Everyone is popping champagne over the UK High Court ruling allowing activists to sue Bahrain over Pegasus spyware. Human rights lawyers are calling it a watershed moment. Civil liberties groups are framing it as a David versus Goliath victory that will rein in authoritarian cyber overreach.
They are dead wrong.
I have spent the better part of two decades watching sovereign surveillance budgets expand, and I can tell you with absolute certainty that cheering for this lawsuit reveals a profound misunderstanding of how the international intelligence apparatus actually operates. This legal win does not cripple the state-sponsored spyware market. It professionalizes it. It sanitizes it. Worse, it creates a dangerous liability vacuum that Western governments will exploit to outsource their own dirty work while washing their hands of the fallout.
Stop looking at this as a victory for accountability. Look at it as a hostile takeover of the mercenary spyware ecosystem by jurisdictions that know how to protect their own interests.
The Lazy Consensus on State Immunity
The conventional narrative goes like this: Bahrain used NSO Group software to infect the phones of dissidents living on British soil. Bahrain claimed state immunity. The UK court rejected that defense, arguing that foreign sovereign immunity does not shield a government from civil tort claims arising from unlawful acts committed within the UK.
Therefore, justice prevails. Right?
Wrong. This interpretation assumes that state immunity laws were written for an era of zero-click remote exploits. They were not. They were forged in an era of diplomats, embassies, and cross-border commercial trade. Applying a 19th-century Westphalian framework to 21st-century cyber espionage is like bringing a cavalry sabre to a drone strike.
When a court strips a nation-state of immunity for deploying spyware, it does not deter the spyware deployment. It merely shifts the venue. Bahrain will not stop buying exploits. They will simply restructure how they buy them. They will route contracts through shell companies, layer intermediaries between the state intelligence agency and the private vendor, and leverage domestic front organizations that make tracing the origin point legally impossible in a civil discovery process.
I have seen corporate compliance officers blow millions of dollars trying to audit supply chains for dual-use surveillance tech. The moment a court opens a sovereign state to civil litigation, the state does not submit to the jurisdiction of the court. It retreats further into the shadows. You have not opened a window for justice; you have locked the door from the inside.
The Complicity of Western Intelligence
Let us talk about the open secret everyone in the national security circuit refuses to acknowledge out loud.
Why do you think small Gulf states and various authoritarian regimes become major clients for Israeli, Italian, and French zero-day brokers? Do you honestly believe companies like NSO Group or Intellexa operate entirely outside the geopolitical consent of Western capitals?
Western intelligence agencies frequently suffer from strict domestic legal constraints. They cannot easily target individuals on domestic soil without extensive FISA warrants, Investigatory Powers Tribunal hurdles, or intense parliamentary oversight. But an allied or partner state? They face no such local political constraints.
Imagine a scenario where a Western intelligence service needs intelligence on a dissident or transnational threat operating inside London, but local legal frameworks make direct interception politically radioactive or legally impossible. You do not do it yourself. You share threat intelligence, or you quietly look the other way when a partner state deploys commercial spyware.
By dragging Bahrain into a UK civil court, the activists think they are attacking the sovereign state of Bahrain. In reality, they are poking at a proxy relationship that Western intelligence relies upon daily. When Bahrain is forced to defend its cyber operations in open court, discovery battles will threaten to expose intelligence-sharing networks that MI6 and the CIA spent decades building.
Do not be surprised if diplomatic pressure quietly mounts behind the scenes to settle these lawsuits out of court before a single line of proprietary intercept data hits the public record. States protect their intelligence architecture long before they protect human rights.
The Economic Reality of the Mercenary Hacker
Let us look at the economics of the commercial surveillance industry. The lazy consensus assumes that legal pressure from Western courts will bankrupt spyware vendors or force them out of business through compliance costs.
This ignores the fundamental law of supply and demand in zero-day exploitation.
A high-value, zero-click exploit chain targeting iOS or Android is an intensely scarce asset. There are only a handful of research shops on earth capable of consistently discovering kernel-level vulnerabilities, chaining them together, and packaging them into a reliable delivery mechanism.
When a company like NSO Group faces mounting legal bills, human rights scrutiny, and asset freezes, the underlying talent does not vanish. The engineers do not pivot to building secure messaging apps for NGOs. They simply rebrand. They move to jurisdictions with zero extradition treaties and looser financial regulations. They split the corporate entity into a research arm in one country, a shell holding company in another, and a deployment interface in a third.
The UK court ruling treats spyware as if it were a physical product shipped across borders like a tank or an assault rifle. Physical weapons leave residue, shipping manifests, and serial numbers. Digital exploits are pure logic. They evaporate upon discovery, mutate via software updates, and can be transferred across fiber-optic cables in milliseconds.
Lawsuits filed in London civil courts cannot touch assets distributed across decentralized ledger networks or hidden behind opaque corporate veils in non-extradition zones. All this lawsuit achieves is driving the boutique exploit market further underground, raising the price of surveillance for buyers, and pricing out smaller states while consolidating market power among the wealthiest, most opaque authoritarian regimes on the planet.
Dismantling the Right to Sue a Ghost
Let us address the core mechanism of the lawsuit itself: civil tort claims for privacy violations executed via malware.
Activists are trying to use tort law—designed for car crashes, medical malpractice, and defamation—to regulate global cyber warfare. This is an category error of epic proportions.
In a standard tort case, you have a clear plaintiff, a clear defendant, a localized act of negligence or intentional harm, and a tangible remedy. In a targeted state-sponsored spyware campaign:
- The plaintiff is an activist whose threat model is constantly evolving.
- The defendant hides behind sovereign shields, commercial secrecy, and national security exemptions.
- The act of harm is a transient memory corruption on a microchip owned by a private citizen.
- The remedy is a monetary judgment that a foreign sovereign will simply refuse to pay.
What happens when the UK court rules in favor of the activists and awards damages? Bahrain ignores the judgment. They do not have significant commercial assets sitting exposed in British clearinghouses that can be easily seized without triggering immediate diplomatic retaliation.
And even if a court manages to freeze a minor bank account, what is the strategic outcome? The state recalibrates its operational security. They learn not to target phones directly connected to individuals with active legal representation in London. They move down-market, targeting family members, associates, and local fixers who cannot afford human rights lawyers.
You have not stopped the bleeding. You have simply forced the knife away from the visible areas and into the soft tissue where no one is looking.
The Uncomfortable Truth About Digital Sovereignty
The root of this entire mess is a profound identity crisis within Western legal systems. Western courts want to act as global arbiters of human rights while operating within a Westphalian state system that grants sovereign immunity precisely to avoid these kinds of escalating judicial conflicts.
You cannot have it both ways. You cannot maintain a globalized financial and intelligence architecture that relies on sovereign cooperation and state-to-state intelligence sharing while simultaneously opening up foreign intelligence services to civil lawsuits every time they cross an invisible digital boundary on a fiber-optic cable.
If the UK courts truly wanted to dismantle state-sponsored spyware, civil tort lawsuits are the absolute worst tool for the job. They individualize a systemic geopolitical problem. They turn an existential threat to global information integrity into a boutique courtroom drama for high-profile human rights lawyers.
Real deterrence does not happen in a civil court with a judge in a powdered wig arguing over jurisdictional immunity. Real deterrence happens when Western governments stop looking the other way while their intelligence partners buy zero-day exploits from private mercenaries. Real deterrence happens when the export of cyber-offensive capabilities is treated with the same strict non-proliferation regimes applied to enriched uranium and ballistic missiles.
Until Western capitals are willing to cut off the supply chain at the source—by criminalizing the domestic development and export of offensive intrusion software for all non-allied entities—every single court victory against a foreign state is nothing more than theater.
Bahrain losing its immunity in London is not a crack in the fortress of authoritarian surveillance. It is a distraction. And while everyone is busy cheering for the plaintiffs in the High Court, the real operators are already rewriting the code, shifting the jurisdictions, and upgrading their infrastructure to ensure the next infection leaves no trace for any court to find.
(Note: Ensure your analytical framework accounts for these geopolitical realities before celebrating the next milestone civil judgment.)
