The ruler of Dubai hacked the phone of his ex-wife Princess Haya using NSO Group’s controversial Pegasus spyware in an unlawful abuse of power and trust, a senior high court judge has ruled.

The president of the family division found that agents acting on behalf of Sheikh Mohammed bin Rashid al-Maktoum, who is also prime minister of the United Arab Emirates, a close Gulf ally of Britain, hacked Haya and five of her associates while the couple were locked in court proceedings in London concerning the welfare of their two children.

Those hacked included two of Haya’s lawyers, one of whom, Fiona Shackleton, sits in the House of Lords and was tipped off about the hacking by Cherie Blair, who works with the Israeli NSO Group.

In July, a Guardian investigation revealed for the first time that Haya and her associates were on a dataset believed to indicate people of interest to a government client of NSO, thought to be Dubai.

Sir Andrew McFarlane’s damning judgment from 5 May, only now published, appears to confirm that finding – which was part of the Pegasus project investigation – and goes further in saying that unlawful surveillance was actually carried out.

Haya’s phone was found to have been hacked 11 times in July and August last year with Sheikh Mohammed’s “express or implied authority”.

The Met police said it was informed of the alleged hacking last year and detectives carried out “significant inquiries” over the course of five months but the investigation was closed in February due to “no further investigative opportunities”.

Although McFarlane’s findings were on the lower civil standard of proof, which requires a conclusion on the balance of probabilities rather than the criminal standard of beyond reasonable doubt, a Met police spokesperson said: “We will of course review any new information or evidence which comes to light in connection with these allegations.”

In another judgment by McFarlane, one of 11 rulings to which news organisations were granted access on Wednesday, it was revealed that agents working on behalf of the sheikh had attempted to buy a £30m estate next door to Haya’s Berkshire home. In response, the judge created a 100-metre exclusion zone around her property and a 1,000ft no-fly zone above it to protect her from the sheikh and his agents.

In his phone-hacking judgment, McFarlane criticised Sheikh Mohammed in the strongest terms.

“The findings represent a total abuse of trust, and indeed an abuse of power, to a significant extent,” he said. “I wish to make it plain that I regard the findings that I have now made to be of the utmost seriousness in the context of the children’s welfare. They may well have a profound impact upon the ability of the mother and of the court to trust him with any but the most minimal and secure arrangements for contact with his children in the future.”

On one occasion, according to the judgment, when Haya’s phone was hacked, 265 megabytes of data was uploaded, equivalent to about 24 hours of digital voice recording data or 500 photographs. It occurred during a period described by McFarlane as “a particularly busy and financially interesting time in these proceedings, with the buildup to key hearings relating to the mother’s long-term financial claims for herself and the children”.

In a witness statement, the sheikh, who has not appeared in court throughout the proceedings – unlike his ex-wife who was a regular attendee – argued that “it is hard to see how the hacking allegations make a substantial difference” to his contact with his children, but this was dismissed out of hand by McFarlane.

The latest judgments will increase scrutiny on Britain’s relationship with the UAE, coming after a December 2019 ruling by McFarlane that found the sheikh orchestrated the abductions of two of his other children, Princess Latifa and Princess Shamsa – in the latter case from the streets of Cambridge – and subjected Haya to a campaign of “intimidation”.

McFarlane used the opportunity of the phone-hacking ruling to criticise the sheikh’s claim after the December 2019 judgment in which the Dubai ruler said: “As head of government I was not able to participate in the court’s fact-finding process.” McFarlane stated this was untrue as the sheikh had submitted two witness statements to that trial and had had a large legal team that he had instructed to withdraw from the courtroom rather than participate.

Sheikh Mohammed’s expensively assembled legal team had attempted to prevent McFarlane ruling on the phone hacking by claiming that the court had no jurisdiction to sit in judgment on a foreign act of state, namely the alleged use of spyware by the UAE and/or Dubai. However, in separate hearings this was rejected by the high court and court of appeal, with the supreme court refusing to allow a further appeal.

Haya fled to London in April 2019 with the couple’s two young children, triggering a still ongoing legal battle over custody, access and financial support.

In a witness statement supporting her application for the exclusion zone around her Castlewood House home, previously occupied by Prince Andrew and Sarah Ferguson, Haya said: “It feels as if I am being stalked, that there is literally nowhere for me to go to be safe from [her ex-husband], or those acting in his interests. It is hugely oppressive … I feel like I cannot breathe any more; it feels like being suffocated. I don’t want the children to live with the kind of fear that punctuates my existence at all times. They do not deserve this.”

On 9 December last year, granting her request, McFarlane said that in the abduction of his two adult daughters, the sheikh had demonstrated “his ability to act and to do so irrespective of domestic criminal law”, explicitly referencing the fact that Shamsa was taken from Cambridge to Dubai by helicopter. “The mother is justified in regarding the purchase of a substantial estate immediately abutting her own as being a very significant threat to her security, both in terms of providing an opportunity for 24-hour close surveillance and as a close-to-hand transport hub for a helicopter,” the judge said.

After the findings were published, Sheikh Mohammed issued a statement in which he continued to deny the allegations relating to hacking.

“These matters concern supposed operations of state security. As a head of government involved in private family proceedings, it was not appropriate for me to provide evidence on such sensitive matters… Neither the Emirate of Dubai nor the UAE are party to these proceedings and they did not participate in the hearing. The findings are therefore inevitably based on an incomplete picture.”