Ghanem Al-Masarir v Kingdom of Saudi Arabia [2026] EWHC 119 (KB)

[2026] EWHC 119 (KB)Case No QB-2019-003909
IN THE HIGH COURT OF JUSTICE
KING’S BENCH DIVISION
MEDIA AND COMMUNICATIONS LIST
Venue Royal Courts of Justice, Strand, London, WC2A 2LLDate 26/01/2026
Before
THE HONOURABLE MR JUSTICE SAINI
Between
GHANEM AL-MASARIRClaimantKINGDOM OF SAUDI ARABIADefendant
Ben Silverstone (instructed by Leigh Day) for Claimant for The Defendant did not appear and was not representedHearing Hearing dates: 20 January 2026
Approved JudgmentThis judgment was handed down remotely at 10am on 26 January 2026 by circulation to the parties or their representatives by e-mail and by release to the National Archives..............................THE HONOURABLE MR JUSTICE SAINI
[1]The main issue before me in this application is whether the Claimant, Ghanem Al-Masarir, is entitled to summary judgment under CPR 24.4(1) on his claim for damages against the Kingdom of Saudi Arabia (“the KSA”). The Claimant says that he is the victim of a number of civil wrongs committed against him in the United Kingdom by the KSA, or its agents. The KSA has taken no part in these proceedings, following the Court of Appeal’s dismissal of its appeal against the decision of Julian Knowles J, on 19 August 2022, refusing the KSA’s application to set aside permission to serve the Claim Form on it. That unsuccessful application was made the basis that the KSA was immune from the court’s jurisdiction under section 1(1) of the State Immunity Act 1978 (“the 1978 Act”): see [2022] EWHC 2199 (QB); [2023] QB 475. I deal with the procedural history further in Section B below.[2]The Claimant is a Saudi National, formerly resident in the KSA. He is a prominent satirist, human rights activist and political commentator. The Claimant has lived in the UK since 2003, and was granted asylum here in 2018. His YouTube videos, commenting on human rights and political issues in the KSA have gained him a substantial following. They have generated over 345 million “views”. He is well-known in the KSA and internationally as a vocal critic of the governing Saudi Royal Family.[3]The Claimant says that in June 2018 he was subject to acts of hacking by the KSA using malicious spyware known as “Pegasus”. It is his case that as a result of the covert deployment of that spyware on two of his mobile phones, the KSA (or its agents) gained ongoing access to all of the data communicated via and stored on them. He says that they were also able to track his location, intercept and record his calls, to use the phones’ microphones to record him and to use the phones’ cameras. The Claimant says that this intrusive secret surveillance by the KSA or its agents, touched on every aspect of his private life. That is the first wrong of which he makes complaint. The second wrong is a claim that on 31 August 2018, while this surveillance was ongoing, he was the victim of a physical assault in London which he says was authorised or directed by the KSA or its agents.[4]The acts of which complaint is made are said to fall within a number of torts: misuse of private information (“MOPI”), harassment, trespass to goods and assault. He seeks damages for the psychiatric and physical injury, and substantial consequential loss and damage, he says he sustained as a result of discovering the surveillance conducted by the KSA and the physical attack. The Claimant’s evidence is that the discovery of his targeting by the KSA has had catastrophic personal consequences for him. These include severe depression in consequence of that discovery, such that his once thriving and lucrative online YouTube content career has effectively ended, and that he is unable to work at all or to perform many basic day-to-day activities, and rarely leaves the house. It is clear that the Claimant had a lucrative and rising source of income from YouTube before the events which give rise to this claim.[5]Pursuant to directions given by Steyn J by Order dated 17 October 2025, the hearing before me was for the determination of the Claimant’s applications for:(a) permission to rely on expert evidence in the fields of (i) psychiatry and (ii) labour market analysis and employment/earning prospects;(b) permission to amend the Schedule of Loss;(c) (if necessary) permission to apply for summary judgment; and(d) summary judgment on the whole of the claim, including damages and costs.[6]At the hearing, I gave the Claimant permission under CPR 35.4 to rely on expert evidence in the form of the psychiatric reports of Dr Martin Baggaley (“Dr Baggaley”) dated 4 December 2019 and 29 October 2024, and the employment/career prospects report of Keith Carter (“Mr Carter”) served in July 2025. Dr Baggaley gives evidence of the psychiatric harm suffered by the Claimant as a result of his discovery of the hacking of his iPhones. This is plainly a matter for expert evidence and is relevant to the question of damages. Mr Carter gives evidence of the Claimant’s likely career prospects and earnings:(a) “but for” the psychiatric harm he sustained and(b) in light of the wrongs committed. It is appropriate that this issue, which is also relevant to damages, should be addressed by expert evidence because of the unusual source of the Claimant’s earnings. In short, these earnings were made as a YouTube content creator, a career which has no clearly defined path or earning structure. It would not have been possible for me to form a view about the loss of earnings without the assistance of expert evidence in that field. I also gave permission to the Claimant to rely on a draft Amended Schedule of Loss (“ASoL”) which reflects the input of the experts. The ASoL sets out the Claimant’s damages to 27 June 2025 and seeks a lump sum payment.[7]At the conclusion of the very well-focussed oral submissions of Mr Silverstone for the Claimant, I indicated I would grant most of the relief sought by the Claimant and enter judgment for reasons to be provided in due course. I was not satisfied that the full extent of the financial relief claimed was justified, as regards the losses related to YouTube income. The amount I awarded in respect of special damages was lower than that claimed in the ASoL. II. Procedural Chronology[8]The Claim Form was issued on 4 November 2019. On 10 January 2020, Master McCloud granted permission to serve the Claim Form and Particulars of Claim (“POC”) on the KSA out of the jurisdiction. Service was effected on 3 September 2020 and on 5 February 2021, the KSA issued an application for a declaration that the court lacked jurisdiction on state immunity grounds and to set aside service of proceedings. That application was dismissed by Julian Knowles J. In his judgment, Julian Knowles J found that, on the evidence as it then stood and on the balance of probabilities, it was likely that the KSA had conducted the spyware attack on the Claimant (see [152]-[185]) and was also responsible for the physical attack on him (see [186]-[204]). The Judge ordered (among other things) that the KSA should file a further Acknowledgement of Service (“AoS”) and a Defence, and make a payment of £150,000.00 to the Claimant on account of his costs of the application.[9]The KSA sought permission to appeal on two grounds relating to the interpretation and application of the 1978 Act (it did not seek to appeal the factual findings made by the Judge). It also sought a stay on the order to file a further AoS and Defence pending its application for permission to appeal/the appeal, and an order to vary the order for payment on account so that the sum would be paid into Court rather than to the Claimant. On 5 June 2023, Warby LJ granted the KSA permission to appeal. He also granted its application for a stay on the filing of a further AoS and Defence, but refused the application to vary the order for payment on account. The KSA did not make the payment on account as ordered.[10]By a further Order of 15 November 2023, Warby LJ ordered the KSA to give security for the Claimant’s costs of the appeal by 24 November 2023, failing which the appeal would be dismissed without further Order. The KSA failed to provide that security, as a result of which its appeal was dismissed. On 18 December 2023, the Court of Appeal ordered the KSA to file and serve a further AoS within 14 days and a Defence within 28 days; and to pay within 14 days the Claimant’s costs of the appeal on the indemnity basis in the sum of £180,000.00.[11]On 29 December 2023, Master Eastman allowed the application of RPC, the KSA’s former solicitors, to come off the record. Since that time the KSA has not engaged in any way with these proceedings. It has not served a further AoS or Defence, or met any of the costs which it has been ordered to pay. On 18 September 2024, Master Dagnall granted the Claimant permission to serve further documents in these proceedings (other than any default judgment given against the KSA) by recorded delivery to the Royal Embassy in London and via two specified email addresses.[12]On 1 September 2025, the Claimant issued the present application, which I am satisfied was served on the KSA by the authorised means. I am also satisfied that it was appropriate within CPR 23.11(1) for the Court to proceed to hear the application in the absence of the KSA. I consider the KSA has made a deliberate decision not to participate in the claim before the High Court, just as it refused to engage with the appeal it issued in the Court of Appeal once it was required to make payments in accordance with the Court of Appeal’s directions. III. Summary Judgment[13]By CPR 24.4(1), a claimant may not apply for summary judgment until the defendant against whom the application is made has filed an acknowledgment of service or a defence, unless(a) the court gives permission; or(b) a rule or practice direction states otherwise.[14]In European Union v Syrian Arab Republic [2018] EWHC 1712 (Comm) Bryan J identified the following principles governing the exercise of the Court’s discretion under CPR 24.4(1)(a) at [61] (authorities omitted):
“(1) The purposes of the rule are to ensure that no application for summary judgment is made before a defendant has had an opportunity to participate in the proceedings […] and to protect a defendant who wishes to challenge the Court's jurisdiction from having to engage on the merits pending such application […] (2) Generally permission should be granted only where the Court is satisfied that the claim has been validly served and that the Court has jurisdiction to hear it […] once those conditions are met there is generally no reason why the Court should prevent a claimant with a legitimate claim from seeking summary judgment. (3) The fact that a summary judgment may be more readily enforced in other jurisdictions than a default judgment is a proper reason for seeking permission under CPR 24.4(1) […].”
There is no obligation to obtain permission under CPR 24.4(1)(a) before making an application for summary judgment: both such applications can be brought together (European Union v Syrian Arab Republic at [62]) as the Claimant has done in the present case.[15]In this case, the KSA has filed an AoS. On 27 November 2020, it filed an AoS by which it indicated that it would contest jurisdiction under CPR 11. I agree with Mr Silverstone that permission is not required under CPR 24.4(1). However, I note that by [2] of its Order of 18 December 20223, the Court of Appeal ordered the KSA to file and serve a further AoS, which it has not done. If it is necessary to grant permission to apply for summary judgment, I make such an order. Having regard to the factors in European Union v Syrian Arab Republic, the KSA has had an opportunity to participate in the proceedings and to challenge jurisdiction (indeed such a challenge was unsuccessfully brought). The claim has been properly served and the Court has jurisdiction to hear the claim.[16]I also consider an application for summary judgment is of particular value to the Claimant in preference to an application for default judgment, for two reasons. First, any grant of summary judgment would provide him with a form of judgment on the merits rather than a decision based on purely procedural considerations. Second, it may be more straightforward to enforce, outside the jurisdiction, an order resulting from summary judgment than one based on default judgment. This is a case where I consider it likely that enforcement steps in a jurisdiction other than in England and Wales will be necessary.[17]Turning to the substance, CPR 24.3 provides that the court may give summary judgment against a claimant or defendant on the whole of a claim or on an issue if(a) it considers that the party has no real prospect of succeeding on the claim or issue; and(b) there is no other compelling reason why the case or issue should be disposed of at a trial. I will not recite the governing principles set out in the well-known case of Easyair Ltd v Opal Telecom Ltd [2009] EWHC 339 (Ch). I found helpful the observation of Cockerill J in King v Stiefel [2021] EWHC 1045 (Comm) at [2] in relation to the evaluation of factual evidence in summary judgment applications:
“21. The authorities therefore make clear that in the context of summary judgment the court is by no means barred from evaluating the evidence, and concluding that on the evidence there is no real (as opposed to fanciful) prospect of success. It will of course be cautious in doing so. It will bear in mind the clarity of the evidence available and the potential for other evidence to be available at trial which is likely to bear on the issues. It will avoid conducting a mini-trial. But there will be cases where the Court will be entitled to draw a line and say that - even bearing well in mind all of those points - it would be contrary to principle for a case to proceed to trial. 22. So, when faced with a summary judgment application it is not enough to say, with Mr Micawber, that something may turn up…”
[18]Although the overall burden on an application for summary judgment rests on an applicant, I consider that at the level of principle if the applicant adduces credible factual evidence in support of its application, the respondent becomes subject to a form of evidential burden requiring it to show a real prospect of success or some other compelling reason for a trial. I was also helpfully referred to Promontoria (Oak) v Emanuel (Practice Note) [2022] 1 WLR 2004 at [155] and to the observations of Moore-Bick LJ at [14] in Korea National Insurance Corp v Allianz Global Corporate & Specialty AG [2007] 2 CLC 748.[19]In Stanbic Bank Ghana Ltd v Rajkumar Impex Private Ltd (High Court (QBD, Commercial Court)), judgment of 8 August 2017, HHJ Waksman QC (sitting as a Judge of the High Court) explained at [20] that the failure of a defendant, in response to a summary judgment application, to put forward evidence or other material which the Court could look at to see whether there was a defence, was of itself sufficient for summary judgment to be granted in favour of the claimant. I respectfully agree with that observation.[20]In my judgment, if a party refuses to engage in proceedings at all, it cannot complain if the court proceeds to make findings of fact and draws inferences against it (even inferences of serious wrongdoing) on a summary basis in finding it has no real prospect of defending the claim. The court must of course have a sound factual basis for making such findings and does not proceed on the basis that it must accept all factual assertions made by a claimant. IV. The Facts[21]I will begin with a summary of the relevant facts for the purposes of the hearing before me. I take those facts from the evidence which has not been answered by the KSA. In particular, I have relied on the evidence in the Claimant’s second witness statement dated 22 August 2022 and what is confirmed by a Statement of Truth in the POC. This is a case where I have to decide whether the inferences on which the Claimant relies to support his case that the KSA are responsible for the hacking and assault are made out for summary judgment purposes. I bear in mind the seriousness of the allegations of effectively criminal conduct for which the KSA is said to be responsible. The question for me under CPR Part 24 is whether the KSA has reasonable prospects of defending the claim (or there is some other compelling reason for a trial), based on the materials before me.[22]The Claimant was born in Saudi Arabia on 16 May 1980. In 2003, he moved to England which has become his permanent home.[23]From 2008, he began to post articles and YouTube videos which were critical of the Saudi government’s approach to human rights issues. His public profile increased in 2011 as a result of his criticism of King Abdullah of Saudi Arabia in a YouTube video which had over 800,000 views in a single day.[24]In 2015, the Claimant set up two YouTube channels, called “Ghanem Tube” and “Ghanem Show”, on which he posted videos which criticised the Saudi government and sought to expose what he said was corruption in the KSA. Both channels were removed from YouTube as a result of complaints made by the Saudi Broadcasting Corporation (a Saudi government entity), although the Ghanem Show was subsequently reinstated. In 2016, the Claimant created a further YouTube channel called “Ghanem AlMasarir”. At the time of the alleged wrongs complained of before me, videos on Ghanem Tube had received a total of about 230 million views (with the majority of viewers located in Saudi Arabia) and videos on Ghanem AlMasarir had gained about 43.4 million views.[25]On 25 October 2018 the Claimant was granted asylum by the UK. The First Tier Tribunal (Immigration and Asylum Chamber) concluded that the Claimant “has a well-founded fear of persecution if he is now returned to Saudi Arabia on the basis of his political opinions, and, accordingly, he is entitled to be recognised as a refugee in this country”. Further, the judge held that the Claimant “faces a real risk of ill-treatment contrary to Article 3 [of the European Convention of Human Rights] if he is now returned to Saudi Arabia”. The judge was satisfied that the Claimant “... has a very significant political profile that has grown significantly since... March 2015. That profile is of a relentless critic of the Saudi government. His profile is an international one and he has a very significant number of follows on YouTube and Twitter and I am satisfied that the Saudi authorities must be aware of his identity and activities”.[26]For summary judgment purposes, I am satisfied that it was as a result of his public statements about the Saudi government, that the Claimant was subject to various acts of intimidation between 2015 and 2019. These are detailed at [15]-[21] of the PoC and included the “spamming” of his Twitter account by the submission of about 10,000 complaints in a single day; the hacking of his Facebook account; the hacking of his personal website and the replacement of its contents with a statement praising the Al-Saud family and referring to the Claimant as a “dog”; the hacking and deletion of his Instagram account; and the sending of threatening messages to the Claimant online and via his mobile phone. I infer that the KSA and/or its agents were responsible for these various acts of intimidation. I outline below some of the evidence which supports this inference.[27]So, I note that on 2 March 2017 Sheikh Akram al Biladi, the Governor of al-Ahsa in Saudi Arabia, made a speech (in Arabic) in which he referred to the Claimant as one of a number of “foolish criminals who belong to terrorist organizations abroad”. Then, on 4 September 2017, the Claimant received a telephone call from Prince Abdulaziz bin Mashhur Al Saud, the brother-in-law of Crown Prince Mohamed Bin Salman, in which the Prince said (in Arabic) that the Claimant’s head would be underneath the Crown Prince’s feet, that “we will get you here in our ways, you dog” and that the Crown Prince had the Claimant’s “file”.[28]In 2017, the Claimant was given a human rights award by an individual named Tarek Ibrahim on behalf of the organisation Human Rights for All based in Oslo. The Claimant met with Mr Ibrahim and his colleague in London to collect the award and take formal pictures. Mr Ibrahim subsequently admitted that the award was not genuine, and that he and his colleague had been paid by a representative from the Saudi Government to get in contact and meet with the Claimant in person. Mr Ibrahim had not in the event been paid by his colleague. He warned the Claimant not to accept any further invitation from his colleague. He advised the Claimant that his colleague was “a bad person” and that there was a plot by government officials to gain the Claimant’s trust to “get rid of” him.[29]In 2018 and 2019, the Claimant suffered further acts of intimidation and intrusion, including the hacking of his mobile phones with Pegasus in June 2018 and the physical attack on 31 August 2018 which form the basis of these claims. I will return to these in more detail below after addressing Pegasus. Pegasus[30]Pegasus was created and is marketed by NSO Group Technologies Limited (“NSO”), an Israeli company which specialises in the development of surveillance technology. The evidence before me is that NSO has repeatedly stated that it sells Pegasus only to state bodies. Information about Pegasus became public as a result of an internal information booklet entitled “Pegasus – Product Description” which was leaked online. The details below are taken primarily from that document, as well as from the 1st witness statement of Dr Bill Marczak (“Dr Marczak”) who, as I explain below, has conducted extensive investigations into Pegasus.[31]The operation of Pegasus requires, first, that the spyware “agent” be covertly installed onto the target device. This can be done by the use of a malicious link contained in a text message or email sent to the device. When the link is clicked on by the device user, a web request is made to the Pegasus server, via a network of proxy servers (which conceal the location of the Pegasus server). This enables the Pegasus server to respond, again via the proxy servers, by running code, which is disguised as innocuous Javascript code, on the target device, so as to initiate the covert installation of the agent on the device. In addition, Pegasus has the capability to install the spyware by an “over-the-air” vector or “zero-click exploit” which operates without the need for the device user to click on a link. Once the agent is installed it breaks into the core part of the device’s operating system, or “kernel”, so as to disable additional security features and reside in the device’s flash memory, with the result that it persists when the device reboots. It also disables update mechanisms for the phone’s operating system (e.g., iOS), to prevent updates from interfering with the proper functioning of the spyware. Its surveillance activities are conducted by the receipt of commands from, and the transmission of data to, a “command and control” server (relayed via proxy servers to conceal the location of the ultimate server) which is under the control of the Pegasus user.[32]In summary, Pegasus enables three forms of surveillance:(a) “initial data extraction”, by which all data stored by the device is extracted and sent to the Pegasus user following installation of the agent;(b) “passive monitoring”, by which the spyware monitors the device on an ongoing basis and retrieves data in real time; and(c) “active collection”, by which specific data is retrieved in response to instructions by the Pegasus user. “Active collection” enables the following forms of surveillance to be conducted: (i) location tracking of the device; (ii) interception and recording of voice calls; (iii) retrieval of files stored on the device; (iv) recording of sounds in the vicinity of the device using its microphone; (v) taking of photographs in the vicinity of the device using its camera; and (vi) screen capturing (by which the Pegasus user can take screenshots of the device’s screen display).[33]When the Pegasus user wishes to end the surveillance of the target, the agent can be remotely uninstalled. It is designed to leave no traces or indications that it ever resided on the target device. The uninstallation does not affect the data which has been collected and which remains on the Pegasus user’s servers. Acquisition by the KSA of Pegasus[34]In 2017 Abdullah al-Maliha, an associate of Prince Turki al-Faisal, a former head of Saudi Arabia’s intelligence services, and Nasser al-Qahtani, another senior Saudi official, who presented himself as the deputy of the current intelligence chief, held several meetings with representatives of NSO and other individuals at which they discussed the purchase of Pegasus by or on behalf of the Defendant. The purchase was concluded in or around summer 2017.[35]On 11 January 2019 Ynet, an Israeli news and general-content website, published an interview with Shalev Hulyo, the CEO of NSO. The interview included the following passages:
“David Ignatius of the Washington Post reports that you sold your [Pegasus] system to a close advisor of Mohammad bin Salman, the Saudi Crown Prince and de factor ruler of the country. The advisor, Saoud Al Qahtani, was later fired on suspicion he ordered the murder [of Jamal Khashoggi]. We categorically deny selling the system to Qahtani. We don’t sell the system to private bodies. Of course you didn’t sell it to Qahtani as a private individual. The question is did you sell the system to Qahtani or another Saudi official. We deny selling the system to Qahtani. That is somewhat ambiguous wording. He holds an official position; he’s not buying the system from you as a private individual. Qahtani’s role was an advisor. As an advisor, we didn’t sell it to him. If we are selling and if we did sell, it’d only be to intelligence agencies. Did you sell the system to Saudi Arabia? We do not comment on any question about specific clients. We will neither confirm nor deny.”

Did you sell the system to Saudi Arabia?

[36]Mr Hulyo was also asked whether NSO was involved in the murder of Jamal Khashoggi, to which he replied: “We conducted a thorough inspection of all of our clients, not just the one client who could perhaps be a potential suspect for involvement in the affair, but also other customers who may for some reason have had an interest in monitoring him... After all these tests, I can tell you, in an attributed quote, that Khashoggi was not targeted by any NSO product or technology, including listening, monitoring, location tracking and intelligence collect. I consider it is reasonably to be inferred that the “client” referred to in this passage is the KSA or its agents. The texts received by the Claimant in June 2018 and Pegasus installation[37]Between 20 June 2018 and 24 June 2018, the Claimant received (and clicked on) the following text messages (“the Text Messages”): a) On 20 June 2018 he received a text message (in Arabic) on his iPhone 7 which purported to be from “Nkhaleej” (the Khaleej is a Middle Eastern newspaper). The text message stated (in translation) “Now it’s free to subscribe to al-Khaleej Newspaper’s text messaging service” and contained a link to a webpage with the URL “mideast-today.com/o2WnuKfRW”. This is referred to below as “Text Message 1”. b) On 23 June 2018, he received a text message (in English) on his iPhone X which purported to be from “DHL” (the delivery company). It stated:
“Dear Customer, DHL shipment No. #1751455027 is scheduled for delivery on 28/06/2018, Manage delivery at http://tinyurl.com/yb9vszsm, DHL.” and contained a link to a webpage with the URL “sundaydeals.com/jSXuYsH8”
. This is referred to below as “Text Message 2”. c) On 24 June 2018 he received a text message (in English) on his iPhone 7 which purported to be from “arabnews”. It stated:
“In Saudi Arabia, Countering Terrorism [sic] Becomes Chimera for Rights Abuses ArabNews SMS.” and contained a link to a webpage with the URL “arabnews365.com/18nusUK”
. This is referred to below as “Text Message 3”. Dr Bill Marczak[38]The identification of the Text Messages as texts which resulted in the installation of Pegasus on the Claimant’s iPhones, and the attribution of responsibility to the KSA is based primarily on the evidence before me from Dr Marczak (as set out in his 3 witness statements and their exhibits). Before addressing Dr Marczak’s analysis of the Text Messages in particular, it is helpful to refer by way of background to Dr Marczak’s previous investigations of Pegasus.[39]Dr Marczak works at Citizen Lab, an interdisciplinary laboratory based at the Munk School of Global Affairs & Public Policy, University of Toronto. This laboratory focuses on research and development at the intersection of information and communication technologies, human rights, and global security. He has been researching the use of spyware, including Pegasus, by state bodies for many years, and is the author of numerous published reports on that topic as well as several peer-reviewed papers on issues of computer security. I am satisfied that he an expert in this area.[40]It is significant that Dr Marczak gave evidence in Re Al M (Fact-finding) [2021] EWHC 1162 (Fam), which were child welfare proceedings involving allegations that HH Mohammed bin Rashid Al Maktoum (the Ruler of Dubai) had authorised the use of Pegasus to conduct surveillance of the mother of his children and others associated with her. In his judgment, Sir Andrew McFarlane P found those allegations proven. In doing so the President made the following observations about Dr Marczak’s evidence:
“137… [Dr Marczak’s] grasp of the detail of the Pegasus system and his own researches, previous encounters with it and published articles was to be expected, but it was, nevertheless, impressive and was maintained without significant falling off or error over the course of the two days. He was equally clear and firm in the detailed knowledge and recall that he had of his investigation for this case. He presented foremost as a scientist, who worked strictly within the confines of the data and the principles of computer science. His opinions both micro and macro, were carefully built upon and supported by the data and the underlying engineering of the complex systems with which he works. I did not detect any occasion when he might be seeking to stretch the science to fit a pre-determined conclusion in relation to the fact of hacking and the identification of Pegasus software. 138. Despite being properly and thoroughly tested at every turn by the intelligent and probing questioning of Mr Green, Dr Marczak gave measured, clear and full answers to each question. Where there was a need to do so, he conceded matters or readily accepted corrections. As each stage of the cross-examination proceeded, I became more and more impressed with the witness. 139. Dr Marczak was, in short, an impressive witness who presented a detailed, logical account, supported by the core data that he had found, which led to the conclusion that there was strong evidence that the three principal phones had been hacked by Pegasus software and that it was probable that the other three phones, which exhibited some but not all of the suspicious features, had also been infiltrated.”
[41]In addition, the evidence given by Dr Marczak in this case was accepted by Julian Knowles J in his judgment. At [160], Julian Knowles J observed:
“Dr Marczak’s qualifications and expertise are impeccable. In my judgment, his evidence demonstrates to the requisite standard that the Claimant’s iPhones were infected with spyware, and that the Defendant and/or those for whom it was vicariously liable, were responsible.”
[42]Dr Marczak first analysed Pegasus in a report named “The Million Dollar Dissident”, published in August 2016. This report was based on Dr Marczak’s analysis of text messages received by Ahmed Mansoor, a human rights campaigner based in the United Arab Emirates. As part of his investigation Dr Marczak clicked on the links contained in the text messages, under controlled conditions. This enabled him to identify the malicious processes which were executed on a device following clicking. It also enabled Dr Marczak to map out the internet servers which were responsive to messages sent out as a result of the clicking on the links, and were therefore clearly associated with Pegasus. At that stage he identified 237 IP addresses belonging to servers that exhibited such a response. Some of those IP addresses pointed to domain names registered to NSO. This confirmed the attribution of the spyware to NSO.[43]During the 24 months following the publication of that report, Dr Marzcak discovered a new set of servers which exhibited a response indicating they were Pegasus proxy servers. He identified 1,091 such servers within this new Pegasus infrastructure. In the same period Dr Marczak investigated Pegasus attacks directed against individuals involved in Saudi human rights issues via the use of malicious text messages. These were an (unnamed) Amnesty International researcher, a Saudi activist named Yahya Assiri and Omar Abdulaziz, a prominent Saudi political activist resident in Canada who produced a popular satirical show on YouTube which was highly critical of the Saudi government.[44]Dr Marczak’s findings in relation to these individuals were set out in a post entitled “NSO Group Infrastructure Linked to Targeting of Amnesty International and Saudi Dissident” (31.07.18), a report entitled “Hide and Seek: Tracking NSO Group’s Pegasus Spyware to Operations in 45 Countries” (18.09.18) and a report entitled “The Kingdom Came to Canada: How Saudi-Linked Digital Espionage Reached Canadian Soil” (01.10.18).[45]Examination of those individuals’ phones revealed that they had received messages containing links associated with Pegasus servers. Dr Marczak also identified Mr Abdulaziz as a victim of a Pegasus attack by a technique called “DNS Cache Probing”. That technique enables Dr Marczak to identify internet service providers (“ISPs”) serving devices which are seeking to look up the IP addresses for Pegasus command and control servers. Dr Marczak established that the same 2 Pegasus command and control servers were looked up via 2 ISPs in Quebec, Canada. Those ISPs supplied locations at which (it subsequently transpired) Mr Abdulaziz used the internet at times associated with the look-up activity.[46]Dr Marczak was able to divide the 1,091 proxy servers within the new Pegasus infrastructure into 36 groups, with each group representing proxy servers that communicated with a single Pegasus command and control server. He proceeded on the basis that each group of servers related to a single government user of the spyware, which he named an “Operator”. Using various forms of information about the Operators, Dr Marczak established the Operators’ areas of interest and likely location. That information included the identities of targets who had received messages containing links to domain names in the group, country themes suggested by the domain names (e.g., some domain names were designed to impersonate news websites or telecom companies that operate exclusively in a single country) and DNS Cache Probing results showing countries in which the group was conducting surveillance activities.[47]One of these groups of proxy servers, which Dr Marczak named “Operator KINGDOM”, is, absent any contrary evidence, clearly attributable to the KSA. That is for the following reasons: a) NSO sells Pegasus only to governments. b) The KSA purchased Pegasus in 2017. c) All of the 6 publicly described targets linked with Operator KINGDOM showed a clear nexus with Saudi Arabia. Those individuals were Mr Assiri, Mr Abdulaziz and the Amnesty International researcher (as described above) as well as the Claimant, Ben Hubbard (a journalist who was writing a book about Crown Prince Mohammed bin Salman while he was targeted) and a further Saudi activist. Operator KINGDOM was the only operator whose domain names showed likely infections within Saudi Arabia based on the DNS Cache Probing results. d) There appear to be no targets of Operator KINGDOM that are not linked to Saudi Arabia. e) There appear to be no targets clearly linked to Saudi Arabia who were targeted in 2017 or 2018 by a Pegasus operator other than Operator KINGDOM. f) The domain names employed by KINGDOM included domains that were thematically indicative of an Arab kingdom (e.g. kingdom-deals[.]com, kingdom-news[.]com, mideast-today[.]com, muslim-world[.]info, akhbar-arabia[.]com, arabnews365[.]com). Connecting this to the hacking of the Claimant[48]Dr Marczak examined the Claimant’s two iPhones. At that stage, Text Message 1 was not marked as “read” whereas Text Messages 2 and 3 were marked as “read”. Both iPhones were unable to install an iOS operating system update despite having sufficient storage space and network connectivity. A characteristic of Pegasus is that, once successfully installed, it disables operating system updates to prevent an update from interfering with the functioning of the spyware.[49]It was also apparent from Dr Marczak’s DNS cache probing analysis that one or more devices connected to the internet using a British Telecom (“BT”) connection were regularly connecting to Pegasus command and control servers linked to Operator KINGDOM during the periods of at least 23 July 2018 to 28 July 2018 and 23 August 2018 to 18 September 2018 (I note that the earliest DNS cache probing measurements that Dr Marczak conducted were on 17 July 2018 so there is no evidence on whether any devices on BT’s network may have been communicating with Pegasus servers before then). During the relevant period the Claimant’s iPhones used a BT wifi connection.[50]Further, the Text Messages displayed characteristics which clearly link them to Operator KINGDOM. In particular: a) The domains in the links in the Text Messages ultimately directed to the same Pegasus installation server as that to which the domains in the links received by Mr Abdulaziz, Mr Assiri and the AI researcher ultimately directed (by way of proxy servers). b) Text Message 1 contained a link to “mideast-today.com” which Dr Marczak had already, in his report of 1 October 2018, identified as linked to Operator KINGDOM. c) Text Message 2 was almost identical to the text message which Mr Abdulaziz received on the same day. The sunday-deals.com domain contained in the links in both messages had also been linked to Operator KINGDOM. d) Text Message 3 contained a link to “arabnews365.com”. That domain had also been identified as linked to Operator KINGDOM and was included in a link contained in a malicious text message subsequently received by Ben Hubbard. The assault on the Claimant[51]On 31 August 2018, about 2 months after he received the Text Messages, the Claimant met up with an acquaintance of his at a café in London. They left the café but did not realise that they were being followed by two men. One of the two men then approached the Claimant and shouted at him, asking who he was to talk about the family of al-Saud (he had not in fact being talking that day about this subject). The Claimant noticed that one of the men was wearing a wired earpiece. One of the men punched him in the face and continued physically to attack him. Passers-by intervened. The men called the Claimant a “slave of Qatar” (Qatar and the KSA are known to have a strained relationship) and said that they were going to “teach him a lesson”.[52]After the attack, the Claimant was treated in an ambulance for his injuries. At that point another man approached the Claimant’s friend who was standing by outside. He said that he was a Saudi businessman, that he was an importer of rice in the UK and that he had seen what had happened (meaning the attack). He said it was not in the Claimant’s friend’s interest to get involved. He also said: “don’t associate yourself with this son of a bitch!” and warned him that “the police will not come for Ghanem, we are in charge here, we run the police and they will not come”.[53]The Claimant was taken by the ambulance to the police station where he provided a statement to police. He is not aware that any action has been taken by the police against the perpetrators of the attack. I have seen a photograph of the injury to the Claimant’s face. Further acts of intimidation against the Claimant[54]The attack preceded a series of further acts. By September 2018 a number of threatening hashtags about the Claimant were being posted on Twitter, including: الدوسري_غانم_الكلب_جلد# (#whipping_the dog_Ghanem_Al Dosari); محاولة_اغتيال_غانم_الدوسري# (#Attempt_assassination_ Ghanem_Al Dosari); and مقتل_المرتزق_غانم_الدوسري# (#Killing of_ mercenary_ Ghanem_Al Dosari).[55]I note that many of the users who tweeted these hashtags had pictures of King Salman of Saudi Arabia as their profile pictures. At 3am on 31 October 2019, the Claimant was woken at his home by UK officials and informed that they had intelligence which indicated that there was an imminent threat to his life. In addition, between 2018 and 2019 the Claimant was subject to further online abuse and intimidation in Arabic, which included death threats, via Twitter, Snapchat and WhatsApp.[56]On 19 June 2019, the Claimant, while at a café in Knightsbridge, was approached by a child who sang a song to him entitled “عاش سلمان يا بلادي، عاش سلمان” (“Long live Salman, oh my homeland, long live Salman”). A man filmed the child as he did this, and a video of the incident was published on Twitter, Facebook and Instagram with the hashtag #Shibil_Yam_Insults_Ghanem_Al_Dosari. It was reposted many times and received millions of views. It also featured on state-owned television in Saudi Arabia over a number of days. On the same day, as the Claimant was leaving a restaurant in West London, a man walked up to him and said in Arabic “أيامك معدودات” (“Your days are numbered”) before walking off. Conclusions on hacking[57]In my judgment, there is a compelling basis for concluding that the Claimant’s iPhones were hacked by Pegasus spyware which resulted in the exfiltration of data from those mobile phones and that this conduct was directed or authorised by the KSA or agents acting on its behalf.[58]I note the findings of Julian Knowles J. One of the bases on which the KSA contested jurisdiction was the argument that the Claimant had failed to establish on the balance of probabilities that the KSA was responsible for the alleged spyware attack on him and had therefore not shown, for the purposes of section 5 of the 1978 Act, that the proceedings were in respect of personal injury caused by an act of the KSA in the United Kingdom. Having considered the evidence served by both the Claimant and the KSA (which served two witness statements from its solicitor, but no evidence from any direct witnesses), Julian Knowles J rejected the KSA’s argument. He held at [160] that Dr Marszak’s evidence “demonstrates to the requisite standard [i.e. the balance of probabilities] that the Claimant’s iPhones were infected with spyware, and that the Defendant and/or those for whom it was vicariously liable, were responsible”. His reasons for that conclusion were set out in detail at [161]-[185], in which the Judge also explained why the forensic points made in Ms Given’s evidence were rejected or insufficient to negate the Claimant’s evidence.[59]The evidence on the hacking issue before me is the same as it was before Julian Knowles J. The only relevant changes of circumstance since then are that the KSA has failed to file a further AoS or a Defence, or any evidence in response to the summary judgment application. I am also satisfied that the KSA appears unlikely to participate further in the proceedings, such that there is no reasonable basis to conclude that any additional evidence supportive of the KSA would be available at trial. Those are factors which strongly support the grant of summary judgment.[60]Although I give weight to the judgment of Julian Knowles J, I am independently satisfied that the KSA has no real prospect of successfully defending the allegation that it engaged in hacking of the type I have described above. In my judgment, the Claimant’s activities in criticising the Saudi government and the public profile he had thereby gained, particularly in Saudi Arabia, made him an obvious target for the KSA. I also accept that the KSA has a well-documented history of use of various forms of spyware and it purchased Pegasus in 2017; and that no state other than the KSA would have had an interest in conducting surveillance of the Claimant. The characteristics of the Text Messages linked them to Operator KINGDOM, which was also linked to the text messages sent to 5 other targets whose activities were of interest to Saudi Arabia. The evidence before me relating to Operator KINGDOM indicates that it was controlled by the Saudi government or security services.[61]In the absence of any pleaded case by the KSA in response to these facts and conclusions, and any evidence in response to this application, I conclude that the KSA has no real prospect of defending the allegation of hacking. Conclusions on the assault[62]In my judgment, the analytical position in respect of the physical attack allegation is similar to that in relation to the hacking allegation. Julian Knowles J found on the balance of probabilities that the KSA was responsible for the physical attack in that the assailants were working for or on behalf of the KSA (his detailed reasons for that conclusion are set out at [186]-[204] of his judgment). I agree and since the original judgment, the KSA has pleaded no case in response and has served no evidence in response to the application; and it is therefore unlikely that any additional evidence supportive of the KSA would be available at trial.[63]The KSA had a clear interest in and motivation to shut down the Claimant’s public criticism of the Saudi government. The attack was unprovoked: the Claimant had not, contrary to what the attackers said, been discussing the Saudi royal family or government. This accusation therefore appeared to be a pretext for a premeditated attack on him. I have already referred to the fact that one of the attackers was wearing an earpiece which also suggests a level of planning in the operation. Mr Silverstone was right to say that the comments made by the apparent bystander at the scene are redolent of governmental involvement.[64]In my judgment, there is no real prospect that the KSA will successfully defend the allegation that it was responsible for the physical attack on the Claimant.[65]I turn to the causes of action relied on. V. Misuse of Private Information[66]Liability for misuse of private information is determined applying a well-known two-stage test:(1) does the claimant have a reasonable expectation of privacy in the relevant information; and(2) if yes, is that outweighed by countervailing interests: McKennitt v Ash [2008] QB 73 [11]; and ZXC v Bloomberg [2022] 2 WLR 424 [26]. Whether a person has a reasonable expectation of privacy is an objective question: the expectation is that of a reasonable person of ordinary sensibilities placed in the same position as the claimant and faced with the same publicity. The question is a broad one which takes account of all the circumstances in the case, including the attributes of the claimant; the nature of the activity in which the claimant was engaged; the place at which it was happening; the nature and purpose of the intrusion; the absence of consent and whether it was known or could be inferred; the effect on the claimant; and the circumstances in which and the purposes for which the information came into the hands of the publisher: see ZXC at [49].[67]The second-stage, balancing exercise involves “an intense focus on the comparative importance of the specific rights being claimed in the individual case”. It requires consideration of “the justifications for interfering with or restricting each right”; and “the proportionality" of the respective interference or restriction: see ZXC at [58].[68]In my judgment, the Claimant plainly had a reasonable expectation of privacy in respect of the information accessed by the deployment of Pegasus on his iPhones. The information stored on and communicated via those devices during the relevant period included information relating to his personal life, his family, his relationships, his health, his finances and private matters relating to his work promoting human rights in Saudi Arabia. The covert accessing of that information, together with the tracking of his location, the interception of his calls, and use of the phones’ microphones and cameras to monitor the Claimant, constituted in my judgment exceptionally grave invasions of his privacy. It effectively converted these smartphones into “bugging” devices which secretly transmitted huge amounts of his data and information on every aspect of his life to a hostile state.[69]No justification has been advanced for this grossly intrusive conduct, nor could there be. The Claimant’s activities as an online activist in support of human rights in Saudi Arabia and in opposition to the Saudi government represented a proper exercise of his free speech rights, protected by Article 10 ECHR. They could not possibly justify the hacking and surveillance. It follows that there is no real prospect of the KSA successfully defending the claim in misuse of personal information. VI. Harassment[70]Under the Protection from Harassment Act 1997 (“PHA”) it is a civil wrong for a person (“P”) to pursue a “course of conduct” which amounts to harassment of another and which P knows or ought to know amounts to harassment of the other: ss 1(1), 3. P ought to know that the course of conduct amounts to harassment of another if a reasonable person in possession of the same information would think the course of conduct amounted to harassment of the other: s 1(2). A course of conduct must involve conduct on at least two occasions: s 7(3). Harassment “include[s] alarming the person or causing the person distress”: PHA, s 7(2). Conduct does not constitute harassment if the defendant shows that(a) that it was pursued for the purpose of preventing or detecting crime,(b) that it was pursued under any enactment or rule of law or to comply with any condition or requirement imposed by any person under any enactment, or(c) that in the particular circumstances the pursuit of the course of conduct was reasonable: s 1(3).[71]Harassment was characterised in Hayes v Willoughby [2013] 1 WLR 935 (at [1]) as “a persistent and deliberate course of unreasonable and oppressive conduct, targeted at another person, which is calculated to and does cause that person alarm, fear or distress”. The conduct “must cross the boundary between that which is unattractive, even unreasonable, and conduct which is oppressive and unacceptable. To cross the border from the regrettable to the objectionable, the gravity of the misconduct must be of an order which would sustain criminal liability”: Majrowski v Guy’s & St Thomas’s NHS Trust [2007] 1 AC 224 at [30].[72]The requirement that “harassment” must be “calculated” to cause a person alarm, fear or distress does not mean that the defendant must intend to bring about that result, or that harm must be foreseeable. Instead “calculated” should be understood in the objective sense of “likely to produce a result”, with “likely” meaning not “more likely than not” but “sufficiently likely in all the circumstances”: Gerrard v Eurasian Natural Resources Corp Ltd [2021] EMLR 8, [78]-[87]. This is consistent with the fact that acts of covert surveillance were held to form part of a course of conduct constituting harassment in Kellett v DPP [2001] EWHC 107 (Admin) and Howlett v Holding [2006] EWHC 41 (QB), and were held to be capable of forming part of such a course of conduct in Gerrard. In that case, Richard Spearman QC (sitting as a Deputy High Court Judge) explained as follows at [94]:
“I consider that Kellett is authority for the proposition that the offence (or tort) of harassment is only complete when the victim learns of the harassing conduct. Until then, they do not suffer any harmful effects. However, once the victim learns of conduct which, objectively, constitutes harassment, I consider that it is no answer for the perpetrator to say that the perpetrator hoped or intended or planned that the victim would not find it out.”
[73]Sections 1-7 PHA extend only to England and Wales. A claim will fall within the territorial extent of the PHA where acts are committed within England and Wales and the harassing effect is also felt by the claimant in the jurisdiction: Bukhari v Bukhari [2025] EMLR 13, [125]. In Shehabi v Bahrain [2025] KB 490 the Court of Appeal accepted that, for the purposes of section 5 of the 1978 Act, acts of hacking a device in England and Wales occur in this jurisdiction even if the defendant is located overseas: see Males LJ at [34] and following.[74]In my judgment, the KSA’s alleged acts of surveillance (which I have found it has no reasonable prospect of contesting) constituted a course of conduct which amounted to, and which it knew or ought to have known amounted to, harassment of the Claimant. The obvious inference is that the KSA used Pegasus to monitor him over an extended period and by multiple acts. This follows from(a) the repeated contact made by the device(s) on the BT wifi network with the Pegasus command and control servers from 23.07.18 to 28.07.18 and 23.08.18 to 18.09.18;(b) the fact that two of the Claimant’s devices were infected with Pegasus;(c) the multiple functionalities of Pegasus which enabled the KSA to conduct numerous forms of surveillance of the Claimant and his data and(d) the nature of the KSA’s interest in the Claimant which would have induced it to use those functionalities to monitor various aspects of his life and activities. These acts of surveillance plainly amounted to a course of conduct. The discovery of that course of conduct clearly caused alarm, fear and distress to the Claimant. Indeed, it caused him severe psychiatric injury on the evidence before me.[75]It is also apparent that a reasonable person in possession of the information available to the KSA about how Pegasus functions would think that the course of conduct amounted to harassment of the Claimant. The conduct involved the most acute intrusion into every part of his private life, akin to the most severe form of “stalking”, a wrong which the PHA was specifically intended to address. Its discovery was highly likely to cause harassment to the Claimant. The KSA has identified no basis on which any of the defences under s 1(3) PHA could apply. For reasons similar to those given above in respect of the balancing exercise relating to the MOPI tort, I conclude that none of those defences is available. The KSA has no reasonable prospect of defending this claim. VII. Trespass to goods[76]A claim for trespass to goods lies for any direct and wrongful interference with a claimant’s possessory interest in a chattel, ranging from deliberate damage to some other form of physical interference: Clerk & Lindsell on Torts (24th edition), [16]-[133]. For these purposes, in my judgment, physical mediums on which information is stored, such as computer disks, USB sticks or smart cards are corporeal property, from which it follows that the alteration or erasure of that data is capable of amounting to a trespass. See Clerk & Lindsell, [16]-[ 136]. Indeed, Clerk & Lindsell goes on to state as follows at [16]-[137] (under the heading “Cyber- trespass”):
“While the definition of corporeal personal property may normally be straightforward, questions may nevertheless arise in a number of borderline cases, in particular in respect of electronic technology. For example, it is hard to see why a deliberate attempt through the internet unlawfully to manipulate data on a computer should not amount to a trespass to that computer. The configuration of a computer hard disk is a physical feature of it, and the defendant’s act in altering or accessing it changes that configuration, at least temporarily. American courts have fairly consistently so held, and it is suggested that English courts should do likewise.”
[77]I agree with this analysis and as explained in Clerk & Lindsell it is supported by (among other cases) the decision of Chadwick LJ in Taylor v Rive Droite Music Ltd [2006] EMLR 4 and the US decisions in Thrifty-Tel, Inc v Bezenek 46 Cal. App. 4th 1559 (1996) and Sotelo v Directrevenue, LLC 384 F. Supp. 2d 1219 (N.D. Ill 2005). In Taylor, Chadwick LJ accepted that the unauthorised deletion of electronic files from a computer amounted to wrongful interference with goods (of which trespass to goods is a species): see [63]-[68]. In Thrifty-Tel the Court of Appeal of California accepted that hacking of a long-distance telephone carrier system constituted trespass to chattel in respect of that system. In Sotelo, District Judge Gettleman in the United States District Court for the Northern District of Illinois held that the use of spyware to track the plaintiff’s internet use was capable of constituting trespass to personal property under Illinois law.[78]In my judgment, the infection with Pegasus of the Claimant’s iPhones plainly interfered with his possessory interest in those devices. The execution of the Pegasus spyware altered the physical configuration and functioning of the iPhones without his consent. It resulted in the writing of code to the iPhones’ Flash Storage, the reading of data from their Random Access Memory, the use of the iPhones’ wi-fi hardware, mobile radios (their hardware to access the cell network), microphones, cameras, GPS sensors and batteries. These changes to the iPhones had no lawful basis. Accordingly, I conclude that the KSA’s hacking of the iPhones constituted a trespass to his goods and it has no reasonable prospect of defending that claim. VIII. Assault[79]The attack committed against the Claimant was plainly an assault. There was no lawful justification for this attack. The KSA has no reasonable prospect of defending this claim. Other compelling reason why the case should be disposed of at a trial[80]In my judgment, there is no reason (and certainly no compelling reason) why this claim should go to trial. The KSA has failed to serve a Defence or to respond to this application and has breached multiple further orders. It appears unlikely to participate in the claim. Proceeding to trial would result in a wholly unnecessary use of Court time and resources, and the unnecessary incurring of significant further costs. Entering summary judgment at this stage is the only course consistent with the overriding objective when a trial would simply be a rehearsal of all the evidence before me without challenge from the KSA. At a trial, it would not be the role of the judge to question the factual evidence put forward by the Claimant in the absence of the KSA. IX. Damages[81]The Claimant’s claim for damages for personal injury is set out in the ASoL. It is composed of:(1) general damages in the form of pain, suffering and loss of amenity;(2) past losses in the form of medical costs and loss of earnings; and(3) future losses in the form of medical costs, travel costs and loss of earnings. The evidence of psychiatric and physical harm is summarised below. I will then address the general damages and special damages claims. No distinct claim for losses relating to the trespass to goods was advanced.

(a) Evidence of psychiatric harm

[82]The evidence of the psychiatric harm suffered by the Claimant is contained in the two expert reports of Dr Baggaley, which I accept. In summary, in his first report Dr Baggaley said: a) The Claimant reported that on learning that he had been targeted by spyware “he became very paranoid and depressed”. He felt very afraid that “the Saudi government had been able to monitor and invade his private life” and this “affected his business because he is too afraid to use his laptop to produce YouTube videos”. He reported various specific symptoms including an inability to sleep, a loss of interest in things, bad dreams, and a belief that his life was in danger and that he would not stop being targeted. b) In Dr Baggaley’s view the Claimant was suffering from a relapse of a Recurrent Depressive Disorder, current episode moderate. At the time of the infiltration his depression was in remission/mild but then he suffered a relapse of moderate severity. c) On causation, Dr Baggaley stated that the attack in August 2018 “would have been expected to be stressful and might in itself have precipitated a relapse in [the Claimant’s] depression. However, the impact of this episode was made considerably worse by the discovery of the infiltration of Pegasus spyware as he felt that all his movements and contacts were able to be monitored, making the threats he received much more real. On the balance of probabilities, the infiltration by Pegasus would have caused a relapse of his depression even without the assault and would have caused a further exacerbation of the relapse caused by the assault”. d) A course of cognitive behavioural therapy (CBT) of at least 12 and up to 20 sessions was recommended. Dr Baggaley proposed optimisation of the Claimant’s anti-depressant regime, to be supervised by a consultant psychiatrist for an initial assessment and up to 6 follow up sessions. e) The Claimant had reduced capacity to work partly because of his symptoms of depression (for example poor sleep, reduced motivation, low mood) which will impair his ability to be creative and make online content. f) Dr Baggaley provided the following prognosis: “I would expect [the Claimant’s] depression to run a fluctuating course thereafter with deterioration in response to various adverse life events”.[83]In his addendum second report of 29.10.24 Dr Baggaley said that: a) The Claimant reported various adverse symptoms, including an inability to sleep, fatigue, low mood most of the time, a frequent inability to “see the point of carrying on”, poor concentration and feelings of being very distracted, the need to use medication to stop him “exploding”, anger at how the Saudi authorities have behaved towards him, constant feelings of being hyperalert and hypervigilant. The Claimant also reported that he was too “paranoid” to leave the house and really avoids going out as much as possible, that he relied on his partner to go shopping and do day-to-day chores, that he was worried that a woman from Saudi Arabia who came to stay with him in 2023 may get into trouble and may have to leave the country, that he no longer made his YouTube videos and that he sometimes felt so low as to think of suicide. b) Dr Baggaley expressed the view that the Claimant had substantially deteriorated since his last assessment and was now suffering from a Recurrent Depressive Disorder, current episode severe. c) In Dr Baggaley’s view, the Claimant had suffered a significant impact on his relationships, activities of daily living and work in that he did not socialise and very rarely went out, he was unable to work and although he had a relationship with his partner it is limited in nature and if it failed he would struggle to form a new relationship. d) Dr Baggaley’s view on causation remained as in his first report.[84]The Claimant in his evidence explains the impact on him of the discovery that he was subject to surveillance by the KSA. Prior to this, he led a sociable and active life and gained particular pleasure and a sense of purpose from his activism on political and human rights issues in Saudi Arabia conducted via his successful YouTube videos. The Claimant had plans to expand his YouTube channels and to start a non-governmental organisation. However, this all changed as a result of his discovery of his targeting by the KSA. The Claimant provides a vivid account of the devastating impact on his mental health of this discovery. He feels constant worry about what the KSA could do to him and its ability to access him while he is in the UK. He is suspicious of everything and everyone. He suffers from depression and insomnia and is always tired. He finds it difficult to leave the house and has isolated himself from those he previously considered friends. He no longer prepares his own meals.[85]I also accept the evidence that the Claimant is unable to produce YouTube content because of his fears of retaliation by the KSA and his inability to focus on or think up ideas for videos. Indeed, the Claimant is even unable to consider embarking on any form of work again. He finds it difficult to interact with others, to wake up early, to keep to plans or to focus for a meaningful period.

(b) Evidence of physical harm

[86]As I have said, I have seen the photograph of the injury to the Claimant’s eye caused by the attack, which was taken the following evening. He retained the marks of the injury a few days later, when he was due to attend a social engagement at Chatham House. He therefore wore sunglasses to hide the injury, as shown in the photograph from the event.

(c) General damages (i) General damages for psychiatric injury

[87]As I have already noted, Dr Baggaley’s most recent assessment is that the Claimant’s Recurrent Depressive Disorder is “severe”. The range for quantum of general damages for severe psychiatric injury in the 17th edition of the Judicial College Guidelines (“the Guidelines”) is £66,920 to £141,240. The Guidelines identify the following factors relevant to assessment of quantum:(i) the injured person’s ability to cope with life, education, and work;(ii) the effect on the injured person’s relationships with family, friends, and those with whom he or she comes into contact;(iii) the extent to which treatment would be successful;(iv) future vulnerability;(v) prognosis; and(vi) whether medical help has been sought. The Guidelines state that in “severe” cases “the injured person will have marked problems with respect to factors (i) to (iv) above and the prognosis will be very poor”. That reflects the evidence in this case.[88]The circumstances of this case are unusual and there appear to be no closely analogous authorities which assist on quantum. Mr Silverstone took me to a number of cases including the discussion of Mr Yentob’s case in Gulati and ors v MGN Ltd [2015] EWHC 1482 (Ch) and Vernon v Bosley [1997] PIQR P255. The present case is very different. In all the circumstances I conclude that an appropriate award for general damages for psychiatric injury is £100,000.00, with interest from the date of issue to judgment. (ii) General damages for physical injury[89]The Claimant sustained a number of blows, including to the face. His eye injury persisted for a short period, with the eye injury still visible a few days later. For “minor injuries” in respect of which “there is a complete recovery within seven days” the Guidelines recommend general damages in the range of “[a] few hundred pounds to £840”. I will award £500.00, with interest from the date of the Claim Form to judgment.

(d) Special damages

[90]The detailed calculations underpinning the special damages claim are set out in the ASoL. I will summarise the position before explaining how these damages (the largest part of the claim) have been calculated. The past losses claimed by the Claimant consist of £594.00 in medical costs and £366,910.00 in lost earnings (which is a net figure after taking into account actual earnings of the Claimant). The future losses claimed by the Claimant consist of £4,500 in medical costs (mainly CBT), £260 in travel costs and £2,892,052.86 in lost earnings. I will deal with earnings separately but will award the medical costs (past and future as claimed).[91]The substantial YouTube related earnings which it is said the Claimant would have made but for the wrongs are based on the projected earnings contained in [118]-[122] of Mr Carter’s expert report. I will outline Mr Carter’s overall approach. As Mr Carter explains, the Claimant achieved a high degree of success in a short period of time after starting his YouTube channel, amassing a large number of views and subscribers. Mr Carter provides some helpful graphs in his report which include a projection of the Claimant’s YouTube viewership (subscribers and total views). This is with the aim of identifying income streams that would have been earned but for the wrongs.[92]Those creating content on YouTube receive income primarily through Google AdSense. As I understand the position, this essentially pays a Content Creator such as the Claimant a certain amount for the number and type of advertisements that are shown to viewers before and during their videos. The amount of income that a YouTube channel receives from Google AdSense will depend significantly on the amount of “monetised playbacks” the channel receives. Only video views which include advertisements will provide revenue to the creator, and certain factors may result in the video being “de-monetised”, including the subject matter and content of the video, the location of the viewer, whether the viewer uses ‘Adblock’ software, etc.[93]A channel’s ‘Cost Per Mille’ (CPM) metric refers to how much advertisers pay for every 1,000 “ad impressions” (i.e., monetised views) the video receives. This figure is determined by YouTube’s algorithms, and will again depend on a range of factors. Although Google Analytics refer to CPM, another term, ‘Revenue Per Mille’ (RPM), is often used as a more accurate indicator of actual income received for each monetised view, as it refers to the amount of money the channel actually receives per 1,000 monetised views, after all deductions have been made (for example, YouTube takes 45% of all advertisement revenue received). There is a clear link between these two factors. If a channel receives more monetised views, this is likely to have a positive influence on its CPM/RPM, although other factors, such as the subject matter of the video, can also have a significant impact as this determines the amount of clicked links (the conversion rate) from advertisements. Mr Carter was provided with information on the analytics for the Claimant’s YouTube channels, Ghanem Show and Ghanem Almasarir. His report contains an overview of the number of monetised views, average CPM, and estimated revenue achieved since 2016/17. He then uses these figures to estimate the RPM that Mr Al-Masarir could have expected to receive based on his analytic data.[94]In Table 8 of Mr Carter’s report, the Claimant’s projected income from his YouTube content (but for his personal injuries) is assessed by reference to four scenarios, with scenario 1 being the lowest and with scenario 4 being a projection for what Mr Carter calls “a very successful YouTube channel”. Mr Silverstone invited me to accept the midpoint range in scenario 4 (at 1.656 RPM). I agree that this is appropriate on the evidence before me of the past success of the Claimant and Mr Carter’s helpful analysis.[95]In addition, Mr Carter considers that income streams other than from YouTube could have increased the Claimant’s earnings by between 5% and 58% above the sums in Table 8. The Claimant seeks an uplift on the earnings figures at the very top of this range. Mr Silverstone argued that this uplift figure is based on the Claimant’s evidence as to his career plans and likely career progression at the time of the incidents complained of. The proposed uplift is also intended to incorporate an element for the effect of inflation during the relevant period.[96]The uplift is intended to catch the further income streams deriving from the Claimant’s YouTube viewership and his profile as a Commentator and Satirist more generally. It is calculated as a percentage increase on his YouTube income to reflect income from other sources such as appearances or articles. Adopting a more conservative and realistic approach, and as I said at the hearing, I have settled on a more limited uplift figure of 40% based on the detail of such opportunities outlined in Mr Carter’s report and the overall evidence.[97]Based on re-worked calculations on the basis of my conclusions above, I will award the Claimant damages as follows: General damages Pain, suffering and loss of amenity £100,500 Interest to date of judgment £12,502.20 Past losses Medical costs £594 Loss of earnings £317,600.60 Interest to date of judgment £27,127.55 Future losses Medical costs £4,500 Travel costs £260 Loss of earnings £2,562,578.48 Total damages £3,025,662.83 X. Costs[98]The Claimant is entitled to the costs of the claim and the application before me. I assessed those at the hearing on an indemnity basis, having regard to PD 44, §9.2(b). I directed an award of 80% of the sums in the schedules presented to me.[99]An indemnity costs order is appropriate in light of the conduct of the KSA in these proceedings, which I consider has been unreasonable to a high degree, and well outside the norm. The KSA has breached multiple orders, including the orders to pay the Claimant’s costs of the application before Julian Knowles J, the order for security for costs in the appeal and the order for the Claimant’s costs of that appeal (as well as the orders to file a further AoS and a Defence). Indeed, it has failed to engage in any way in the proceedings since December 2023 and appears to have made a considered decision to ignore these proceedings, following a lack of success in its state immunity arguments and despite the permission it had to appeal on that matter. I note that the Court of Appeal made an indemnity costs order against the KSA following the dismissal of its appeal on its failure to comply with its orders.