Immunity in cyberspace
Can foreign governments spy on you at home?
The weekly newsletter is written by a human. Please consider a paid subscription.
I was sitting at the Havana Residence watching football on TV. England was one goal up in the final of the 2021 European championships.
There were shortages of food and other basics, as well as persistent power cuts. The tight pandemic measures, in place for over a year, were stifling ordinary people across Cuba.
Across the country, something snapped.
Despite Cuba’s the lockdown and internal security, the conditions drove people past their limit and out of their houses into the country’s first nationwide protests.
The government’s response was repression. Young people were detained (and later imprisoned) for saying the wrong thing or posting coverage on social media.
To whom can victims turn, when the Party controls the police, the media, the parliament and the courts?
Ordinary Cubans can’t themselves talk about it freely without risking arrest, exile or jail.
Image: Havana’s seafront, the Malecón, after a hurricane
Opinions differ on the leeway a foreign diplomat has to criticise their host government in public. This is one of the thorniest issues of interpreting the Vienna Convention on Diplomatic Relations (VCDR).
“Interfering in internal affairs” isn’t permitted. At the same time there’s a duty to respond to abuses of human rights, not least when they break formal international commitments.
On such occasions diplomats have a privilege and duty to speak, first behind closed doors and then in some circumstances more publicly.
Immunity constrains what diplomats can say, and also protects them.
When my host government used the name “Lord Vader” for me online, in a curious way they came close to a line drawn by the VCDR. Not only can’t you detain or jail diplomats. In principle, you can’t disrespect them.
The VCDR says the receiving State “shall treat [foreign diplomats] with due respect and shall take all steps to prevent any attack on [their] person, freedom or dignity,” and that diplomats “enjoy immunity from the criminal jurisdiction of the receiving State [and] from its civil and administrative jurisdiction.”
Immunity exists to safeguard diplomacy. The diplomat benefits only incidentally.
To be honest, “Lord Vader” felt like a compliment. There followed a series of snide remarks and insults on state TV. At least the government cared.
At the other end of the spectrum, governments threaten diplomats’ lives, directly or otherwise.
A notorious example came in 1979, when 52 US citizens, including some diplomats, were held hostage inside the US Embassy in Tehran. We need safe communication through representatives, particularly in hostile or authoritarian states.
The concept isn’t new. Roman law protected ambassadors, including in wartime.
The origins of the modern rule:
London debt collectors had apprehended the Russian Ambassador, Andrey Matveyev. Peter the Great called for the bailiffs to be executed.
Instead, Queen Anne apologised, and the first law granting immunity for “Ambassadors and their servants” followed, around 300 years ago.
A privilege this old and this strong is also, inevitably, abused.
The rules say this must not happen. Diplomats must obey local law.
The VCDR is explicit: “It is the duty of all persons enjoying such privileges and immunities to respect the laws and regulations of the receiving State.”
Sanctions are possible. Immunity can be waived. And the host country can expel diplomats at any time, with or without a reason, often giving them 72 hours to pack.
Q: Is immunity a free pass to commit crime?
Reality check. In 2024, the latest figures on incidents in the UK, 17 serious and significant offences were alleged against members of the diplomatic community out of around 26,500 entitled to immunity.
The British Foreign Office (FCDO) calls that proportionately low.
That doesn’t mean immunity isn’t controversial. The 2024 list ran from drink-driving to modern slavery.
Whenever there’s a high-profile case, people call for rule changes.
An awful recent example is the tragedy of 19-year-old Harry Dunn, killed in 2019 in a traffic accident caused by a US national.
We covered that case in the Gazette of 11 December. It exposed the hard edges of family-member immunity under the VCDR and the limits of waiver and extradition diplomacy.
A conviction followed, but from afar.
After an independent review into the UK government’s response, a loophole was closed. The FCDO set up a “Complex Cases Team” to escalate cases involving disputed immunity, serious harm or death.
The underlying Vienna Convention framework remains.
At the less grave end of the scale, resentment builds over money.
London’s diplomatic missions owed £164.6 million in unpaid congestion charge as of last September, climbing by several million a year. The UK calls it a fee for a service; many embassies call it a tax the VCDR exempts them from.
The USA tops the table at over £14 million. (In 2024 Togo owed around £40.)
Immunity shouldn’t mean impunity.
Without unravelling the whole VCDR there are still options:
independent rulings on local charges
removing accreditation from repeat offenders
publishing comparable annual data globally rather than nationally
using waivers early for serious crime
training missions and families before the keys are handed over
Diplomatic immunity protects individual diplomats. This week’s news turns on state immunity, that protects states.
Q: What’s the difference between diplomatic immunity, state immunity and sovereign immunity?
Diplomatic immunity protects individual diplomats and their families from the legal jurisdiction of the country they’re posted to.
State immunity protects a state from being sued in another state’s courts.
Sovereign immunity is the older, broader principle: no state should be judged by another in a court of law. Most countries now apply a restrictive version, so commercial acts lose the protection while governmental acts keep it.
Image: visitors at UN headquarters
Can foreign spies switch on your laptop camera?
On Monday the Supreme Court handed down The Kingdom of Bahrain v Shehabi.
Two Bahraini activists in London say the kingdom’s agents infected their laptops with FinSpy spyware, reading their files and switching on their microphones and cameras. Bahrain claimed state immunity.
But there’s an exception: personal injury caused by an act in the UK.
Is hacking from 3,000 miles away an act in the UK? Bahrain said no: its agents would be sitting abroad, not in Britain.
The Court of Appeal said yes. Hacking is like breaking into your house and emptying your safe. The burglary happens where the safe is.
The Supreme Court agreed by a 3-2 majority.
Remotely hacking a computer sitting in Britain is an act in Britain, a direct interference with UK territorial sovereignty, bringing it within the personal-injury exception to immunity.
The activists’ case can proceed to trial. Foreign states that deploy spyware against people here can be sued here, without setting foot in the country.
At least one dissenting judge suggested the ruling
blurs the line between an act and its effects
departs from European and UN immunity conventions
risks putting the UK in breach of its international obligations
It may lead to more cases in UK courts.
State immunity has now been tested in court, but diplomatic immunity in cyberspace hasn’t.
The VCDR was written for the days of the telegram. It says a mission’s archives, documents and correspondence are inviolable “at any time and wherever they may be.” It doesn’t say much about data.
Does inviolability protect a mission’s data sitting on a private or foreign server, as opposed to data in transit? The experts behind NATO’s Tallinn Manual, a leading study of how international law applies to cyber operations, couldn’t agree on how far diplomatic inviolability extends to electronic diplomatic archives stored outside mission premises (for example on third-party or foreign servers).
Can a receiving state lawfully run surveillance against a mission on its own soil? It’s hardly an uncommon practice, even if the Convention forbids it.
Does a diplomat enjoy immunity for a cyber operation they run themselves? The International Court of Justice has described espionage as an abuse of diplomatic functions, not a lawful exercise of them.
Cyber diplomacy is challenging and changing the rules.
Bonus for paid subscribers: this week’s diplomacy opportunities.