Two, p13, where the International Law Commission said in relation to draft Article 12, which was not materially different to the 2004 text, that the presence requirement was inserted to ensure the exclusion of transboundary injuries or trans-frontier torts or damage, such as export of explosives, fireworks or dangerous substances which could explode or cause damage through negligence, inadvertence or accident, and that events such as shooting or firing across a boundary or of spill-over across the border of shelling as a result of an armed conflict were also excluded from the areas covered by Article 12.

The Defendant argues that any different interpretation of s 5 would potentially result in the UK being in breach of its obligations to the other States Parties to the Basle Convention.

Next, the Defendant disputes the relevance of cases on service out of the jurisdiction and the other cases I addressed in Al-Masarir, [128]-[133], eg, Ashton Investments Ltd v OJSC Russian Aluminium (RUSAL) [2007] 1 All ER (Comm) 857, [62]-[63]. The Defendant says (rightly) that none of the cases concerned claims or actions against States or State officials and did not concern immunity. It says PD6B serves a different purpose from the SIA 1978.

The Defendant also relies on US case law on the corresponding provision of the US Foreign Sovereign Immunities Act 1976 (FSIA), which is to be found in Chapter 28 of the United States Code (USC). The Defendant says this supports its construction of s 5 of the SIA 1978.

28 USC 1605(1)(a), (2) and (5)(a) of the FSIA provide:

“(a)

A foreign state shall not be immune from the jurisdiction of courts of the United States or of the States in any case -

…

(2)

in which the action is based upon a commercial activity carried on in the United States by the foreign state; or upon an act performed in the United States in connection with a commercial activity of the foreign state elsewhere; or upon an act outside the territory of the United States in connection with a commercial activity of the foreign state elsewhere and that act causes a direct effect in the United States;

…

(5)

not otherwise encompassed in paragraph (2) above, in which money damages are sought against a foreign state for personal injury or death, or damage to or loss of property, occurring in the United States and caused by the tortious act or omission of that foreign state or of any official or employee of that foreign state while acting within the scope of his office or employment; ..”

Sub-paragraph (5) is often known as the ‘non-commercial tort’ exception to immunity.

The Defendant points to dicta in Al-Adsani (No 2), pp542-544, where Stuart-Smith LJ considered the FSIA and said that the relevant part was ‘in all material respects for present purposes … the same as State Immunity Act 1978’. He rejected the claimant’s submission that the English courts should not follow ‘the highly persuasive judgments of the American courts’.

It also relies on Lord Clarke’s more recent statement in SerVaas Inc v Rafidain Bank [2013] 1 AC 595, [28], in relation to decisions of US courts on the interpretation of section 1610(a) of the FSIA in the context of the exception to procedural privileges in s 13(4) of the SIA 1978 for ‘property which is for the time being in use or intended for use for commercial purposes’, that they were‘strong persuasive authority … given the close relationship between the language of section 13(4) of the Act and section 1610(a) of the FSIA’.

The Defendant therefore relies as persuasive authority on cases such as Argentine Republic v Amerada Hess, (1989) 488 US 428 (US Supreme Court), Kidane v Ethiopia (2017) 851 F 3d 7 (US Court of Appeals for the District of Columbia Circuit) and Democratic National Committee v Russian Federation (2019)392 F Supp 3d 410 (US District Court for the Southern District of New York), where American courts have held that, in order for the exception to apply, the entire tort causing injury must take place in the United States.

I discussed Kidane in particular in Al-Masarir, [135]-[148]. It was another alleged spyware case, in which the American court held Ethiopia to be immune under the FSIA because some of the alleged acts involved in the hacking took place outside of the United States. I will return to it later. The Democratic National Committee case was similar, and concerned the alleged hacking of Democratic Party computers by persons on behalf of the Russian Federation. Again, Russia was held to be immune because some of what was alleged to have occurred as part of the hack took place in Russia.

Finally, the Defendant says its construction of s 5 is supported by academic authority, namely, Dickinson, Lindsay and Loonam. State Immunity: Selected Materials and Commentary (Oxford, 2004), p370; and Schreuer, State Immunity: Some Recent Developments (Cambridge/Grotius, 1988), pp51-2.

On the second strand of its argument, the Defendant disputes that infecting a computer in the UK with spyware from abroad is an act done in the UK, ie, the Claimants have not established their alleged personal injuries were ‘caused by an act … in the United Kingdom’. It says that the Claimants’ own pleadings (in particular, PoC at [41]) do not allege acts which were said to have occurred in the UK. Further, the Claimants do not claim or otherwise suggest the alleged acts were carried out by officials, employees or agents of the Kingdom of Bahrain while present within the territory of the UK.

Next, and thirdly, the Defendant denies there is sufficient evidence to show on a balance of probabilities that the Claimants’ computers were infected and/or that they were infected by persons for whom it is responsible. It makes a number of forensic points about Dr Marczak’s evidence in order to dispute the assertions at [19]-[20] of the PoC which are underpinned by his evidence. These are that:

“19.

Between around 28 October 2010 and 9 February 2011 the Defendant, and/or agents, employees and/or officials acting on its behalf, acquired from the Gamma Companies various licences to use FinSpy and other similar surveillance/spyware products marketed by the Gamma Companies, including FinSpy USB and FinFly Web.

20.

At all material times, a FinSpy command and control server was operated from the IP address 77.69.140.194 which was at the material time allocated to a Bahraini Internet Service Provider known as Batelco. This server was used for the purposes of issuing commands to and receiving information from devices infected with FinSpy. It is to be inferred that this server was operated by the Defendant and/or on its behalf by one or more of its departments, agencies, officials and/or employees.”

The Defendant says that the Claimants have provided no evidence as to how their computers were alleged to have been infected, and point out that the Claimants’ computers were not themselves examined by Dr Marczak nor anyone else. It says Dr Marczak’s evidence is just based on his analysis of three emails containing infected files sent to Alaa Shehabi. This point was made several times in its written submissions.

Further, the Defendant argues that according to the Claimants’ PoC, it was the discovery (in the UK) of hacking that caused their personal injuries (PoC at [44.1] and [46.1]. The Defendant says that the Claimants do not suggest that it was an act of the Kingdom of Bahrain that caused them to discover or learn of the alleged surveillance. Indeed, the Claimants found out because relatives or friends alerted them to the Bahrain Watch article of 7 August 2014 co-authored by Dr Marczak (as to which, see later).

The Defendant’s fourth submission is that the alleged injuries are not ‘personal injuries’ for the purposes of s 5 because they are psychiatric injuries and the term ‘personal injury’ in s 5 should be interpreted as excluding non-physical injury. It seeks to argue that s 5 should be interpreted in accordance with Article 11 of the Basle Convention and Article 12 of the UN Convention which, it says, are limited to physical injury. It also seeks to distinguish two EAT cases (or says they were wrongly decided) which have held that psychiatric injury does fall within s 5, namely Military Affairs Office of the Embassy of Kuwait v Caramba-Coker [2003] UKEAT 1054_02_1004 and Federal Republic of Nigeria v Ogbonna [2012] 1 WLR 139.

It also relies on the decision of the Canadian Supreme Court in Schreiber v Canada (Attorney General) [2002] 3 SCR 269. The Court that held s 6 of the Canadian State Immunity Act, the corresponding provision to s 5 of the SIA 1978, which makes an exception for ‘any proceedings that relate to … any death or personal injury … that occurs in Canada’ referred to bodily injury and the scope of the exception is limited to instances where mental distress and emotional upset were linked to a physical injury. Le Bel J (who gave the judgment of the Court) said that that conclusion was ‘consistent with … international law sources’. The Defendant further relies, to the same effect,onKazemi and Hashemi v Islamic Republic of Iran [2014] 3 SCR 176, [78].

The Defendant says this aspect of its case is supported by academic commentary, including Xiaodong Yang, State Immunity in International Law (2012) (p200-201):

“In practice, the term ‘personal injury’ has been generally understood to refer only to ‘physical injury’, thus precluding, for example, claims based on mental injury, hurt feelings, psychological injury, damage to reputation, libel or defamation.”

As will become clear, I do not need to address the Claimants’ Article 6 argument, or the Defendant’s response to it.

On behalf of the Claimants, Mr Hermer (who also appeared for the Claimant in Al-Masarir) submitted that the language of s 5 is clear and unambiguous. He argued s 5 does not require the author of the act causing injury to be present in the UK (ie, there is no presence requirement in s 5); and nor does it require all of the acts causing injury to take place here. To hold otherwise would be to give an unnatural reading to the plain words of the statute. Section 5 is concerned with the location of the acts or omissions causing injury, not with the presence of the author(s), or where the injury is suffered.

Unlike in some international instruments relating to immunity, where the presence requirement is made explicit (eg, Article 11 of the Basle Convention, and Article 12 of the UN Convention), in s 5 Parliament did not include such a condition. Mr Hermer said the omission must have been intentional. As Stewart J observed in Heiser v Islamic Republic of Iran [2019] EWHC 2074 (QB), [152], s 5 does not replicate Article 11 of the Basle Convention and ‘does not have a presence requirement’. Mr Hermer said that these international provisions did not therefore assist in the interpretation of s 5, because Parliament had deliberately chosen a different model.

Mr Hermer therefore said that it is only necessary for a single relevant act or omission causative of the death, injury or damage to take place within the UK in order to engage the exception, provided that it has more than a minimal causative effect.

Mr Hermer said placing spyware on a computer hard drive located in the UK remotely from abroad amounted to an act in the UK for the purposes of s 5. He placed reliance on what he said was analogous language in CPR PD 6B [3.1(9)(b)] (‘… A claim is made in tort where … (b) damage which has been or will be sustained results from an act committed, or likely to be committed, within the jurisdiction …’) and Ashton Investments Ltd, where the Court held the test under PD 6B, para 3.1(9)(b) was satisfied in circumstances where a hack on devices located within the jurisdiction emanated from abroad: see particularly at [63].

He said that similarly, in Vidal-Hall v Google Inc [2014] 1 WLR 4155, [78], and Lloyd v Google LLC [2019] 1 WLR 1265, [47], the test was met in respect of the collection of internet search-related information by Google (based abroad) from users located in the jurisdiction. He also cited R v Governor of Brixton Prison, ex parte Levin [1997] QB 65, an extradition case, in which the Divisional Court held that the remote manipulation of a computer hard drive physically located in the US by a person in Russia was an act in the US because the essence of the act was done in the US (and so, in equivalent circumstances vis-à-vis the UK, would have been an act done in the UK).

Mr Hermer submitted that the Defendant’s reasoning would equally impose immunity in respect of a range of tortious activity directed from abroad by a foreign state body, such as a ransomware attack on vital infrastructure located in the UK; a drone attack on people or property within the UK; or a poisoning within the UK launched from outside the jurisdiction. He said that such an outcome, depriving individuals of legal redress for grievous wrongs within the UK, would not only be disturbing at the level of principle (given in particular the increasing prevalence of such forms of state-directed attacks), but would also run counter to the clear terms of s 5. He said there could be no policy justification for such a result.

Mr Hermer further submitted that it was well-settled that the reference to ‘personal injury’ in s 5 covers cases of psychiatric as well as physical injury, and he relied on Caramba-Coker and Ogbonna. He said the Canadian cases are not on point.

Mr Hermer further said that Dr Baggaley’s evidence showed that the Claimants had suffered psychiatric injury as a consequence of hacking.

As I have said, I do not need to address Mr Hermer’s alternative Article 6 argument.

Dr Marczak’s witness statement contains a great deal of information, including about what FinSpy is and how it operates and what investigations he carried out. The following is a summary of his evidence. To keep matters simple, I have omitted a great deal of the (fairly daunting) technical detail in his statement. But for the avoidance of doubt, I rely on his evidence in full.

Once the operator implants the spyware on the target’s device (as I have said, often via an infected email which the target unwittingly opens), the spyware causes the device to periodically contact Internet ‘Command and Control’ (C&C) servers listed in a configuration file bundled with the spyware's code. The purpose of this contact is for the spyware to receive commands from the operator (typically, a government agency) and to transmit data captured from the device back to the operator.

FinSpy's commands include the ability for the operator to upload messages, photos, files, and passwords from the device, to enable its microphone and camera to ‘snoop in’ on calls or activity in the device’s vicinity, and to remotely wipe the spyware implant to avoid detection. Operators issue commands from a C&C server that is typically located in a facility of the operating government agency. This server is also the ultimate destination of data captured by the spyware on the target’s device.

However, the Internet servers included with the spyware's code are typically proxy servers, ie, servers whose sole function is to relay data between the target’s device and the C&C server on the government agency’s premises. The purpose of relaying commands and data through these proxy servers is so that it is not possible to identify the Internet Protocol (IP) addresses of the spyware operator by examining a copy of the spyware. This can prevent security researchers from easily establishing the identity or location of the spyware's operator through examination of the spyware’s code alone. However, in the case of Bahrain, the FinSpy operator appears to have not used a proxy server, allowing the location of the spyware's operator to be established, as Dr Marczak discusses in [15] of his witness statement.

He first examined a copy of the FinSpy spyware in May 2012, when Alaa Shehabi, the Bahraini activist with whom he co-founded Bahrain Watch, forwarded three emails to him that she viewed as suspicious. Ms Shehabi asked him to analyze the attachments in the emails, suspecting that they might contain spyware sent by the Government of Bahrain.

Dr Marczak analysed attachments to the emails, which he found contained further files containing executable computer code (.exe files) that were disguised as a popular image file format (.jpg). Clicking on the image file did display an image, but it also installed a computer program on the virtual machine which he was using for his analysis. (A virtual machine is a software based replica of a computer which sits inside an actual hardware computer and allows files to be manipulated and examined without risking the actual computer itself becoming infected). A .doc (ie, Word) file in an attachment behaved similarly, by surreptitiously installing a program when opened.

These programs attempted to communicate with a server at the IP address 77.69.140.194, which is used by customers of a Bahraini ISP called Batelco. Upon successful connection to the Bahraini IP address, the program downloaded and executed several additional subprograms (modules) from the Bahraini server.

According to Dr Marczak’s examination, several of these modules checked for the existence of, and attempted to access, files containing web history and passwords for at least 20 types of web browsers (e.g., Firefox, Opera, Chrome), instant messaging programs (eg, MSN Messenger, Yahoo Messenger, AOL Instant Messenger), and e-mail clients (eg, Outlook, Thunderbird, Eudora). Any items found were uploaded to the Bahraini IP address, after which the module deleted itself. Other modules included: a keylogger that recorded every keystroke, as well as the name of the window on the computer the keystroke was typed into; a Skype module that recorded audio of each party on a Skype call, as well as text messages and files sent via Skype chats, and the contents of a Skype user's contact list; a Voice Over IP (VoIP) module that recorded voice calls from apps similar to Skype; a ‘hot mic’ module that could record live audio from the computer's microphone upon receipt of a special command from the server; and a screenshot module that recorded periodic captures of the user's screen. All modules recorded the information they gathered to the computer's hard drive temporarily. Periodically, the spyware transmitted this data back to the Bahraini IP address, and then erased the files from the virtual machine's hard drive.

Further analysis led Dr Marczak to conclude that the spyware he was examining was indeed FinSpy. Elaborating, he explained at [24] that after installation, the operator could command the FinSpy installation to activate the computer’s microphone and camera hardware (if the computer has these hardware components) to snoop in on VoIP calls (eg, Skype) or activity in the vicinity of the computer. The operator could also command the FinSpy installation to record keystrokes input via the computer’s keyboard, mouse movement input via the computer’s mouse, and files sent to a printer connected to the computer. Recorded data is transmitted back to a C&C server. Data sent to and from the computer as a result of FinSpy operation is transferred over local telecommunications infrastructure. For instance, a FinSpy installation on a UK-based computer would send and receive data via telecommunications equipment including perhaps the target’s Wi-Fi router and/or cable/DSL modem, as well as cables and routers located in the UK.

After further detailed technical discussion and explanation, Dr Marczak at [39] explained he was able to determine thatthe name of one of the target’s Windows accounts had been set to ‘Saeed Shehabi’ (ie, the First Claimant’s name). Another target had the name ‘Moosa’ (the Second Claimant) and his machine had also been infected with FinSpy. He produces Ex BM1/18 a report from August 2014 of his forensic findings which specifically identified the Claimants as having been a target of FinSpy spyware.

This analysis took place after technical documentation had, ironically, been obtained illicitly from Gamma Group by an individual or group using the alias ‘Phineas Phisher’. It reportedly hacked a website belonging to Gamma Group and obtained 40GB of data, including copies of various products in the FinFisher suite and their documentation; information about the start and expiry dates of licenses held by its clients to use its products; as well as data from a support webpage on which its clients had submitted requests for assistance if they were having a problem with FinFisher products. Phineas Phisher released the data publicly in August 2014, and the well-known website Wikileaks also published some of it a month later.

This important aspect of Dr Marczak’s findings was presaged in the witness statement of Yai Ida Aduwa, the Claimants’ solicitor, at [9]-[14], served at an earlier stage of these proceedings:

“9.

In August 2014 documents relating to FinFisher, including sales brochures, training manuals and communications between support staff and its customers, were published on the WikiLeaks website online (‘the WikiLeaks Documents’). The documents appeared to show that a number of FinFisher products and licences had been sold to the Respondent. I refer at page 3 of exhibit YIA2 to the documents evidencing those purchases.

10.

The WikiLeaks Documents also included a series of messages concerning the use of FinSpy sent between a user of that product and one or more employees of the Gamma companies. The messages from the user included requests for assistance with installing and maintaining FinSpy on targets’ electronic devices, and extracting information from those devices. I refer at pages 4 to 6 of Exhibit YIA2 to those messages.

11.

Attached to one of the messages sent by the user was a document referred to as “the Finspy Master the system logs” [sic]. This appears to contain details relating to devices which had been infected with FinSpy and is referred to below as “the Target List”. The information in that document was subsequently re-presented in the form of an Excel spreadsheet as a result of work done by Bill Marczak, a Research Fellow at the Citizen Lab, an interdisciplinary laboratory based at the Munk School of Global Affairs & Public Policy, University of Toronto, focusing on research and development at the intersection of information and communication technologies, human rights, and global security. I refer to exhibit YIA3 to a copy of that spreadsheet and to the report of Citizen Lab relating to their investigation of the Target List.

12.

It is the Applicants’ case that their laptops appear on the Target List, and that the FinSpy user who had attached the Target List to one of his messages was acting on behalf of the Respondent. The First Applicant’s laptop is identified in the Target List by reference to the user name ‘Moosa’ and the Second Applicant’s laptop is identified by reference to the user name ‘Saeed Shehabi’. Based on that information and other circumstances relating to their activities and interactions with the Respondent, the Applicants infer that the Respondent caused the infection of their devices with FinSpy, and used the information obtained as a result of that infection.

13.

The Applicants will claim that the operation of FinSpy resulted in the covert and unauthorised accessing by the Respondent of the Applicants’ information stored on, or communicated or accessible via, their laptops. This has enabled the Respondent to collect much, if not all, of the data processed by the Applicants’ devices, including messages, emails, calendar records, instant messaging, contacts list, browsing history, photos, databases, documents and videos. It has also permitted the Respondent to track the location of the laptops (and therefore of the Applicants), and to intercept calls made on them. It has permitted the surveillance of the Applicants’ by covert use of the laptops’ in-built microphones and cameras to record sounds or capture images in the vicinity of the devices.”

The first two issues are as follows. It is convenient to take them together.

Does s 5 of the SIA 1978: (a) require the presence of the infringing state actor in the UK in order for the state concerned not to be immune in domestic civil proceedings ?; and (b) does also it require all of the acts causing injury, etc, to have taken place in the UK for immunity not to apply ?

Does the infection of a computer located in the UK with spyware via actions abroad amount to an act in the UK ?

I have considered the Defendant’s submissions in light of my judgment in Al-Masarir (and vice versa).There is nothing in the way the Defendant has advanced its case on this issue which has caused me to doubt what I said in that case. I remain clear that s 5 does not, contrary to the Defendant’s submissions, either: (a) require the presence of the infringing state actor in the UK; and (b) nor does it require all of the Defendant’s acts (ie, acts for which it is responsible) to have occurred in the UK. It is enough if an act takes place in the UK which is more than a minimal cause of the injury, etc, falling within s 5.

I deal with presence first. Although the Defendant did not contend for a presence requirement, I think it sheds light on the approach to be taken to s 5 and the treaty provisions relied on by the Defendant.

I am clear that it is the location of the actor acts causing the injury which is the issue under s 5, not the presence of the author of the act(s). In the witness statement of Mr Boyd, the Defendant said: ‘Importantly for present purposes, there is no allegation or inference that any of the persons carrying out the acts which the Claimants say caused their injury were in the United Kingdom at the time’. If by this the Defendant was contending that there is a requirement for the persons alleged to have performed the acts causative of injury to have been in the UK at the time, this is wrong. There is no ‘presence requirement’ in s 5. When an instrument on immunity incorporates a presence requirement, this is done so expressly as in Article 11 of the Basle Convention and Article 12 of the UN Convention.

The differences between the Basle Convention and the SIA 1978 have been judicially noted at the highest level. In La Générale des Carrières et des Mines v FG Hemisphere Associates LLC [2012] UKPC 27, [10], the Privy Council said :

“The Act was aimed at giving broad effect to (though not following precisely the wording of) the European Convention on State Immunity, which was agreed under the aegis of the Council of Europe at Basle on 16 May 1972 and which entered into force on 11 June 1976.”

Parliament’s omission of the presence requirement in s 5 could only have been intentional, given that it was legislating against the backdrop of the Basle Convention (which the UK signed in 1972). Parliament is sovereign and is free to legislate in a way which differs from an international treaty if it wishes to do so, as I shall explain in a moment. It plainly chose not to adopt the Article 11 model.

It seems to me, therefore, that the passage from the European Court’s judgment in Al-Adsani, at [22], which I quoted earlier, and upon which the Defendant relied, cannot be taken to mean Parliament intended to precisely replicate Article 11 of the Basle Convention in s 5. It obviously did not. I cannot improve on the Privy Council’s formulation that the SIA 1978 gave ‘broad effect’ to the Basle Convention, but did not replicate it. I do not therefore find Article 11 to be of assistance in interpreting s 5.

Nor is Article 12 of the UN Convention of assistance. This also has a presence requirement that is missing from s 5. Moreover, the phrase, ‘… if the act or omission occurred in whole or in part in the territory of that other State and if the author of the act or omission was present in that territory at the time of the act or omission’ seems to me to beg the question. Also, the UK has signed but not ratified the Convention. This was noted by Lord Sumption in Benkharbouche, [12], when he said that ‘for the most part’ the UN Convention is consistent with the SIA 1978, which was one of the models used by the draftsman. I consider that qualification undermines reliance on Article 12 as an interpretive tool.

Although the Defendant relied on Article 11 and Article 12 as interpretive aids, for these reasons, I do not consider them to be of assistance.

On Parliament’s ability to legislate contrary to an international treaty, I repeat what I said in [58] and [59] of Al-Masarir:

“58.

In London Steam-Ship Owners' Mutual Insurance Association Ltd v Spain; The Prestige (Nos 3 and 4) [2021] EWCA Civ 1589, [39]-[40], the Court of Appeal (Males, Popplewell and Phillips LLJ) said, summarising earlier high authority:

‘39. We start with some observations on the relationship between the 1978 Act and public international law. The provisions of the Act fall to be construed against the background of the principles of customary international law, which at the time it was enacted, as now, drew a distinction between claims arising out of those activities which a state undertakes jure imperii, i.e. in the exercise of sovereign authority, and those arising out of activities which it undertakes jure gestionis, i.e. transactions of a kind which might appropriately be undertaken by private individuals instead of sovereign states, in particular what is done in the course of commercial or trading activities. The former enjoyed immunity; the latter did not. This came to be known as the restrictive theory of immunity, which had by then been adopted by the common law in this country. See Alcom Ltd. v Republic of Colombia [1984] AC 580 at pp. 597-599, Playa Larga and Marble Island (Owners of Cargo Lately Laden on Board) v I Congreso del Partido [1983] 1 AC 244 at pp. 261-262, and Benkharbouche at [8]. The Act did not, however, merely seek to frame immunity in terms of this binary distinction, choosing instead to formulate the exceptions to immunity in a series of detailed sections, such that the existence of immunity under public international law is not conclusive as to whether immunity has been removed by the 1978 Act. As Lord Diplock observed in Alcom at p. 600, the fact that the bank account of the Colombian diplomatic mission which the respondents in that case sought to make the subject of garnishee proceedings would have been entitled to immunity from attachment under public international law, at the date of the passing of the 1978 Act, was not sufficient to establish that it enjoyed immunity under the Act; it made it highly unlikely that Parliament intended to require United Kingdom courts to act contrary to international law unless the clear language of the statute compelled such a conclusion; but it did not do more than this.

The next question is whether s 5 requires the act (or all the acts, where the damage was caused by more than one act) to have taken place in the UK (as the Defendant contends); or if it is sufficient that just one causative act having more than minimal effect took place here (as the Claimants contend, and as I concluded in Al-Masarir at [118]-[151] where a similar argument was advanced by Saudi Arabia).

In other words, the questions are whether: (a) s 5 only applies where the whole tort causing death, etc, is committed within the UK, as the Defendant contends, or (b) it applies so long as some substantial and effective act causative of the required damage has been committed within the jurisdiction (whether or not other substantial and effective acts have been committed elsewhere), which is the Claimants’ contention.

Prior to my judgment in Al-Masarir there was no English authority I was aware of which was directly on point. The issue had been touched on in a few earlier cases.

I set out the background to, and context of, the SIA 1978 in Al-Masarir, [51]-[59]. To briefly recap, at one time foreign states enjoyed absolute immunity from suit in the courts of the UK. The classic statement was that of Lord Atkin in Cia Naviera Vascongada v Steamship Cristina; (The Cristina) [1938] AC 485, 490, in which he said ‘the courts of a country will not implead a foreign sovereign’.

Over time, immunity at common law became more restricted. It continued to attach to acts undertaken by a state jure imperii, ie, in the exercise of sovereign authority, but not to those arising out of activities which it undertook jure gestionis, ie, transactions of a kind which might appropriately be undertaken by private individuals instead of sovereign states, in particular those which were done in the course of commercial or trading activities. This became known as the restrictive theory of immunity. The key cases that marked the definitive absorption by the common law of this restrictive theory were The Philippine Admiral [1977] AC 373 delivered in November 1975, and Trendtex Trading Corporation v Central Bank of Nigeria [1977] QB 529. Lord Denning's statement in Trendtex as to what had become the revised common law rule as to the immunity of foreign sovereign states from the jurisdiction of the English courts, before the passing of the SIA 1978, received the approval of the House of Lords in I Congreso del Partido [1983] AC 244.

The long title of the SIA 1978 declared, inter alia, that it was an Act to make ‘new provision’ with respect to proceedings against other States in the UK.

In Al-Adsani (No 2), p542, Stuart-Smith LJ said that the Act 'is a comprehensive code and is not subject to overriding considerations.' In Benkharbouche, [39], Lord Sumption said the SIA 1978 was a ‘complete code’, and that if the case does not fall within one of the exceptions to s 1, the state is immune.

I start with the statutory language. I set out the relevant principles of statutory construction, with references to authority, in Al-Masarir, [64]-[70]. It is to be presumed that the grammatical meaning of an enactment is the meaning that was intended by the legislator.

In my judgment, the grammatical meaning of s 5, and in particular the use of the indefinite article (death or personal injury caused by 'an act or omission') (emphasis added) means what it says. There has to be an act or omission in the UK which is causative of the requisite damage on a more than de minimis basis. Parliament did not say ‘the act or omission’, still less, ‘acts or omissions occurring entirely within the UK’, both of which would have been more supportive of the Defendant's interpretation of s 5. This suggests the Claimants’ contention is the correct one.

Such domestic authority as there is on this question supports, in a limited way, the Claimants’ interpretation. In Heiser v Islamic Republic of Iran [2012] EWHC 2938 (QB) (the same case which later came before Stewart J), on an ex parte application for permission to serve the claim form out of the jurisdiction, Singh J (as he then was) held that the claimants had a good arguable case that the s 5 exception applied in relation to international conspiracies causing death and injury to US citizens. He said at [6]-[7]:

“6.

The issue which may arise under the State Immunity Act is whether section 5 would apply if this were a case which arose in the United Kingdom. By way of analogy, the question will become whether the death or personal injury had been caused 'by an act or omission in the United States'.

7.

The essential submission for the claimants at this stage is that there is a good arguable case that there would be jurisdiction if a similar action were to arise in the United Kingdom, on the basis of a conspiracy being regarded as a composite act. It is said that the conspiracies concerned could properly be regarded as being conspiracies not just against those individuals but their relatives and indeed the public more generally in the United Kingdom. So, by way of analogy, it is said in the present cases conspiracies can be analysed as being conspiracies not just to cause injury or death to American citizens, but also to damage their families and also to damage the public in the United States more generally. That, it is submitted, is one of the inherent features of the scourge of international terrorism, as it has been described by courts both in this country and elsewhere. In some of the other cases the analysis of the American court was to the effect that the material assistance knowingly provided to terrorist organisations which caused the death or injury in question. Again it is submitted on behalf of the claimants that it is at least arguable at this stage that section 5 of the State Immunity Act would not preclude an action in the United Kingdom if similar proceedings were brought here. I accept those submissions.”

This reasoning was adopted in Ben-Rafael v Islamic Republic of Iran [2015] EWHC 3203 (QB). That case concerned an attempt to enforce a judgment from a US court for damages arising out of a bomb attack in Buenos Aires. At [7], Whipple J (as she then was), noted that the US courts had concluded that:

“… the proceedings were caused by an act or omission in the United States, to the extent that the US courts were considering a composite act (namely, one of conspiracy) at least one element of which had occurred within the territory of the US”.

I accept that these were short ex parte judgments, nonetheless they are judgments of exceptionally distinguished judges and are helpful so far as they go, and provide more support for the Claimants’ contention than they do for the Defendant's position.

In his 2019 judgment in Heiser ([2019] EWHC 2074 (QB)) Stewart J considered s 5 at [134]-[160]. Professor Sarooshi KC placed some emphasis on this decision. In a number of different cases American citizens had suffered injuries in terrorist attacks entirely outside the US (in the Middle East) and those who survived had continued to suffer from their injuries after their return there. Stewart J said at [147]-[148]:

“147.

the Claimants say that section 5 encompasses a composite act or omission i.e. an act occurring partly inside and partly outside the forum state. It is said that in other contexts it is well established that an act done outside the territory which has harmful consequences inside the territory should in law be treated as an act in the territory. Examples are given such as shooting a gun across a border, planting a bomb on a train which will cross a border and explode in another country, or sending a letter or making a telephone call across state frontiers. At the without notice hearing before Singh J the Claimants gave the example of a dirty bomb detonated outside UK territorial waters which caused death and personal injury in the UK. They submitted it would be absurd if section 5 were to be construed in a way that conferred immunity in those circumstances, simply because the explosion took place outside territorial limits. The Claimants say that all such cases would be within section 5 as being acts "within the United Kingdom", even though the person responsible for the act is not physically present in the United Kingdom and the initiating steps take place outside the United Kingdom. The act is completed in the United Kingdom and that suffices. So, for example, under the old test of jurisdiction, English Courts had jurisdiction for an action ‘founded on a tort committed within the jurisdiction’. A misrepresentation made by telex sent from outside the jurisdiction, but received and acted upon within the jurisdiction, or a telephone call from outside the jurisdiction but answered within the jurisdiction, led to the court finding that the substance of the tort was committed where the representation was received and acted upon – Diamond v Bank of London and Montreal [1979] 1 QB 333.

148.

The difficulty with this submission is that section 5 of the 1978 Act is not concerned with where the substance of the tort is committed. Its concern is where the act or omission causing the death, personal injury or damage occurred. In this case, did it occur in the United States? Here, apart from the Acosta case, all relevant acts or omissions occurred in Middle Eastern states. The fact that either primary victims continued to suffer injury on return to the United States or that secondary victims never left the United States does not assist the Claimants. Section 5 does not permit eliding the act or omission causing the personal injury with where the personal injury occurs. I do not accept that section 5 can be construed with such flexibility as to permit the Claimants' submission to succeed.”

I respectfully agree with this. However, the Claimants did not contend that it was sufficient they suffered injury in the UK. They agreed it is the location of the act in question causing the injury which is important. I therefore do not consider that Heiser provides much, if any assistance to the Defendant in this case, because it was not addressing the point in issue here. The Claimants in the present case do not contend they come within s 5 because they were injured abroad, and continued to suffer injury in the UK. They say they were injured in the UK by an act here, albeit with other elements leading to that act having taken place abroad.

Further, as regards one of the US judgments with which he was concerned, known as the Acosta judgment, which concerned an overt act occurring on the forum state's territory (ie, the US) (a shooting), Stewart J held that the case would have come within s 5: [166]-[174], [187(iii)]. His description of the Acosta judgment shows that some of the acts involved in the conspiracy occurred outside the US.

This series of cases supports the view that s 5 will not apply when no act or omission of a foreign state takes place in the UK. But they do not require that all acts or omissions must occur in the UK for s 5 to apply, and they indicate that composite acts may fall within s 5.

For the avoidance of doubt, no argument was addressed to me on s 6(c) of the Interpretation Act 1978, so that ‘an act or omission’ in s 5 of the SIA 1978 should be read as ‘acts or omissions’. Section 6 provides that:

“6.

In any Act, unless the contrary intention appears, -

…

(c)

words in the singular include the plural and words in the plural include the singular.”

If such an argument had been advanced, I would have rejected it. I would have found that there is plainly a contrary intention in s 5. That is because of the explicit absence of a presence requirement, and the use of the phrase ‘an act or omission’. Even if ‘act’ is to be read as the plural, it would still leave open the question whether all acts, or just some, had to take place in the UK.

Whilst noting the Defendant’s arguments to the contrary, I find support for this interpretation from the cases on the tort jurisdictional gateway in PD 6B, [3.1(9)(b)] and its predecessor. True, the context is different, as the Defendant submitted, but the language of the rule is similar to s 5, and I consider it provides assistance on the question before me.

Paragraph [3.1(9)(b)] provides (emphasis added):

“3.1

The claimant may serve a claim form out of the jurisdiction with the permission of the court under rule 6.36 where –

…

(9)

A claim is made in tort where –

(a)

damage was sustained, or will be sustained, within the jurisdiction;

(b)

damage which has been or will be sustained results from an act committed, or likely to be committed, within the jurisdiction.”

The approach of the English courts to the predecessor to [3.9(1)(b)] was that it was sufficient that a ‘substantial and efficacious act’, and not the entire tort, be committed within the jurisdiction. In Metall und Rohstoff AG v Donaldson Lutfin & Jenrette Inc [1990] 1 QB 391, p437A-G, a case under the old RSC r 11, Slade LJ said (emphasis added):

“As the rule now stands it is plain that jurisdiction may be assumed only where (a) the claim is founded on a tort and either (b) the damage was sustained within the jurisdiction or (c) the damage resulted from an act committed within the jurisdiction. Condition (a) poses a question which we consider below: what law is to be applied in resolving whether the claim is "founded on a tort"? Condition (b) raises the question: what damage is referred to? It was argued for ACLI that, since the draftsman had used the definite article and not simply referred to "damage", it is necessary that all the damage should have been sustained within the jurisdiction. No authority was cited to support the suggestion that this is the correct construction of the convention to which the rule gives effect and it could lead to an absurd result if there were no one place in which all the plaintiff's damage had been suffered. The judge rejected this argument and so do we. It is enough if some significant damage has been sustained in England. Condition (c) prompts the inquiry: what if damage has resulted from acts committed partly within and partly without the jurisdiction? This will often be the case where a series of acts, regarded by English law as tortious, are committed in an international context. It would not, we think, make sense to require all the acts to have been committed within the jurisdiction, because again there might be no single jurisdiction where that would be so. But it would certainly contravene the spirit, and also we think the letter, of the rule if jurisdiction were assumed on the strength of some relatively minor or insignificant act having been committed here, perhaps fortuitously. In our view condition (c) requires the court to look at the tort alleged in a commonsense way and ask whether damage has resulted from substantial and efficacious acts committed within the jurisdiction (whether or not other substantial and efficacious acts have been committed elsewhere): if the answer is Yes, leave may (but of course need not) be given. But the defendants are, we think, right to insist that the acts to be considered must be those of the putative defendant, because the question at issue is whether the links between him and the English forum are such as to justify his being brought here to answer the plaintiffs' claim.'

I turn to the Defendant’s reliance on American FSIA case law. Its case is plainly modelled on the FSIA ‘entire tort’ doctrine, as was the defendant’s case in Al-Masarir. I rejected Saudi Arabia’s case for the reasons I explained at [134]-[148] of that judgment. However, given the emphasis placed by the Defendant on this aspect of its case, I have considered the matter afresh in light of its submissions and the additional case law it relied on.

Having done so, I remain of the same view. I am clear that the American jurisprudence is based on different statutory wording and upon FSIA’s distinct legislative history during its passage through Congress.

I quite accept, as Professor Sarooshi KC pointed out, that there are English cases which have held that American decisions on some aspects of FSIA are of persuasive value. But the context of the two cases he cited was different from the issue before me. Al-Adsani (No 2) was concerned with whether s 5 was subject to an overriding exception based on the jus cogens nature of the prohibition of torture in international law, so that immunity was lost even where the acts of torture took place abroad. That argument had been rejected in the United States, as Stuart-Smith LJ explained, and the Court of Appeal rejected it too. The decision in SerVaas Inc did not concerns 5,but relatedto s 13(4) of the SIA 1978 and s 1610(a) of FSIA, and Lord Clarke rested his assertion about the strong persuasive nature of the American authorities on the ‘close relationship’ between the relevant language of the two statutes.

Whilst not in any way doubting the authority of these statements, I remain of the view that caution must always be exercised in placing reliance upon decisions of foreign courts in relation to different statutes. On the issue before me, there are key differences between the language of s 5 of the SIA 1978 and s 1605(a)(5) of the FSIA which compel a different result from that advocated for by the Defendant.

As I have said, Title 28 USC 1605(a)(5) removes sovereign immunity in cases 'in which money damages are sought against a foreign state for personal injury or death, or damage to or loss of property, occurring in the United States and caused by the tortious act or omission of that foreign state …' (emphasis added).

As noted by Stewart J in Heiser, [98], most US court decisions on FSIA have taken the position that the entire tort (including the causative acts) must have occurred in the US for the non-commercial tort exception to immunity to apply under that Act. These cases include: Smith v Socialist Peoples' Libyan Arab Jamahiriya 101 F 3d 239, 246 (2nd Cir 1996) (The Lockerbie Bombing case); Argentine Republic v Ameradi HessShipping Corp 488 US 428, 421 (1989); Persinger v Islamic Republic of Iran 729, F 2d 835 (DC Cir); Cabiri v Government of Republic of Ghana 165 F 3d 193 (1999); in Re Terrorist Attacks 714 F 3d 109, 116 (2nd Cir 2013); and the Democratic National Committee case.

In the second to last of these cases, the US Court of Appeals for the Second Circuit summarised the 'entire tort' rule as follows:

“As noted, the FSIA's non-commercial tort exception provides:

A foreign state shall not be immune from the jurisdiction of courts of the United States or of the States in any case—... in which money damages are sought against a foreign state for personal injury or death, or damage to or loss of property, occurring in the United States and caused by the tortious act or omission of that foreign state or of any official or employee of that foreign state while acting within the scope of his office or employment. (28 USC § 1605(a)(5)).

For this exception to apply, however, the 'entire tort' must be committed in the United States. This so-called "entire tort" rule was first articulated by the Supreme Court in Argentine Republic v. Amerada Hess Shipping Corp., 488 U.S. 428, 109 S.Ct. 683, 102 L.Ed.2d 818 (1989). In that case, the Supreme Court considered whether courts in the United States had jurisdiction over a suit brought by two Liberian corporations against the Argentine Republic to recover damages stemming from a tort allegedly committed by Argentina's armed forces on the high seas in violation of international law. Id. at 431, 109 S.Ct. 683. The Court held that the action was barred by the FSIA, holding that the non-commercial tort exception "covers only torts occurring within the territorial jurisdiction of the United States." Id. at 441, 109 S.Ct. 683.

After Amerada Hess Shipping Corporation was decided, we described and explained the 'entire tort rule in Cabiri v. Government of Ghana, 165 F.3d 193 (2d Cir.1999), noting that "[a]lthough [the words of the statute are] cast in terms that may be read to require that only the injury rather than the tortious acts occur in the United States, the Supreme Court has held that this exception 'covers only torts occurring within the territorial jurisdiction of the United States.' " Id. at 200 n. 3 (quoting Amerada Hess Shipping Corp., 488 U.S. at 441, 109 S.Ct. 683). At least two of our sister circuits have applied the "entire tort" rule as well. See O'Bryan v. Holy See, 556 F.3d 361, 382 (6th Cir.2009) ("We join the Second and D.C. Circuits in concluding that in order to apply the tortious act exception, the 'entire tort' must occur in the United States. This position finds support in the Supreme Court's decision in Amerada Hess Shipping...."); Asociacion de Reclamantes v. United Mexican States, 735 F.2d 1517, 1525 (D.C.Cir.1984) ("Even if the [alleged tort] had the effect of retroactively rendering the prior acts on United States soil tortious, at the very least the entire tort would not have occurred here....")."

In light of the entire tort rule, the US Code was amended, and 28 USC 1605A inserted for terrorist attacks, in relation to which the said rule does not apply: see Heiser, [99]-[100].

Professor Sarooshi KC placed particular weight on the decision of the US Court of Appeals for the District of Columbia in Kidane (as did counsel for Saudi Arabia in Al-Masarir). The facts were similar to those of the present case. An Ethiopian corruption and human rights campaigner who had obtained asylum in the US claimed that he was tricked into downloading FinSpy by being sent an infected email. This enabled the Ethiopian government to spy on him from abroad. The program communicated with a server in Ethiopia, and the text of the original email suggested that it had been sent by an individual located in London.

The District of Columbia Court found 28 USC 1605(a)(5) was inapplicable (and so Ethiopia had immunity) because the entire tort did not occur in the US. It noted, by reference to Argentine Republic v Amerada Hess Shipping Corp 488 US 428 (1989) that the primary purpose of the Congress in enacting s 1605(a)(5), 'was to eliminate a foreign state's immunity for traffic accidents and other torts committed in the United States, for which liability is imposed under domestic tort law', and thus it was 'unsurprising' that transnational cyberespionage should lie beyond section 1605(a)(5)'s reach. In Amerada Hess the US Supreme Court had rejected an argument that s 1605(a)(5) could apply to a claim for injury to a ship which occurred on the high seas as the relevant tort did not occur 'in the US'.

The Court in Kidane went on to highlight that the phrase ‘occurring in the United States’ is no mere surplusage as ‘[t]he entire tort – including not only the injury but also the act precipitating that injury – must occur in the United States’. On the facts, it held:

“… at least a portion of Ethiopia's alleged tort occurred abroad

…

… whether in London, Ethiopia or elsewhere, the tortious intent aimed at Kidane plainly lay abroad and the tortious acts of computer programming likewise occurred abroad. Moreover, Ethiopia's placement of the FinSpy virus on Kidane's computer, although completed in the United States when Kidane opened the infected e-mail attachment, began outside the United States. It thus cannot be said that the entire tort occurred in the United States.

…

Without the software's initial dispatch or an intent to spy – integral parts of the final tort which lay solely abroad – Ethiopia could not have intruded upon Kidane's seclusion under Maryland law …”

The tort which Mr Kidane alleged thus did not occur entirely in the United States, and so was a transnational tort over which the court lacked subject matter jurisdiction because of state immunity.

The Court distinguished Letelier v Republic of Chile 488 F Supp 665 (DDC 1980)(which I discussed in Al-Masarir at [80]-[88]),on the basis that that case had involved actions ‘occurring in the United States’ that were tortious, without reference to any action undertaken abroad.

The Democratic National Committee case was not cited to me in Al-Masarir. I have considered it, but I do not consider that it adds to the existing jurisprudence. It seems to me to have been a straightforward application of the entire tort doctrine as explained in Amerada Hess in respect of alleged Russian hacking partly taking place outside the US.

Despite the high authority of the American courts which have spoken on this issue, I remain unpersuaded that their decisions have a significant bearing on the issue I have to decide. As I have already remarked, English courts should be cautious before placing too much reliance on foreign decisions that are concerned with different legislation which has different wording and a different legislative history, as the FSIA does when compared with the SIA 1978. The decision in Kidane was further complicated by issues of Maryland state law. The following points also strike me as to why comparative and international materials do not offer much assistance on the present issue.

Firstly, differences exist among foreign States as to how and to what extent the territorial connection is established for the purpose of the exception to state immunity. As Xiaodong Yang observed in State Immunity in International Law (2012), 'the formulations of this requirement are as many as the instruments' (p216).

Second, it seems to me that the wording of the US provision (‘the tortious act or omission of that foreign state’) is critically different to s 5 of the SIA 1978, with its reference to 'an act or omission in the United Kingdom' (emphasis added). As I have already indicated, the fact that Parliament specified only ‘an act’ suggests that not every wrongful act has to occur in the UK. By contrast, the use of the definite article conjoined to the word 'tortious' in the FSIA is a pointer to the conclusion that the entirety of the tortious activity is governed by the territorial jurisdictional requirement (as the US courts have consistently held). Moreover, as set out above, English courts have accepted that s 5 may apply where only some acts occur in the UK.

Third, it is clear from the decision In the Matter of the Complaint of Sedco Inc 543 F Supp 561 (SD Tex, 1982), an early authority on the ‘entire tort’ theory under the FSIA, that this approach was based in large part on FSIA’s specific and distinct legislative history:

“Plaintiffs argue the tort may occur, in whole or in part, in the United States, and that the tort occurs in the United States if the acts or omissions directly affect this country. This argument may be correct in other circumstances, see Ohio v. Wyandotte Chemicals Corp., 401 U.S. 493, 91 S.Ct. 1005, 28 L.Ed.2d 258 (1971); however, legislative history appears to reject this theory with respect to the FSIA. In describing the purpose of § 1605(a)(5), the House Committee Report accompanying the House Bill, which ultimately became the FSIA, states:

'It denies immunity as to claims for personal injury or death, or for damage to or loss of property caused by the tortious act or omission of a foreign state or its officials or employees, acting within the scope of their authority; the tortious act or omission must occur within the jurisdiction of the United States … ‘

House Report, supra at 6619 (emphasis added). The primary purpose of this exception is to cover the problem of traffic accidents by embassy and governmental officials in this country. Id.”

There are statements to similar effect in later US cases on the entire tort doctrine: Asociacion de Reclamantes v United Mexican States 735 F.2d 1517 (DC Cir 1984) and Jerez v Cuba 775 F.3d 419 (DC Cir 2014), itself cited in Kidane. For the reasons I have given, I consider this jurisprudence to be inapplicable to the differently-worded SIA 1978.

As I did in Al-Masarir at [149], and for the same reasons, I also reject reliance by the Defendant in this case on Parliamentary statements made during the passage of the State Immunity Bill. I consider the Defendant's submissions to be contrary to the principles in Pepper v Hart since the meaning of s 5 is clear. Further, the Parliamentary statements relied upon by the Defendant would not ‘almost certainly settle the matter immediately one way or the other’, which is one of the well-known Pepper v Hart requirements.

So far as academic commentary is concerned, the passage from Dickinson, Lindsay and Loonam’s work was cited to me in Al-Masarir. I remain of the view (see at [150] of that the judgment) that the assertion, ‘if a claimant alleges a single legal wrong comprising more than one act or omission on the part of the state, each act or omission must have occurred while the actor was in the United Kingdom’ was made was made in tentative and provisional terms and there is little by way of analysis. I do not find it persuasive. The same, I think, can be said of Professor Schreuer’s work, which does not grapple with the language of s 5 and its key difference (for example) from Article 11 of the Basle Convention. He simply said:

“This requirement of a territorial connection has, in fact, turned out to be the most limiting factor in the application of the torts exception. The new codifications of immunity law invariably require the tort be committed inside the forum State. The European Convention is particularly explicit on this point in that it requires that ‘facts which occasioned the injury or damage occurred in the territory of the State of the forum, and… the author of the injury or damage was present in that territory at the time when those facts occurred’. The British Act simply refers to ‘an act or omission in the United Kingdom’. The Australia Act is very similar on this point. The International Law Association’s Draft requires that the ‘act or omission… occurred wholly or partly in the forum State’ while the ILC Draft [which became the 2004 Convention] adds that the ‘author of the act or omission was present in that territory at the time of the act or omission’. Curiously, the United States Act is somewhat vague on this point in that it only refers to the resulting damage as ‘occurring in the United States’. However, the House Report emphasizes that the tortious act or omission must occur within the jurisdiction of the United States. All this makes it clear that the torts exception to sovereign immunity will not only be unavailable to torts committed abroad but also to long distance torts like letter bombs, trans-frontier pollution and most probably also illegal acts committed by way of international channels of communication such as telephone lines or computer links.”

Taking a step back, it seems to me that to uphold the Defendant’s case would empty s 5 of much of its content. It would mean it would not apply except in the most straightforward of cases (eg, a road traffic accident involving a vehicle driven by an employee of a foreign embassy). But many, if not most, of the cases where a foreign state ought not to be immune will involve some tortious activity outside the UK, and so if the Defendant were right, the foreign state would be immune, no matter how heinous its conduct, or how high up the state’s involvement. In fact, the greater the state involvement, the more immune it would be.

Most readers, I hope, would have understood my example in [1] of Al-Masarir to be a thinly-veiled reference to the case of Alexander Litvinenko who, Sir Robert Owen found after a public inquiry, died in London in 2006 having been poisoned by two Russian agents using Polonium-210 likely manufactured and then brought into the UK from Russia (see https://www.gov.uk/government/publications/the-litvinenko-inquiry-report-into-the-death-of-alexander-litvinenko.)

If the Defendant’s submissions in this case were right, Russia would be entitled to immunity for Mr Litvinenko’s murder despite Sir Robert Owen’s conclusions in Part 10 of his report that two Russian agents were responsible and were probably acting at the direction of the FSB and on the orders of President Putin. Some of the acts which contributed to Mr Litvinenko’s killing took place in Russia, meaning that if the Defendant were right, Russia would be immune. On the other hand, if the two Russian agents had acted alone wholly in the UK on behalf of Russia, but without express orders, Russia would not be immune. That would be a perverse outcome.

I cannot conceive of any reason founded in law or justice that should permit such a result. Of course, if there were a binding reason for me to reach such a conclusion, then I would. But there is not, and I do not. The rationale for the personal injury exception to immunity lies in part in the relationship between the core principles of the sovereign equality of states and the forum state’s sovereignty over its territory. The exception gives priority to the forum state’s sovereignty when the injury or damage is caused by an act or omission on its territory: International Court of Justice, Jurisdictional Immunities of the State (Germany v. Italy; Greece intervening), ICJ Reports 2012, at [57]; Belhaj v Straw [2017] AC 964, 1063,[12]. As with the foreign act of state doctrine, English courts may not question the acts of a foreign sovereign within its own borders, but where personal injury is caused by a state official overseas outside of the embassy compound, sovereignty is not impeached by bringing the state before the forum state’s court. The acts of the foreign government are a direct challenge to the UK’s sovereignty within its own sovereign borders.

I come back to the Litvinenko case. He was poisoned on 1 November 2006 and died three weeks later on 23 November. As described by Sir Robert Owen, his poisoning directly engaged the sovereignty of the UK in the following ways, among others: it sparked a massive criminal investigation by the Metropolitan Police with the assistance of the Atomic Weapons Establishment, Public Health England, the Health and Safety Executive, the Forensic Science Service and other external experts; it caused a public health emergency as the authorities sought to identify contaminated radioactive sites; it consumed NHS resources as doctors treated Mr Litvinenko; it occupied considerable governmental time and resources and involved the security and intelligence services; it led to litigation in the High Court (R (Litvinenko) v Secretary of State for the Home Department [2014] EWHC 194 (Admin)); and it resulted in a lengthy public inquiry before a former High Court judge involving open and closed hearings and much sensitive material. It seems to me that recognising the immunity and impunity of a foreign state to interfere with rights and freedoms enjoyed by those on UK soil – and who are thus entitled to the protection of its laws – on the artificial basis that not everything happened here, would be contrary to the core underpinnings of immunity. It would also likely leave the victim without a remedy. As the Yearbook of the International Law Commission 1983, Vol. II(1), [70] states:

“Non-exercise of jurisdiction in such a case may result in a vacuum. Not only will there be a shortage of a more appropriate law to be applied, but also a more suitable court of competence will not easily be found to try the case, which may be falling between two stools. The absence of competent judicial authority and lack of applicable law would leave the injured party remediless and without adequate relief or possible recourse, except at the mercy of the foreign State, which might or might not feel obliged to pay compensation, either on a voluntary basis or ex gratia. In the interests of the rule of law and of justice, normal legal remedies should continue to be available, regardless of the public or private character of the defendant.”

Overall, I remain of the view which I expressed in Al-Masarir at [120]:

“120.

… In my judgment, the grammatical meaning of s 5, and in particular the use of the indefinite article (death or personal injury caused by 'an act or omission') (emphasis added) means what it says. There has to be an act or omission in the UK which is causative of the requisite damage on a more than de minimis basis. Parliament did not say 'the act or omission', still less, 'acts or omissions occurring entirely within the UK', both of which would have been more supportive of the Defendant's interpretation of s 5. This suggests the Claimant's contention is the correct one.”

Hence, in my judgment, the s 5 exception applies when the death, injury or damage is ‘caused by an act or omission in the United Kingdom’ (emphasis added). In accordance with the plain meaning of this phrase, it is only necessary for a single relevant act or omission more than minimally causative of the death, injury or damage to take place within the UK in order to engage the exception.

I therefore find for the Claimants on these issues.

Where a computer in the UK is manipulated from abroad, where is the act in question to be regarded as having taken place ?

The next question is where the act takes place when a computer in the UK is remotely manipulated from abroad. In my judgment, in such a scenario, this is to be regarded as an act within the UK.

In Ashton Investments Ltd, the test under PD 6B, [3.1(9)(b)] was held to be satisfied in circumstances where a ‘hack’ of devices located within the jurisdiction emanated from abroad. Jonathan Hirst QC (sitting as a deputy judge of the High Court) said:

“[62] Ashton's computer server was in London. That is where the confidential and privileged information was stored. The attack emanated from Russia but it was directed at the server in London and that is where the hacking occurred. In my view, significant damage occurred in England where the server was improperly accessed and the confidential and privileged information was viewed and downloaded. The fact that it was transmitted almost instantly to Russia does not mean that the damage occurred only in Russia. If a thief steals a confidential letter in London but does not read it until he is abroad, damage surely occurs in London. It should not make a difference that, in a digital age of almost instantaneous communication, the documents are stored in digital form rather than hard copy and information is transmitted electronically abroad where it is read. The removal took place in London. I also emphatically reject the proposition that the damages claimed are so trivial that the court should decline to bother the defendants with the claim. On the contrary, if the claimants make good the pleaded allegations at trial, then I think this is a very serious and substantial case indeed, with considerable potential ramifications. The cost of replacing the computer and the investigation/consultancy costs may not be very great, but the court will also have to consider what damages and other relief it should grant for the substantial injury caused—viz the improper obtaining of confidential and privileged information.

[63] I also consider that substantial and efficacious acts occurred in London, as well as Russia. That is where the hacking occurred and access to the server was achieved. This may have been as a result of actions taken in Russia but they were designed to make things happen in London, and they did so. Effectively the safe was opened from afar so that its contents could be removed. It would be artificial to say that the acts occurred only in Russia. On the contrary, substantial and effective acts occurred in London.”

This approach is supported by Vidal-Hall v Google Inc [2014] 1 WLR 4155, [78], and Lloyd v Google LLC [2019] 1 WLR 1265, [47], both of which concerned alleged secret transnational tracking of internet users by Google in breach of data protection legislation. Although both Vidal-Hall and Lloyd were subject to appeal, the analysis on these issues was not revisited.

In R v Governor of Brixton Prison ex parte Levin [1997] QB 65, the United States sought Mr Levin's extradition to face trial on 66 charges concerning his alleged unauthorised access to a bank's computer in the United States in order to transfer funds into various bank accounts controlled by him. He had gained access to the US computer by means of his own computer in Russia. The alleged conduct translated under English criminal law into offences of theft, forgery, false accounting and unauthorised modification of computer material. Because of how extradition law operates, there was an issue as to whether what happened in the US would, in equivalent circumstances, be regarded as having happened in England. The Divisional Court said at p81:

“For the reasons we have already indicated, the operation of the keyboard by a computer operator produces a virtually instantaneous result on the magnetic disk of the computer even though it may be 10,000 miles away. It seems to us artificial to regard the act as having been done in one rather than the other place. But, in the position of having to choose on the facts of this case whether, after entering the computer in Parsipenny [New Jersey], the act of appropriation by inserting instructions on the disk occurred there or in St. Petersburg, we would opt for Parsipenny. The fact that the applicant was physically in St Petersburg is of far less significance than the fact that he was looking at and operating on magnetic disks located in Parsipenny. The essence of what he was doing was done there. Until the instruction is recorded on the disk, there is in fact no appropriation of the rights of Bank Artha Graha

…

In the case of a virtually instantaneous instruction intended to take effect where the computer is situated it seems to us artificial to regard the insertion of an instruction onto the disk as having been done only at the remote place where the keyboard is situated.”

I do not consider there is any meaningful distinction between the facts of Levin, where there was nefarious real time manipulation from Russia of a computer in the US, and this case of a spyware attack implanting software from abroad by trickery onto a device in the UK, which then, at regular intervals under the control of the spyware program, sends data back to a C&C server abroad. The technicalities may be different, but the principle is the same. In both cases a foreign entity has taken control of a computer located in the UK in order to obtain data.

I therefore conclude that infecting a computer located in the UK with spyware from abroad is an act done in the UK for the purposes of s 5.

Have the Claimants shown on a balance of probabilities that their computers were infected by spyware by the Defendants’ servants or agents ?

I turn to the third issue raised by the Defendant, which I can take comparatively shortly. I am satisfied at this stage that the Claimants have discharged the burden on them of showing on the balance of probabilities that their computers were infected with spyware by the Defendant’s agents.

Dr Marczak’s work and analysis over a number of years, the salient parts of which I set out earlier, has been painstaking and detailed. His expertise (in a general sense) in relation to spyware cannot be doubted. True it is that he has not examined the Claimants’ computers. But he was able to work backwards and identify them as targets following the hack of Gamma Group’s data which revealed the Claimants to have been targets.

I accept of course that if the matter is tested at trial, a different conclusion might be reached. But at this stage I am satisfied that the Claimants have shown what they need to show on this issue.

Do the Claimants’ pleaded psychiatric injuries constitute ‘personal injury’ within s 5 of the SIA 1978 ?

In both Caramba-Coker and Ogbonna the EAT held that psychiatric injury fell within s 5 as a form of personal injury. I agree. As I have said, in Al-Masarir Saudi Arabia did not argue that psychiatric injury fell outside s 5.

In Caramba-Coker, a black employee at the Kuwaiti Embassy brought proceedings for wrongful dismissal and racial discrimination. He claimed he had developed a stress-related medical condition as a result of the discriminatory treatment.

Giving the Tribunal’s judgment, Keith J said at [17]:

“It is well established that personal injury encompasses psychiatric harm, and Mr Caramba-Coker was therefore claiming that he suffered psychiatric injury as a result of his dismissal.”

The issue in that case was complicated by the fact that the Employment Tribunal (ET) at first instance had not had in mind the s 5 exception because the Embassy had not raised it and it was unclear from the record whether the ET had intended to find that the claimant had suffered a personal injury, or only injury to his feelings ([20]). The EAT therefore remitted the case for the ET to decide whether the complaint of race discrimination fell within s 5 ([26]).

Brief though the EAT’s discussion was, so far as it goes, it undoubtedly more supports the Claimants’ position in this case than it does the Defendant’s position.

However, the meaning of personal injury in s 5 was considered in detail by the EAT in Ogbonna, and the correctness of Caramba-Coker was directly challenged. Given Ogbonna’s importance, I will need to quote extensively from it.  The judgment was given by the President of the EAT, Underhill J (as he then was).

The claimant, Ms Ogbonna, worked in the Nigerian High Commission.  Her employer was the Federal Republic of Nigeria.  In late 2008 her daughter became ill.  She asked for and was granted time off to look after her, though she says only with reluctance and after she had been made to ‘beg’.  She returned to work in late January 2009, but on 4 February she was summarily dismissed, ostensibly as part of a staff rationalisation.  She believed that the real reason for her dismissal was that she had sought time off. 

The claimant brought proceedings in the ET against the Republic claiming that she had been unfairly dismissed and also that her dismissal constituted discrimination on the grounds of her daughter’s disability. It was also her case that her treatment had caused harm to both her physical and her mental health.  So far as the former is concerned, it had, she pleaded, caused a recurrence of sciatica from which she had suffered in the past.  As for the latter, she says that she developed depression for which she was treated by sessions of cognitive behavioural therapy.  These symptoms and their claimed relationship to her dismissal remained to be proved.

The Republic argued it was immune under the SIA 1978. The Republic’s claim to immunity was determined by a judge of the ET as a preliminary matter of law. The judge held that the Republic was entitled to immunity in relation to the Claimant’s claim of unfair dismissal, which was accordingly dismissed; but that the disability discrimination claim constituted ‘proceedings in respect of … personal injury’ within the meaning of s 5 to the extent of the claims for compensation for her sciatica and her depressive illness, and that state immunity did not apply to that extent. The Republic appealed.

As Underhill J recorded at [5] of his judgment, he adjourned the appeal when it was first before him. He drew the attention of the parties to a decision of the Supreme Court of Canada in Schreiber, and the international law materials there referred to (both relied on by the Defendant before me), which it was agreed needed further research by the parties. 

The matter subsequently came back before Underhill J. Having considered Caramba-Coker, he said at [7]:

“7.

It is perfectly clear from that reasoning taken as a whole that this Tribunal in Caramba-Coker decided as a matter of ratio (a) that any claim for compensation for personal injury fell within the terms of section 5 notwithstanding that it was consequent on a discrimination claim, and (b) that in this context a claim of mental ill-health caused by the discrimination complained of constituted a claim for ‘personal injury’.  The decision would seem therefore on its face clearly to apply to the circumstances of the present case.  The [ET judge] was right to hold that she was bound by it.  I am of course not so bound, and [counsel for the Republic] submitted that the section 5 point was only fairly briefly dealt with in Keith J’s judgment and that it did not seem that it had been very fully argued.  I accept that; but my starting-point must nevertheless be, on ordinary principles, that I should not depart from Caramba-Coker unless I am satisfied that it was wrong.”

At [14] et seq Underhill J addressed the Republic’s third ground of appeal. This was that, whatever might be its meaning in a purely domestic context (where counsel for the Republic had conceded that it was apt to cover cases of injury to mental health), the phrase ‘personal injury’ in s 5 should be interpreted as it would be understood as a matter of international law; and that as matter of international law a claim for compensation for harm to a claimant’s mental health would be regarded as a claim for personal injuries if, but only if, it was consequent on a physical injury in the sense of some damage to the body as opposed to the mind.  The Republic argued that that is what was decided by the Supreme Court of Canada in Schreiber and that the Court expressly based its conclusion, at least to some extent, on the international jurisprudence.

At [15] Underhill J said this:

“15.

I have no difficulty with the proposition that the 1978 Act generally, and section 5 in particular, should be construed so far as possible to conform to any recognised international norm.  That is because, although the Act was not passed specifically to give effect to a treaty obligation, it was nevertheless, as appears from the speech of the Lord Chancellor introducing the bill in the House of Lords, intended to conform, at least in the relevant respects, to the terms of the European Convention on State Immunity (which was opened for signature in 1972, albeit not signed by the United Kingdom at that time).  In fact the point goes further, in that in the relevant respects the terms of the Convention were subsequently adopted by the United Nations Convention on Jurisdictional Immunities of States and their Property.  But the question is whether the relevant Conventions or the commentaries on them give any support for the construction of the phrase ‘personal injuries’ which [counsel for the Republic] advances.  I do not believe that they do.  I will take the relevant materials in turn.” 

He went on to address some of the international law materials at [16]-[17]:

“16.

I start with article 11 of the European Convention.  That reads simply as follows:

‘A Contracting State cannot claim immunity from the jurisdiction of a court of another Contracting State in proceedings which relate to redress for injury to the person or damage to tangible property, if the facts which occasion the injury or damage occurred in the territory of the State of the forum, and if the author of the injury or damage was present in that territory at the time when those facts occurred.’

That provision by itself seems to me to cast no relevant light on the question before me.  The phrase ‘injury to the person’, or ‘préjudice corporel’ in the French text (which is of equal authority), seems to me perfectly apt to cover cases of injury to mental health, though I accept that it does not necessarily do so.

17.

I turn to the explanatory report on the European Convention promulgated by the Council of Europe. Article 11 is the subject of paragraphs 47-49 of the commentary. I need only quote paragraph 48, which reads as follows:

‘Where there has been injury to the person or damage to property, the rule of non-immunity applies equally to any concomitant claims for non-material damage resulting from the same acts, provided of course that a claim for such damage lies under the applicable law (e.g. in respect of pretium doloris).  Where there has been no physical injury and no damage to tangible property the Article does not apply.  This is the case, for example, as regards unfair competition […] or defamation.’

[Counsel for the Republic] relies on the statement that ‘where there has been no physical injury … the Article does not apply’, but I cannot place any real weight on that statement in the context in which it appears.  I am ready to accept that the phrase ‘physical injury’, read literally, refers more naturally to bodily than mental harm, but it does not appear that the authors were concerned with the distinction between injury to physical and mental health.  Rather, as is clear from the concluding sentence, they were concerned with the distinction between injury to the person on the one hand and such other forms of injury as damage to economic interests or to reputation on the other.”

At [18] he addressed the UN Convention:

“18.

The next item to which [counsel for the Republic] refers consists of the Report of the International Law Commission on the work of its 43^rd session, which laid the foundations for the United Nations Convention.  Article 12 of that Convention is in substantially the same terms as article 11 of the European Convention.  In its commentary on article 12 the Report says at paragraph (5):

‘Article 12 does not cover cases where there is no physical damage.  Damage to reputation or defamation is not personal injury in the physical sense, nor is interference with contract rights or any rights including economic or social rights damage to tangible property.’

I would make the same observations about that passage as I do about the commentary on article 11 in the explanatory report on the European Convention: see above.”

He then went on to consider extracts from Lady Fox’s book, The Law of State Immunity, eg, at p577, where she commented on Article 12 of the UN Convention: 

“The tortious conduct covered by this exception is confined to acts causing physical damage to the person or property; damage resulting from words spoken or written remains immune.”

Underhill J said that, again, Lady Fox had been concerned with drawing a distinction between physical damage on the one hand and damages, to other interests, in particular to reputation, on the other.  She was not addressing the question of whether personal injury could include damage to mental health, and the use of the phrase ‘physical damage’ could not fairly be read to be expressing a view on that question.

He expressed his conclusion on the international law materials at [21]:

“In sum, I find nothing in the international law materials which supports [the Republic’s] submission that there is a recognised meaning in international law to the phrase ‘personal injury’ which is more limited than the natural meaning of those words in domestic law. 

He then turned to consider  Schreiber, which he described as being ‘of essentially secondary interest’. The plaintiff had been arrested by the Canadian police and detained for over a week under an extradition warrant issued at the request of Germany. It was his case that there was no proper basis for the issue of the warrant.  He brought proceedings against Germany in the courts of Ontario alleging various causes of action and claiming that he had suffered ‘mental distress, denial of liberty and damage to reputation’, which were collectively characterised as ‘personal injury’.  The relevant Canadian statute, the State Immunity Act 1985, contained a provision, s 6, disapplying the normal immunity rule in the case of ‘any proceedings that relate to … any death or personal injury … that occurs in Canada’. 

One of the issues before the Court was whether that provision applied to injuries of the kind pleaded by the plaintiff.  The Supreme Court upheld the decision of the Court of Appeal for Ontario that they did not, and specifically that ‘the scope of the exception … is limited to instances where mental distress and emotional upset were linked to a physical injury’ (at [42].

Underhill J said that Le Bel J, who gave the Court’s judgment, had relied to a considerable extent on Canadian case law, which appeared, he said, ‘unlike English law, to treat the phrase ‘personal injury’ as referring only to bodily injury’.  Le Bel J did, however, say that his conclusion was consistent with ‘international law sources’, and at [47] of his judgment he drew attention to the passages from the Year Book of the International Law Commission and the explanatory report on the European Convention which Underhill J had discussed earlier.

At [24]-[25] Underhill J set out his conclusions on Schreiber:

“24.

I do not believe that the Supreme Court in Schreiber was in fact concerned with the same question as arises on this appeal.  As I have noted, the ‘personal injuries’ claimed by the plaintiff consisted of “mental distress, denial of liberty and damage to reputation”.  The latter two components are on any view irrelevant; and the first, “mental distress”, naturally connotes distress or injury falling short of, and distinct from, any psychiatric injury.  The Court was not therefore faced with a case like the present, where the claimant asserts that the state defendant has injured his or her mental health.  The decision that a claim of personal injury required a physical injury must be read in that light.  There are in fact some indications - falling short, I accept, of any ruling - that the Court would have regarded “physical injury” as extending at least in some circumstances to an injury to mental health.  I have in mind in particular paragraph 60: in a passage discussing the effect of the French text of the statute, which, like article 11 of the European Convention uses the phrase ‘préjudice corporel’, Mr Justice Le Bel says ‘this type of breach could conceivably cover an overlapping area between physical harm and mental injury, such as nervous stress’. 

25.

Even if, contrary to that view, Schreiber is to be read as excluding from the definition of personal injury in section 6 of the Canadian State Immunity Act any psychiatric injury which is unaccompanied by physical injury, I cannot regard that as persuasive authority, still less binding.  The international materials referred to were only a small part of the Court’s reasoning for its conclusion; and for the reasons already given I do not believe that they justify the conclusion that the phrase ‘personal injury’ has a recognised meaning in international law which would exclude psychiatric injury.  Once that point is recognised, the decision is essentially one based on the Canadian case-law.”

At [27]-[28] Underhill J set out his overall conclusions:

“27.

I therefore agree, even after the fuller argument with which I have been favoured, with the conclusion of this Tribunal in Caramba-Coker that there is no reason why the phrase ‘personal injury’ should not be given its normal meaning in domestic law, which, as it is well recognised, is apt to cover cases of psychiatric as well as physical injury.  Since that point is uncontroversial I need not refer to extensive authority.  I mention only one of the cases cited by [counsel for the claimant], R v Dhaliwal [2006] 2 Cr App R 24, which reviews the authorities as regards both civil and criminal claims. 

28.

This is a result which I am glad to reach.  Not only is the distinction urged on me by [the Republic] one which would mean that the concept of personal injury in section 5 of the Act was different from its meaning elsewhere in English law but it would give rise to what would frequently be difficult, and frankly artificial, debates about the extent to which a particular injury in respect of which claim was made was physical or mental.  The whole trend of recent authority has been to recognise that these kinds of distinction are difficult both conceptually and evidentially.”

The Republic’s appeal was accordingly dismissed.

Ogbonna was recently referred to by the Court of Appeal in Corinna Zu Sayn-Wittgenstein-Sayn v His Majesty Juan Carlos Alfonso Victor María de Borbón y Borbón [2022] EWCA Civ 1595. The appellant was the former King Juan Carlos I of Spain. He abdicated on 18 June 2014, in favour of his son, King Felipe VI. The respondent was a Danish national who was a resident of Monaco between 2008 and 2019. The appellant and respondent were in an intimate relationship from 2004 to 2009. In the underlying proceedings issued by the respondent, she alleged that, from 2012, the appellant engaged in a course of conduct amounting to harassment pursuant to the Protection from Harassment Act 1997. She sought damages and an injunction in respect of acts both prior to and after the abdication. By an application notice dated 18 June 2021 the appellant sought an order declaring that the court had no jurisdiction to try those (and later) allegations because he was entitled to immunity under the SIA 1978. Nicklin J refused the application and the appellant appealed.

At [71]-[74] Simler LJ said:

“71.

The judge addressed the argument advanced on the respondent's behalf by reference to the personal injury exception in section 5 SIA as follows:

‘76. Although, based on my decision, the point does not arise, I should deal, finally, with the submission that, had an immunity subsisted, the Claimant's claim could nevertheless continue on the basis of s.5 SIA. I would have rejected that argument. The Claimant's claim is for pure harassment. The loss she claims does not include a claim for any recognised psychiatric injury (see [10] above). As such, I do not accept that the Claimant's claim is, or includes, a claim for personal injury. A claim for distress and anxiety arising from an alleged course of conduct amounting to harassment is not, without more, a personal injury claim. Neither of the authorities relied upon by Mr Lewis QC assists the Claimant. The claimant in Jones v Ruth was pursuing a claim for psychiatric injury (i.e. a claim for personal injury). Nigeria v Ogbonnais authority only for the proposition that ‘personal injury’, as used in s 5 SIA, should be given its normal meaning in domestic law; ie to include a claim for a recognised psychiatric injury (see [27] per Underhill J). The short point is that, in her Particulars of Claim, the Claimant makes no claim that she has been caused a recognised psychiatric injury by the alleged harassment. Her claim is therefore not a claim for personal injury within the terms of s.5 SIA; it is a claim for distress caused by the alleged harassment.’

72.

Mr Lewis accepted that the original pleading did not specifically use the phrase "personal injury" or adduce a medical expert report as to any asserted psychiatric injury suffered by the respondent, as is required for a personal injury claim by CPR 16PD 4. However, the Particulars of Claim pleaded a claim at paragraph 7.1 for damages caused by anxiety and damage to the respondent's health caused by harassment. Moreover, he relied on the clearly pleaded claim at paragraphs 56.1 and 56.3, for damages for anxiety, distress and depression. Although in writing he submitted this sufficiently pleaded a recognised psychiatric injury, he accepted in the course of the hearing, that it did not, and that personal injury was not in fact pleaded in the original Particulars of Claim.

73.

However, he maintained that these passages made clear that the respondent intended to claim damages for injury to her health, and it was open to her to provide further particulars documenting the extent of her injuries (which she has now done in the draft Re-Amended Particulars of Claim, including by reference to an expert medical report). Certainly, by the time of the hearing before the judge and having raised reliance on section 5 SIA, it was clear that she regarded her claim as a claim for personal injury, and the amended pleading demonstrates that this is the case she intends to run. The amendment would cure any defect and she should have been given the opportunity to cure any defect in her pleading, if there is one.

74.

I do not accept these submissions and can see no error in the judge's conclusion in respect of section 5 SIA. The claim was plainly not pleaded as a personal injury claim nor were damages for personal injury claimed in the prayer. As the judge correctly held, a claim for distress and anxiety arising from an alleged course of conduct amounting to harassment is not, without more, a personal injury claim. The short point, again as the judge observed, is that the respondent made no claim that she has been caused a recognised psychiatric injury by the alleged harassment. Her claim is therefore not a claim for personal injury within the terms of section 5 SIA. It is simply a claim for distress, anxiety and depression (none of which, as pleaded, are recognised psychiatric conditions) caused by the alleged harassment.”

There is no suggestion in this passage that the Court of Appeal was in doubt about Underhill J’s conclusion in Ogbonna.

I turn to the meaning of ‘personal injury’ in the domestic law context. Although Underhill J said the point was uncontroversial, I think it helpful to cite a few authorities which illustrate why it is so firmly established in domestic law at the highest level that personal injury includes psychiatric injury.

As long ago as 1943, in Bourhill v Young[1943] AC92, p103, Lord Macmillan said:

“The crude view that the law should take cognisance only of physical injury resulting from actual impact has been discarded, and it is now well recognised that an action will lie for injury by shock sustained through the medium of the eye or the ear without direct contact. The distinction between mental shock and bodily injury was never a scientific one.”

In R v Chan-Fook (1994) 99 Cr App R 147, p152, the principle which Hobhouse LJ extracted from the authorities was that:

“… the phrase ‘actual bodily harm’ is capable of including psychiatric injury. But it does not include mere emotions … nor does it include, as such, states of mind that are not themselves evidence of some identifiable clinical condition. The phrase ‘state of mind’ is not a scientific one and should be avoided in considering whether or not a psychiatric injury has been caused …”

In Page v Smith [1996] AC 155, the House of Lords considered a claim for damages for personal injury which took the form of a re-appearance of myalgic encephalomyelitis (or chronic fatigue syndrome). Lord Lloyd of Berwick observed at p190:

“There is no justification for regarding physical and psychiatric injury as different ‘kinds of damage’ … a defendant who is under a duty of care to the plaintiff … is not liable for damages for nervous shock unless the shock results in some recognised psychiatric illness”

In R v Ireland [1998] AC 147, the certified questions before the House of Lords on two conjoined appeals raised the common issue of whether psychiatric injury was ‘bodily harm’ for the purposes of the offences contrary to ss 18, 20 and 47 of the Offences Against the Person Act 1861 (see at p156). Counsel for the appellants challenged Chan-Fook as being wrongly decided. That argument was rejected. Lord Steyn said at pp158-159:

“The proposition that the Victorian legislator when enacting sections 18, 20 and 47 of the Act of 1861, would not have had in mind psychiatric illness is no doubt correct. Psychiatry was in its infancy in 1861. But the subjective intention of the draftsman is immaterial. The only relevant inquiry is as to the sense of the words in the context in which they are used. Moreover the Act of 1861 is a statute of the ‘always speaking’ type: the statute must be interpreted in the light of the best current scientific appreciation of the link between the body and psychiatric injury.

For these reasons I would, therefore, reject the challenge to the correctness of R v Chan-Fook[1994] 1WLR689. In my view the ruling in that case was based on principled and cogent reasoning and it marked a sound and essential clarification of the law. I would hold that “bodily harm” in sections 18, 20 and 47 must be interpreted so as to include recognisable psychiatric illness.”

Given these consistent and high statements of principle, it seems to me that very cogent reasons would need to be given for construing ‘personal injury’ in s 5 of the SIA 1978 in a different and narrow way so as to exclude psychiatric injury.

For all of the reasons given by Underhill J, with which I respectfully agree, and which are contrary to the submissions on this aspect of this appeal by the Defendant, there is no such cogent basis for such a conclusion. Whilst some of the materials relied on by the Defendant superficially provide some support for its position, on closer analysis, they do not provide any real support. They were just not aimed at the point at issue here.

Furthermore, I think one of the authorities relied on by the Defendant undermines its argument. Earlier, I referred to Xiaodong Yang’s assertion that ‘personal injury’ has been generally understood to refer only to ‘physical injury’, thus precluding claims for ‘mental injury and psychological injury’. There is a footnote to this passage which is instructive. Footnote 20, after ‘psychological injury’ states:

“On the other hand, psychiatric harm is usually treated as a species of personal/physical injury: Military v. Caramba-Coker, England, 2003 WL 1610407, paras 16, 17 and 20.”

I do not therefore think this passage assists the Defendant and is, in fact, against it.

My conclusion is reinforced because, as the Claimants point out, since Ogbonna was decided, there has been support in academic commentary for the view that the terms ‘personal injury’ and ‘injury to the person’ in international instruments do not have an autonomous meaning in international law. For example, the commentary on Article 12 of the UN Convention, by Foakes and O’Keefe in O’Keefe and Tams (eds), United Nations Convention on Jurisdictional Immunities of States and their Property: A Commentary (OUP, 2013), p218, states:

“For the exception to immunity from jurisdiction specified in Article 12 to apply, the pecuniary compensation sought in the proceedings against the State must be for ‘death or injury to the person’ or for ‘damage to or loss of tangible property’. Claims alleging, for example, damage to reputation, loss of amenity, interference with privacy, or economic loss not consequential upon death or personal injury or damage to or loss of tangible property do not fall within Article 12. As a result, as far as Article 12 goes, a State remains immune from foreign proceedings alleging, for example, defamation, nuisance, misrepresentation, or interference with contractual rights, incorporeal hereditaments, or choses in action. At the same time, it is important to highlight that the ILC commentary may be misleading when it states, in relation specifically to injury to the person, that ‘Article 12 does not cover cases where there is no physical damage’. There is no clear warrant for this assertion in the text of Article 12, which refers simply to ‘injury to the person’.

…

Whether a claim for pecuniary compensation is considered to be one for ‘injury to the person’, a term not defined in the Convention, will probably depend on the applicable domestic law. In many jurisdictions, the development of a recognized psychiatric illness as a result of another’s act or omission is deemed in and of itself to constitute injury to the person, while in other jurisdictions it may not be. Conversely, while in many jurisdictions mere pain and suffering or emotional distress not amounting to a recognized psychiatric condition are not compensable unless consequential upon some form of physical injury, other jurisdictions may class these things as injury to the person in their own right. Article 12 does not on its face dictate such legal characterizations of fact. The same goes, mutatis mutandis, for whether the proceedings against the State relate to damage to or loss of ‘tangible property’.”

At the least, this article demonstrates a distinct lack of international consensus on the issue, and demonstrates that international law cannot bear the weight the Defendant seeks to put on it in support of a reading of personal injury in s 5 which would run counter to clear and settled domestic law on the meaning of that term in a variety of different contexts.

Have the Claimants’ shown on a balance of probabilities that they have suffered psychiatric injury ?

I turn to the specific injury relied upon by the Claimants. I set out their pleaded cases earlier.

The expert they rely upon, Dr Martin Baggaley, is a Fellow of the Royal College of Psychiatrists. He is approved under s 12(2) of the Mental Health Act 1983. He is consultant psychiatrist in the South London & Maudsley NHS Foundation Trust. He has particular experience in treating and assessing individuals who have suffered a traumatic experience.

In his report of 18 April 2019 in respect of the First Claimant, he summarised his conclusions as follows ([3], emphasis added):

“Dr Shehabi has a long history of political activism in relation to opposition to the current Bahraini regime. He discovered that his electronic devices had been targeted by the FinFisher software. He felt shocked and was very concerned that he had betrayed many friends colleagues and family in Bahrain and elsewhere and caused their personal safety and security to be compromised. He has developed symptoms of a recognisable psychiatric illness, an adjustment disorder. He would benefit from a course of cognitive behavioural therapy. I am guarded about the prognosis.”

At [11] Dr Baggaley said:

“Diagnosis. Dr Shehabi described experiencing a number of symptoms of insomnia, anxiety, paranoid thoughts, intrusive distressing thoughts of the situation and low mood which would be best classified as an adjustment disorder F43.2 in the International Classification of Diseases Version 10 (ICD-10). In my opinion this is of moderate severity.”

Dr Baggaley’s report on the Second Claimant is dated 14 April 2019. His conclusions are summarised at [3]:

“Summary. Mr Mohammed become politically active from a young age. He was imprisoned and tortured on a number of occasions as a young man in Bahrain. He came to the UK and was treated by the Medical Foundation for the Care of Victims of Torture (now known as Freedom from Torture). He began to become concerned that his electronic devices and social media sites were being hacked into from approximately 2011. He learnt that his devices had been infiltrated by FinFisher in August 2014. He has developed a chronic adjustment disorder. This is liable to run a continuing chronic course. He might benefit from some cognitive behavioural therapy but it would be a challenge to find a suitable therapist.”

At [10] he wrote:

“Diagnosis. Mr Mohammed presented with variety of symptoms including disturbed sleep, low mood, anxiety and poor concentration. I believe that the symptoms are best categorised as an Adjustment Disorder (a prolonged depressive reaction), F43.21 in the International Classification of Diseases Version 10 (ICD-10). The disorder is of moderate severity and has been present since 2011.”

From this evidence I conclude that the Claimants have shown on a balance of probabilities that they suffered psychiatric injury as a consequence of their computers being infected, and that their claims, accordingly, fall within the exception to immunity in s 5 of the SIA 1978.

Article 6 of the ECHR

This issue would only have arisen if I had been against the Claimants on their primary submission. However, as I have found in their favour, it follows I do not need to consider the Claimants’ alternative case based on Article 6 of the ECHR.

It follows that I dismiss the Defendant’s application.