# UK Supreme Court Rejects Bahrain's State Immunity Claim in FinSpy/FinFisher Spyware Surveillance Case (Shehabi v Kingdom of Bahrain)

> The UK Supreme Court ruled 3-2 that the Kingdom of Bahrain cannot claim state immunity over allegations it covertly installed FinSpy (FinFisher) spyware on the UK-based laptops of dissidents Saeed Shehabi and Moosa Mohammed around 2011, enabling data exfiltration, communications interception, and covert microphone/camera surveillance. The ruling caps a decade-long documented FinSpy campaign against Bahraini lawyers, journalists, and opposition figures first exposed by Citizen Lab (2012) and the 2014 Gamma International leak, and establishes that remote spyware installation on a device physically located in the UK falls within the personal-injury exception to the State Immunity Act 1978.

- **Published:** 2026-07-27T00:00:00Z
- **Last reviewed:** 2026-07-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1726
- **ID:** TL-2026-1726
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** TRACKING
- **Actor:** Government of the Kingdom of Bahrain (Bahrain)
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 27 July 2026 the UK Supreme Court dismissed an appeal by the Kingdom of Bahrain seeking to block a civil suit brought by UK-resident dissidents Saeed Shehabi and Moosa Mohammed, who allege Bahraini agents infected their laptops with FinSpy (FinFisher) spyware around 2011. The 3-2 majority held that because the hacking occurred on devices located in the United Kingdom, the harassment/personal-injury claims fall within section 5 of the State Immunity Act 1978 and Bahrain cannot shield itself with sovereign immunity. The case (previously rejected by the High Court in 2023 and the Court of Appeal on 4 October 2024) is a landmark precedent for holding states accountable for transnational cyber-espionage conducted against dissidents on foreign soil, with direct implications for the commercial surveillance-vendor industry.

FinSpy is the flagship intrusion tool of the FinFisher/FinFisher GmbH suite, marketed by the Gamma Group (Gamma International Ltd, UK; Gamma International GmbH, Munich) as a 'lawful intercept' governmental IT-intrusion product. Bahrain's use of the tool was first technically exposed by Citizen Lab's July 2012 report 'From Bahrain With Love: FinFisher's Spy Kit Exposed', which analyzed FinSpy samples delivered to Bahraini activists via spearphishing emails impersonating Al Jazeera correspondent Melissa Chan, using RAR archives and right-to-left-override (RLO) Unicode tricks to disguise executables as images/documents. Infected machines exfiltrated screenshots, keystrokes, Skype calls, and microphone/webcam captures to a command-and-control server (77.69.140.194) sitting in Bahraini Batelco ADSL IP space, alongside Gamma-operated infrastructure (tiger.gamma-international.de, ff-demo.blogdns.org).

A 6 August 2014 breach of Gamma International's internal network by the hacker 'Phineas Fisher' (40GB of leaked source code, sales records, and customer-support tickets, later mirrored on WikiLeaks) confirmed that Bahraini authorities infected at least 77 computers between 2010 and 2012, including those of opposition leader Hassan Mushaima (infected 14 November 2010), human-rights lawyer Mohamed Altajer (infected 24 January 2011, the same day he was sent a blackmail video), and UK-resident activists Shehabi and Mohammed. Privacy International filed a criminal complaint with the UK National Crime Agency on 13 October 2014 over Gamma International UK's role in supplying the malware. FinFisher GmbH entered insolvency proceedings in December 2021/2022 amid German export-control investigations, and four former FinFisher executives were charged in Munich in 2023 over an unlicensed sale of the system to Turkey.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1585 Establish Accounts
- T1583 Acquire Infrastructure
- T1566 Phishing
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1542 Pre-OS Boot
- T1548 Abuse Elevation Control Mechanism
- T1404 Exploitation for Privilege Escalation
- T1134 Access Token Manipulation
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1574 Hijack Execution Flow
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1055 Process Injection
- T1497 Virtualization/Sandbox Evasion
- T1056 Input Capture
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1012 Query Registry
- T1518 Software Discovery
- T1082 System Information Discovery
- T1113 Screen Capture
- T1123 Audio Capture
- T1005 Data from Local System
- T1429 Audio Capture
- T1430 Location Tracking
- T1636 Protected User Data
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [UK court rejects Bahrain immunity claim in spyware case](https://therecord.media/uk-court-rejects-bahrain-immunity-claim-spyware-case)
- [The Kingdom of Bahrain (Appellant) v Shehabi and another (Respondents)](https://supremecourt.uk/cases/uksc-2024-0152)
- [UK Supreme Court says no state immunity for Bahrain in surveillance case](https://www.middleeasteye.net/news/supreme-court-says-no-state-immunity-bahrain-uk-surveillance-case)
- [Bahrain cannot claim sovereign immunity for spyware attack against UK dissidents, top UK court rules](https://www.computerweekly.com/news/366646130/Bahrain-cannot-claim-sovereign-immunity-for-spyware-attack-against-UK-dissidents-top-UK-court-rules)
- [Shehabi v Kingdom of Bahrain (Court of Appeal judgment)](https://www.judiciary.uk/wp-content/uploads/2024/10/Shehabi-v-Kingdom-of-Bahrain-04.10.24.pdf)
- [From Bahrain With Love: FinFisher's Spy Kit Exposed](https://citizenlab.ca/research/from-bahrain-with-love-finfishers-spy-kit-exposed/)
- [The SmartPhone Who Loved Me: FinFisher Goes Mobile?](https://citizenlab.ca/research/the-smartphone-who-loved-me-finfisher-goes-mobile/)
- [Elusive FinFisher Spyware Identified and Analyzed](https://www.eff.org/deeplinks/2012/07/elusive-finfisher-spyware-identified-and-analyzed)
- [Leaked Files: German Spy Company Helped Bahrain Hack Arab Spring Protesters](https://theintercept.com/2014/08/07/leaked-files-german-spy-company-helped-bahrain-track-arab-spring-protesters/)
- [Bahrain Government Hacked Lawyers and Activists with UK Spyware](https://bahrainwatch.org/blog/2014/08/07/uk-spyware-used-to-hack-bahrain-lawyers-activists/)
- [Bahraini Government, With Help From FinFisher, Tracks Activists Living In The United Kingdom](https://privacyinternational.org/blog/1231/bahraini-government-help-finfisher-tracks-activists-living-united-kingdom)
- [Privacy Group Targets British Spyware Company over Bahrain Surveillance](https://theintercept.com/2014/10/13/privacy-group-targets-british-spyware-company-bahrain-surveillance/)
- [FinFisher spyware used to snoop on Bahraini activists, police told](https://www.theregister.com/security/2014/10/16/finfisher-spyware-used-to-snoop-on-bahraini-activists-police-told/1326062)
- [FinFisher (Software) - MITRE ATT&CK S0182](https://attack.mitre.org/software/S0182/)
- [FinFisher](https://en.wikipedia.org/wiki/FinFisher)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1726