UK Supreme Court Denies Bahrain State Immunity in Spyware Case

Devdiscourse

UK Supreme Court Denies Bahrain State Immunity in Spyware Case

First seen 27 Jul 2026, 16:09 UTC • •62.9

Article Content

1 / 40

Browse articles

ThreatCluster •July 28, 2026 at 15:18 UTC

•The UK Supreme Court ruled Bahrain cannot claim state immunity in a spyware lawsuit.
•Dissidents Saeed Shehabi and Moosa Mohammed allege their computers were hacked with FinSpy in 2011.
•The ruling allows for potential accountability of foreign states for cyber actions conducted from abroad.

The UK Supreme Court ruled that Bahrain cannot claim state immunity against a lawsuit by two dissidents, Saeed Shehabi and Moosa Mohammed, who allege their computers were hacked with FinSpy spyware in 2011. The court's decision, made by a 3-2 majority, allows the case to proceed, asserting that the alleged surveillance occurred in the UK, thus falling under the personal injury exception to state immunity. The plaintiffs claim to have suffered psychiatric harm after discovering the hacking in 2014. Bahrain has denied the allegations and sought immunity based on the argument that the surveillance was conducted from abroad. This ruling could set a precedent for future cases against foreign states in the UK. The case is expected to return to the High Court for further proceedings.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 44d ago How this analysis works

Timeline

2011-09-01

Alleged spyware infection began

Saeed Shehabi and Moosa Mohammed claim their computers were infected with FinSpy spyware, allowing surveillance by Bahraini agents.

2014-08-01

Discovery of hacking

The plaintiffs learned about the spyware infection through disclosures by WikiLeaks and Bahrain Watch, leading to their lawsuit.

2020-01-01

Lawsuit filed

Shehabi and Mohammed filed their lawsuit in London's High Court seeking damages for psychiatric harm due to the alleged hacking.

2023-01-01

High Court ruling against Bahrain

The High Court ruled that Bahrain's claim of state immunity was invalid, allowing the case to proceed.

2024-10-01

Court of Appeal upholds High Court decision

The Court of Appeal confirmed the High Court's ruling, rejecting Bahrain's appeal on state immunity.

Solicitorsjournal

2026-07-27

Supreme Court ruling

The UK Supreme Court ruled by a 3-2 majority that Bahrain cannot claim state immunity, allowing the lawsuit to proceed.

Globalbankingandfinance

More articles in this cluster (39)

Threat Graph

15 entities, 22 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (8)

Data Breach
Malware
Zero-day Exploit
T1041 - Exfiltration Over C2 Channel
T1056.001 - Keylogging
T1056 - Input Capture
T1068 - Exploitation for Privilege Escalation
T1123 - Audio Capture

Organization (2)

Gamma Group
Kingdom Of Bahrain

Malware (3)

FinFisher
FinSpy
Pegasus

Affected Platform (2)

Android
IOS

Relationships

FinFisher targets Gamma Group
FinFisher targets Kingdom Of Bahrain
FinSpy targets Gamma Group
FinSpy targets Kingdom Of Bahrain
Pegasus targets Gamma Group
Pegasus targets Kingdom Of Bahrain
Data Breach targets Android
Data Breach targets IOS
Malware targets Android
Malware targets IOS
Zero-day Exploit targets Android
Zero-day Exploit targets IOS
T1041 - Exfiltration Over C2 Channel targets Android
T1041 - Exfiltration Over C2 Channel targets IOS
T1056.001 - Keylogging targets Android
T1056.001 - Keylogging targets IOS
T1056 - Input Capture targets Android
T1056 - Input Capture targets IOS
T1068 - Exploitation for Privilege Escalation targets Android
T1068 - Exploitation for Privilege Escalation targets IOS
T1123 - Audio Capture targets Android
T1123 - Audio Capture targets IOS

Following this threat?

Track FinFisher and Gamma Group in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Cisco FMC Vulnerabilities Under Active Exploitation Cisco's Secure Firewall Management Center (FMC) Software has two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20316, that are currently being exploited by state-sponsored and ransomware actors. CVE-2026-20079, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to bypass authentication and…

BlueMoon Exploit Kit Targeting Chrome and Windows by Multiple State Actors A new exploit kit named BlueMoon has been rapidly adopted by at least four espionage groups, primarily linked to China, exploiting vulnerabilities in Google Chrome and Microsoft Windows. The first observed use of BlueMoon was on August 28, 2026, by the China-aligned threat actor TA412, with subsequent adoption by…