Former Twitter employees charged with spying for Saudi Arabia

Twitter's headquarters in San Francisco. Two former employees were charged with exploiting their access to the company's internal systems to help Saudi Arabia. Photo / Jim Wilson, The New York Times

Ali Alzabarah was an engineer who rose through the ranks at Twitter to a job that gave him access to personal information and account data of the social media service's millions of users.

Ahmad Abouammo was a media partnerships manager at the company who could see the email addresses and phone numbers of Twitter accounts.

On Wednesday, the Justice Department accused the two men of using their positions and their access to Twitter's internal systems to aid Saudi Arabia by obtaining information on American citizens and Saudi dissidents who opposed the policies of the kingdom and its leaders.

The two men, Alzabarah and Abouammo, were charged with acting as agents of a foreign power inside the United States, in the first complaint of its kind involving Saudis in the country. The case raised questions about the security of American technology companies already under scrutiny for spreading disinformation and influencing public opinion, showing that these firms can be penetrated from the inside as well.

It also underscored the broad effort that Crown Prince Mohammed bin Salman of Saudi Arabia and his close advisers have undertaken to silence critics both inside the kingdom and abroad. Jamal Khashoggi, a columnist for The Washington Post who was critical of the way Saudi Arabia was run, was killed last year by Saudi agents in Istanbul.

As part of Saudi Arabia's campaign, its operatives have been active online. Saudi operatives groomed Alzabarah, and even before the charges were filed Wednesday, Western intelligence officials suspected him of spying on user accounts at Twitter to help the Saudi leadership.

Saudi operatives have also used Twitter to harass critics. Twitter has been a popular platform for news in the kingdom since the Arab Spring uprisings began in 2010.

Both Alzabarah and Abouammo left Twitter in 2015. On Wednesday, a spokesman for the company said: "We recognize the lengths bad actors will go to try and undermine our service. Our company limits access to sensitive account information to a limited group of trained and vetted employees."

Twitter added that it was committed to protecting those who used the service to talk about freedom and human rights.

The Washington Post earlier reported on the charges.

American companies like Twitter are attractive targets for foreign agents. "The US has such a dominant position in social media and technology that we are a natural target for our enemies and frenemies," said Mark Rasch, a former head of the Justice Department's computer crime division. "They will use any means at their disposal to get individuals' data from U.S. companies for their intelligence and, in this case, suppression efforts."

In addition to Alzabarah and Abouammo, federal prosecutors charged Ahmed Almutairi, who previously ran a social media marketing company that did work for the Saudi royal family. He and Alzabarah are Saudi citizens, and Abouammo is an American, according to the complaint filed by prosecutors.

The communications between the Twitter employees and a Saudi official began in 2014, according to the complaint. Investigators did not contact Twitter until the end of 2015, when they informed executives that the Saudi government was grooming employees to gain information about the company's users.

According to court documents, the Saudi official who developed the Twitter employees was the "secretary general" of a charitable organization owned by a member of Saudi Arabia's royal family. That description pointed the MiSK Foundation, a technology-focused nonprofit founded by Prince Mohammed.

MiSK is led by Bader Al Asaker, whose title is secretary general. A person familiar with the case said Al Asaker is the foreign official who reached out to the Twitter employees.

Alzabarah had joined Twitter in 2013, rising through the engineering division. He had access to users' telephone numbers and internet protocol addresses, which are unique identification numbers for internet-connected devices.

While at Twitter, Alzabarah had grown increasingly close to Saudi intelligence operatives, Western intelligence officials told company executives. The operatives eventually persuaded him to peer into the accounts of users they sought information on, including dissidents and activists who spoke against the crown, multiple people have told The Times.

Two people familiar with the case said one of the 6,000 Twitter accounts that Alzabarah had looked at on behalf of Saudi officials in 2015 belonged to Omar Abdulaziz, a prominent Saudi dissident and Khashoggi confidant.

Once Twitter was notified of the breach of security, it placed Alzabarah on administrative leave while it investigated. Although Twitter did not find direct evidence that Alzabarah had handed data over to the Saudi kingdom, he left the company in December 2015.

Alzabarah eventually returned to Saudi Arabia, where he joined the MiSK Foundation.

Almutairi served as an intermediary between Alzabarah and Saudi officials, according to the complaint. In messages sent to his wife May 13, 2015, and included in the complaint, Alzabarah said Almutairi had asked him to fly to Washington to meet with a director of the private office of a member of the Saudi royal family.

Alzabarah flew to Washington the next day. While he stayed there for less than 12 hours, he communicated frequently with Almutairi, the complaint said. Within a week of the meeting, he began gaining access to Twitter user accounts en masse.

Abouammo, the media partnerships manager at Twitter, also began exploiting his access to user data within a week after meeting with an unnamed Saudi official in London in 2014, according to the complaint. One of the users was a prominent critic of the Saudi royal family and had more than 1 million followers on Twitter.

Abouammo looked up the user's email address, according to the complaint. He later got the email addresses and phone numbers of other Saudi critics, the complaint said.

The Saudi government compensated Abouammo for his work in a series of wire transfers to him and a member of his family, the complaint said. Abouammo created a limited liability company to receive at least $300,000 from the Saudi government.

Abouammo quit his job at Twitter in May 2015 but continued to pass on requests to his former colleagues at the behest of the Saudi official, according to the complaint. He has since moved to Seattle for a marketing job at Amazon. When an FBI agent interviewed him in 2018, he lied to the agent and produced false documents, the complaint said.

Abouammo was arrested in Seattle on Tuesday, a law enforcement official said.

Saudi Arabia is one of Twitter's five most active markets. In the first six months of 2015, when Alzabarah is accused of starting to use his access to account information, Twitter received 93 emergency requests for user data from Saudi Arabia, according to a company transparency report.

In Twitter's most recent transparency report, covering the first half of 2019, it did not disclose any information requests from Saudi Arabia.

The Saudi operation to track its critics has only escalated in recent years. In June 2018, Saudi officials hacked into Abdulaziz's phone using spyware the Saudi government had bought from NSO Group, an Israeli firm, according to researchers at Citizen Lab, a security research lab at the University of Toronto.

Abdulaziz has sued NSO Group and also sued Twitter two weeks ago, alleging the company failed to inform him that its employee had hacked his account.

"The Saudi regime is trying to silence any voices for freedom or reform," said Alaa Mahajna, a human rights lawyer representing Abdulaziz in his case against NSO Group.

Written by: Kate Conger, Mike Isaac, Katie Benner and Nicole Perlroth

Photographs by: Jim Wilson

© 2019 THE NEW YORK TIMES