The Question at Hand
Your risk register probably doesn't include "state-sponsored cyber espionage against dissidents on your soil" as a threat scenario. However, the UK Supreme Court's 3-2 decision in the Bahrain spyware case raises a critical question: when a government deploys surveillance tools across borders, can it claim sovereign immunity to avoid legal consequences?
Two Bahraini dissidents living in the UK alleged that government agents infected their laptops with FinSpy spyware, monitoring their communications with political prisoners and torture victims. Bahrain argued that state immunity should block the lawsuit entirely. The court disagreed, ruling that because the alleged hacking occurred in the UK, immunity doesn't apply.
This isn't an abstract legal debate. It's a precedent that could reshape how organizations assess risk from state-sponsored cyber activities, how governments justify surveillance tool procurement, and how courts treat cross-border digital intrusion.
The Case for Limiting State Immunity in Cyber Operations
The argument against immunity rests on jurisdiction and harm. If a government's digital intrusion occurs on another nation's territory and causes harm there, why should sovereignty shield it from accountability?
The court found that the alleged hacking constituted illegal harassment under UK law. The spyware "allowed access to and exfiltration of information on the computers, interception of communications conducted using the computers, and use of the computers' microphones and cameras to surveil the respondents," according to the opinion. This isn't diplomatic correspondence or intelligence gathering in the abstract. It's sustained, invasive monitoring of individuals on British soil.
This view treats cyber operations like physical ones. If Bahraini agents had broken into the dissidents' homes in London to install listening devices, state immunity wouldn't apply. The digital equivalent shouldn't get different treatment just because the perpetrators never crossed a border physically.
For compliance practitioners, this approach creates clearer boundaries. If your organization operates in jurisdictions where courts reject immunity for cross-border cyber intrusion, you can build risk frameworks around enforceable legal standards. When governments face potential liability, they might exercise more restraint in deploying surveillance tools against individuals in foreign countries.
The commercial spyware market also faces scrutiny. FinSpy (also known as FinFisher) has been described by The Citizen Lab as sophisticated spyware "sold exclusively to governments for intelligence and law enforcement purposes." FinFisher declared insolvency in 2022 amid investigations into its business dealings. If vendors know their government clients can't hide behind immunity when tools are misused, procurement decisions might shift toward more accountable uses.
The Case for Preserving State Immunity
The counterargument centers on sovereignty and diplomatic stability. State immunity exists to prevent courts from second-guessing foreign governments' actions, particularly in national security matters. Without it, every intelligence operation could trigger lawsuits in multiple jurisdictions.
Intelligence agencies conduct surveillance. That's their function. If every target of foreign intelligence gathering could sue in their home country's courts, the entire framework of international relations would fracture. Countries would face endless litigation for activities that, while uncomfortable, fall within the traditional scope of state action.
The minority in the 3-2 decision presumably worried about this slippery slope. Where does monitoring end and harassment begin? If Bahrain's alleged installation of spyware crosses the line, what about signals intelligence that intercepts communications? What about vulnerability scanning that probes networks without authorization? Courts aren't equipped to adjudicate the legitimacy of intelligence operations.
There's also a reciprocity concern. If UK courts allow lawsuits against Bahrain for cyber activities, other countries could use the precedent against British intelligence services. GCHQ's activities would face legal challenges in foreign courts. The precedent cuts both ways.
For risk managers, this uncertainty is the problem. If state immunity applies inconsistently, you can't predict which government actions might trigger legal exposure. Your threat model becomes a guessing game about which courts will hear which claims.
Where Practitioners Actually Land
In practice, most organizations don't treat state-sponsored cyber activity as a legal risk they can manage. You can't sue your way out of Advanced Persistent Threat activity. The UK Supreme Court decision doesn't change that for most enterprises.
But it does matter for three groups:
Spyware vendors now face the possibility that their government clients won't be shielded from liability when tools are misused. That changes the risk calculation for selling intrusive surveillance capabilities. If you're a compliance officer at a security software company, you're reassessing which government contracts expose you to downstream liability.
International organizations with dissidents or activists need to account for this precedent in duty-of-care frameworks. If you're protecting journalists, human rights workers, or political dissidents who might be targeted by their home governments, the UK decision suggests that host countries might allow legal recourse. That doesn't prevent the surveillance, but it creates a deterrent.
GRC teams managing cross-border operations should note the jurisdictional principle. The court ruled that where the harm occurs matters more than where the perpetrator sits. That's relevant for data protection impact assessments, incident response planning, and vendor risk management. If your systems are used to facilitate cross-border surveillance, you might face liability even if the ultimate decision-maker claims immunity.
Our Take
The UK Supreme Court got this right, but not because it solves the state-sponsored cyber threat problem. It doesn't. Bahrain's alleged actions won't stop because of this lawsuit, and other governments won't suddenly abandon surveillance operations.
What the decision does is reject the idea that digital intrusion deserves special immunity protection. If physical surveillance on foreign soil doesn't get immunity, neither should its digital equivalent. The court treated the alleged spyware installation as what it was: sustained harassment causing harm in the UK.
For compliance practitioners, the lesson isn't that you can now sue hostile governments. It's that jurisdictional boundaries in cyberspace aren't as blurry as governments claim. When state-sponsored cyber activities cause harm on your territory, your courts can assert jurisdiction. That won't stop the next APT campaign, but it might make governments think twice before deploying commercial spyware against individuals in countries with strong legal systems.
The real compliance implication is for vendors. If you're selling surveillance capabilities to governments, you can't assume your clients will be shielded from liability when they use those tools across borders. That changes your due diligence requirements, your contract terms, and your risk appetite.
The 3-2 split shows this isn't settled law. But the precedent is set: state immunity won't automatically block lawsuits over cross-border cyber intrusion. Build your frameworks accordingly.
