Last month, the Supreme Court of the United Kingdom issued a highly anticipated decision in The Kingdom of Bahrain v. Shehabi and another (Shehabi). The claimants, two Bahraini dissidents living in the U.K., allegedly suffered psychological harm after Bahrain used FinSpy spyware to hack into their devices. In an important step towards accountability, the court ruled that Bahrain was not immune from litigation arising from the use of the spyware.

Citizen Lab researchers Siena Anstis, Natalia Krapiva, and Kate Pundyk write in Lawfare that this decision is significant for transnational repression. Cross-border hacking is a growing concern, and seeking a remedy is difficult. The Shehabi ruling “provides exiles in the U.K. with greater certainty that claims against foreign states for spyware hacking will be viable at the jurisdictional stage, opening substantive pathways for victims to obtain redress,” according to the authors. 

The case will return to the U.K. High Court of Justice, where attribution, causation, and injury must be proven. However, the authors write that “by removing the blunt defense of state immunity from these cases, the U.K. Supreme Court has dealt a meaningful victory to individuals and organizations fighting spyware and other forms of digital transnational repression.”