Bahrain faces legal action after planting Pegasus spyware on UK blogger

The High Court in London has ordered that a blogger who was tortured over his political views can take legal action against the Kingdom of Bahrain because his mobile phone was hacked by Pegasus spyware after he fled to the UK.

The court has given Yusuf Al-Jamri permission to serve a claim for damages against the Kingdom, which has a track record of human rights abuses against political opponents, over allegations that the administration hacked his mobile phone.

The case is the first to be filed from the UK against Bahrain over the Kingdom’s use of Pegasus software, supplied by Israeli company NSO Group. By granting the application, the UK High Court has agreed there is an arguable case against the Kingdom of Bahrain.

According to analysis by the University of Toronto’s Citizen Lab, Al-Jamri’s mobile phone – an iPhone 8 – was hacked with Pegasus spyware in August 2019 after he had been granted asylum status in the UK.

The spyware is believed to have allowed Bahraini authorities to access Al-Jamri’s personal data, including text messages, calls, location details, photos, and medical and banking records.

It also gave Bahraini authorities the ability to intercept voice calls, use microphones in the phone as a bugging device to record ambient sounds, take photos and track his movements.

Al-Jamri is claiming damages for misuse of private information, personal injury, harassment and trespass to goods. The case raises questions about the sale of spyware by western companies and Israel’s NSO Group to countries with poor human rights records.

According to Amnesty International, Bahrain’s National Security Agency has tortured, threatened and sexually assaulted human rights activists in an attempt to silence criticism of the regime. 

The country’s government censors the internet using blocking software supplied by Canadian company Netsweeper and uses targeted internet disruptions to impede political protests, according to research by The Citizen Lab.

The regime has blocked websites and social media accounts of political opponents, human rights organisations and online newspapers. A 2018 investigation by Haaretz revealed that Verint Systems provided Bahrain with technology for social media monitoring.

Bahrain’s use of spyware

The Kingdom of Bahrain is known to have used spyware to monitor political opponents since at least 2010 when the administration bought licences to use FinSpy and other spyware software sold by the Gamma Group. 

In 2013, the Kingdom bought spyware from Italian spyware company Hacking Team.

Bahrain has been using Pegasus spyware since at least 2017. Researchers at The Citizen Lab found a cluster of servers used to deploy Pegasus servers with domain names ostensibly linked to Bahraini political organisations.

Its victims include political activists living in exile in London, a Bahraini lawyer and human rights defender, a psychologist who fled Bahrain to seek asylum in the UK, and seven unnamed Bahraini activists and journalists.

Automated hacking tool

Israeli company NSO describes Pegasus in marketing material as a “world-leading cyber intelligence solution that enables law enforcement and intelligence agencies to remotely and covertly extract intelligence from any device”. 

Users of the software only need to insert a target phone number to initiate a phone hack. “The rest is done automatically by the system, resulting in most cases with an agent installed on the target device,” the company says.

Clients of Pegasus can set “rules”, for example to send an alert when a target leaves or enters a specific location, when one target meets another target, when a target makes a phone call to a specific number, receives a message from a specific number, or when a keyword or phrase is used in a message.

The spyware can be remotely uninstalled without leaving any direct trace of its presence on the targeted device and is fitted with a self-destruct mechanism that allows it to uninstall when there is a risk of exposure.

Bahrain claims sovereign immunity

The Kingdom of Bahrain is attempting to claim sovereign immunity in a similar case brought by two pro-democracy campaigners whose computers were hacked after they sought refuge in the UK.

Saeed Shehabi, a journalist and founder of Bahraini opposition party Al Wefaq, and Moosa Mohammed, a pro-democracy activist, had their computers hacked in 2011.

They allege that agents working on behalf of Bahrain remotely infected their computers with FinSpy spyware, enabling Bahraini authorities to collect information from their laptops, including messages, emails, calendar records, contact lists, browsing history, photos, databases, documents and video. 

The attack also enabled Bahrain to track the location of their laptops and eavesdrop on conversations by covertly using the laptop’s microphones and cameras.

The activists learned that their computers had been hacked in 2014 when WikiLeaks published documents about Bahrain’s use of FinSpy and a research and advocacy organisation, Bahrain Watch, identified them as victims of hacking.

This legal battle against a powerful and oppressive state sends a resounding message: no matter how wealthy or abusive, no regime is beyond accountability. It affirms that there is a legal path to exposing the truth and standing up to tyranny

A UK court found on the balance of probabilities that their computers were infected by agents of Bahrain, though Bahrain has denied the claims. It failed an attempt to argue the case for sovereign immunity in the Court of Appeal in October 2024, but is expected to pursue the case to the Supreme Court.

Speaking after the court’s decision to allow him to serve a claim for damages, Al-Jamri described the case as a “turning point, opening the door for me to seek justice”.

“This legal battle against a powerful and oppressive state sends a resounding message: no matter how wealthy or abusive, no regime is beyond accountability. It affirms that there is a legal path to exposing the truth and standing up to tyranny,” he added.

Sayed Ahmed Alwadaei, advocacy director at the Bahrain Institute for Rights and Democracy, praised Al-Jamri for his courage in bringing the action against Bahrain, knowing that he was likely to face reprisals.

“Bahrain cannot invade our privacy, trample our rights, or destroy lives on British soil without accountability. While justice takes its course in the courts, the British government must act decisively to confront and deter malicious hacking by foreign states,” he said.

Al-Jamri’s solicitor, Monika Sobiecki, a partner at Bindmans, said the case was the first brought in the UK against Bahrain over its use of the notorious Pegasus spyware.