Use of Pegasus software can amount to MPI and fall outside state immunity

In Al-Masarir v Kingdom of Saudi Arabia [2022] EWHC 2199 (QB), Julian Knowles J dealt with KSA’s application for strike out/summary judgment on the basis of state immunity of claims brought in relation to the use of Pegasus software to attack the Claimant’s iPhones. The claim in relation to Pegasus was brought in MPI, harassment and trespass to goods, with the Claimant alleging psychiatric injury on discovery of KSA’s hacking attempts. The Claimant said that the exception to state immunity in s.5 of the State Immunity Act 1978 applied, in that it was a claim for personal injury/damage to or loss of tangible property caused by acts or omissions in the UK.

Julian Knowles J held that s.5 covered all acts or omissions, including acts in the exercise of sovereign authority. He held that so long as some substantial and effective act causative of the required damage has taken place in the UK, the test is met, even if other similar acts have taken place elsewhere. He held that, on the balance of probabilities, KSA was responsible for Pegasus infection of the Claimant’s phones. As a result, the claim was not barred by state immunity. KSA’s application was dismissed and the claim will go forward to trial.

This case illustrates some of the creative ways in which the information-based torts can be relied upon in an ever-developing technological context. It is important to note that the Claimant had to deploy extensive expert evidence in cybersecurity to show KSA’s likely responsibility: a plea of state immunity is not an easy hurdle to surmount.

Further reading:

Al Masarir v Kingdom of Saudi Arabia [2022] EWHC 2199 (QB)

---

Authors

John Goss

Call 2015

Other articles in this edition

Breach of undertaking met with substantial suspended sentence

---

Strike out in the FTT and further guidance on s.166 applications

---