Former Twitter Employees Charged With Spying for Saudi Arabia
The Justice Department’s charges raised questions about the security of technology companies.
SAN FRANCISCO — Ali Alzabarah was an engineer who rose through the ranks at Twitter to a job that gave him access to personal information and account data of the social media service’s millions of users.
Ahmad Abouammo was a media partnerships manager at the company who could see the email addresses and phone numbers of Twitter accounts.
On Wednesday, the Justice Department accused the two men of using their positions and their access to Twitter’s internal systems to aid Saudi Arabia by obtaining information on American citizens and Saudi dissidents who opposed the policies of the kingdom and its leaders.
The two men, Mr. Alzabarah and Mr. Abouammo, were charged with acting as agents of a foreign power inside the United States, in the first complaint of its kind involving Saudis in the country. The case raised questions about the security of American technology companies already under scrutiny for spreading disinformation and influencing public opinion, showing that these firms can be penetrated from the inside as well.
It also underscored the broad effort that Crown Prince Mohammed bin Salman of Saudi Arabia and his close advisers have conducted to silence critics both inside the kingdom and abroad. Jamal Khashoggi, a columnist for The Washington Post who was critical of the way Saudi Arabia is run, was murdered last year by Saudi agents in Istanbul.
As part of Saudi Arabia’s campaign, its operatives have been active online. Saudi operatives groomed Mr. Alzabarah, and even before the charges were filed on Wednesday, Western intelligence officials had suspected him of spying on user accounts at Twitter to help the Saudi leadership.
Saudi operatives have also used Twitter to harass critics. Twitter has been a popular platform for news in the kingdom since the Arab Spring uprisings began in 2010.
Both Mr. Alzabarah and Mr. Abouammo left Twitter in 2015. On Wednesday, a spokesman for the company said: “We recognize the lengths bad actors will go to try and undermine our service. Our company limits access to sensitive account information to a limited group of trained and vetted employees.”
Twitter added that it was committed to protecting those who used the service to talk about freedom and human rights.
The Washington Post earlier reported on the charges.
American companies like Twitter are attractive targets for foreign agents. “The U.S. has such a dominant position in social media and technology that we are a natural target for our enemies and frenemies,” said Mark D. Rasch, a former head of the Justice Department’s computer crime division. “They will use any means at their disposal to get individuals’ data from U.S. companies for their intelligence and, in this case, suppression efforts.”
In addition to Mr. Alzabarah and Mr. Abouammo, federal prosecutors charged Ahmed Almutairi, who previously ran a social media marketing company that did work for the Saudi royal family. He and Mr. Alzabarah are Saudi citizens, and Mr. Abouammo is an American, according to the complaint filed by prosecutors.
The communications between the Twitter employees and a Saudi official began in 2014, according to the complaint. Investigators did not contact Twitter until the end of 2015, when they informed executives that the Saudi government was grooming employees to gain information about the company’s users.
According to court documents, the Saudi official who developed the Twitter employees was the “secretary-general” of a charitable organization owned by a member of Saudi Arabia’s royal family. That description pointed to the MiSK Foundation, a technology-focused nonprofit founded by Prince Mohammed.
MiSK is led by Bader Al Asaker, whose title is secretary general. A person familiar with the case said Mr. Al Asaker is the foreign official who reached out to the Twitter employees.
Mr. Alzabarah had joined Twitter in 2013, rising through the engineering division. He had access to users’ telephone numbers and internet protocol addresses, which are unique identification numbers for internet-connected devices.
While at Twitter, Mr. Alzabarah had grown increasingly close to Saudi intelligence operatives, Western intelligence officials told company executives. The operatives eventually persuaded him to peer into the accounts of users they sought information on, including dissidents and activists who spoke against the crown, multiple people have told The Times.
Two people familiar with the case said one of the 6,000 Twitter accounts that Mr. Alzabarah had looked at on behalf of Saudi officials in 2015 belonged to Omar Abdulaziz, a prominent Saudi dissident and confidant of Mr. Khashoggi.
Once Twitter was notified of the breach of security, it placed Mr. Alzabarah on administrative leave while it investigated. Though Twitter did not find direct evidence that Mr. Alzabarah had handed data over to the Saudi kingdom, he left the company in December 2015.
Mr. Alzabarah eventually returned to Saudi Arabia, where he joined the MiSK Foundation.
Mr. Almutairi served as an intermediary between Mr. Alzabarah and Saudi officials, according to the complaint. In messages sent to his wife on May 13, 2015, and included in the complaint, Mr. Alzabarah said Mr. Almutairi had asked him to fly to Washington to meet with a director of the private office of a member of the Saudi royal family.
Mr. Alzabarah flew to Washington the next day. While he stayed there for less than 12 hours, he communicated frequently with Mr. Almutairi, the complaint said. Within a week of the meeting, he began gaining access to Twitter user accounts en masse.
Mr. Abouammo, the media partnerships manager at Twitter, also began exploiting his access to user data within a week after meeting with an unnamed Saudi official in London in 2014, according to the complaint. One of the users was a prominent critic of the Saudi royal family and had more than one million followers on Twitter.
Mr. Abouammo looked up the user’s email address, according to the complaint. He later got the email addresses and phone numbers of other Saudi critics, the complaint said.
The Saudi government compensated Mr. Abouammo for his work in a series of wire transfers to him and a member of his family, the complaint said. Mr. Abouammo created a limited liability company to receive at least $300,000 from the Saudi government.
Mr. Abouammo quit his job at Twitter in May 2015 but continued to pass on requests to his former colleagues at the behest of the Saudi official, according to the complaint. He moved to Seattle for a marketing job at Amazon but left the company more than a year ago, an Amazon spokesman said. When an F.B.I. agent interviewed him in 2018, he lied to the agent and produced false documents, the complaint said.
Mr. Abouammo was arrested in Seattle on Tuesday, a law enforcement official said.
Saudi Arabia is one of Twitter’s five most active markets. In the first six months of 2015, when Mr. Alzabarah is accused of starting to use his access to account information, Twitter received 93 emergency requests for user data from Saudi Arabia, according to a company transparency report.
In Twitter’s most recent transparency report, covering the first half of 2019, it did not disclose any information requests from Saudi Arabia.
The Saudi operation to track its critics has only escalated in recent years. In June 2018, Saudi officials hacked into Mr. Abdulaziz’s phone using spyware the Saudi government had bought from NSO Group, an Israeli firm, according to researchers at Citizen Lab, a security research lab at the University of Toronto.
Mr. Abdulaziz has sued NSO Group and also sued Twitter two weeks ago, alleging the company failed to inform him that its employee had hacked his account.
“The Saudi regime is trying to silence any voices for freedom or reform,” said Alaa Mahajna, a human rights lawyer representing Mr. Abdulaziz in his case against NSO Group.
New York Times