UK court allows spyware lawsuits against states

UK Supreme Court ruled Bahrain isn't immune from a lawsuit by dissidents allegedly hacked with FinSpy spyware, easing legal paths for spyware victims.

The UK Supreme Court issued a ruling in The Kingdom of Bahrain v. Shehabi, a case brought by two Bahraini dissidents living in the UK who allege they suffered harm after Bahrain used FinSpy spyware to compromise their devices. The Court held that Bahrain could not claim state immunity to block the litigation, marking a significant precedent for victims of transnational repression seeking legal redress against foreign governments that deploy commercial spyware against exiles and dissidents abroad.

Citizen Lab researchers, writing in Lawfare, characterize the ruling as removing a major jurisdictional barrier ('the blunt defense of state immunity') that has historically prevented spyware victims from pursuing claims against state actors in UK courts. The case now returns to the UK High Court of Justice, where the claimants must still prove attribution, causation, and injury — meaning the substantive legal battle over whether Bahrain is responsible for the hacking is not yet resolved, but the jurisdictional hurdle has been cleared.

This is a legal and policy development rather than an active threat report; there is no new technical disclosure, exploit, or indicator associated with this article. Its significance for defenders and civil society organizations lies in the precedent it sets: individuals targeted by state-sponsored spyware (such as FinSpy/FinFisher, deployed by various governments against journalists, activists, and dissidents) may have improved prospects for civil litigation against foreign states in UK courts going forward.

Source reporting: https://citizenlab.ca/uk-supreme-court-opens-door-for-spyware-victims-to-sue-foreign-states