UK court allows spyware lawsuits against states
UK Supreme Court ruled Bahrain isn't immune from a lawsuit by dissidents allegedly hacked with FinSpy spyware, easing legal paths for spyware victims.
Sourcecitizenlab.ca — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
The UK Supreme Court issued a ruling in The Kingdom of Bahrain v. Shehabi, a case brought by two Bahraini dissidents living in the UK who allege they suffered harm after Bahrain used FinSpy spyware to compromise their devices. The Court held that Bahrain could not claim state immunity to block the litigation, marking a significant precedent for victims of transnational repression seeking legal redress against foreign governments that deploy commercial spyware against exiles and dissidents abroad.
Citizen Lab researchers, writing in Lawfare, characterize the ruling as removing a major jurisdictional barrier ('the blunt defense of state immunity') that has historically prevented spyware victims from pursuing claims against state actors in UK courts. The case now returns to the UK High Court of Justice, where the claimants must still prove attribution, causation, and injury — meaning the substantive legal battle over whether Bahrain is responsible for the hacking is not yet resolved, but the jurisdictional hurdle has been cleared.
This is a legal and policy development rather than an active threat report; there is no new technical disclosure, exploit, or indicator associated with this article. Its significance for defenders and civil society organizations lies in the precedent it sets: individuals targeted by state-sponsored spyware (such as FinSpy/FinFisher, deployed by various governments against journalists, activists, and dissidents) may have improved prospects for civil litigation against foreign states in UK courts going forward.
Mentioned in this report
Source reporting: https://citizenlab.ca/uk-supreme-court-opens-door-for-spyware-victims-to-sue-foreign-states
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs