Two former Twitter Inc. employees and a Saudi national were charged by the U.S. with helping the government in Riyadh spy on dissidents who used the social network.
The employees, one from Twitter’s hometown of San Francisco and one in Saudi Arabia, were allegedly recruited to use their company credentials to gain access to the accounts of “users of interest” to the Saudi royal family, according to a criminal complaint unsealed on Wednesday.
“Saudi agents mined Twitter’s internal systems for personal information about known Saudi critics and thousands of other Twitter users,” U.S. Attorney David Anderson in San Francisco said in a statement.
The charges show a dark side of Twitter’s mission to be a free and open forum where everyone has a voice and anyone can speak truth to power. Even as the platform has served as an outlet for criticism of repressive regimes, it’s also proven useful to those regimes for tracking down and punishing critics. Human rights organizations have tallied dozens of Twitter-related prosecutions in Saudi Arabia.
Twitter said it’s committed to protecting those who use its service and applauded the Justice Department’s actions. At the same time, the company is being sued by a prominent Saudi dissident who alleges the company put his family in danger by failing to tell him about a hack into his account that he attributes to one of the men charged in the U.S. complaint, Ali Alzabarah.
Prosecutors say that Alzabarah, 35, of Saudi Arabia, and Ahmad Abouammo, 41, most recently of Seattle, were recruited by a third Saudi, Ahmed Almutairi, 30, who was working on behalf of the royal family. All three are charged with acting as illegal agents of a foreign government. Abouammo is also charged with creating a false $100,000 invoice for consulting services to the Saudi government to cover up his activities when he was questioned by the FBI. Only Abouammo was arrested and the other two are not in the U.S., officials said.
The criminal complaint traces Abouammo’s involvement with the Saudi government back to 2014, when he worked in one of Twitter’s San Francisco offices as a media partnership manager for the Middle East and Africa. That’s when he allegedly agreed to meet in London with an unidentified member of the inner circle of the Saudi crown prince, Mohammed bin Salman.
After the Saudi official gave him an expensive wrist watch, Abouammo started collecting information on Twitter users and maintained regular contact with the official, who wired him hundreds of thousands of dollars in payments, according to prosecutors.
Even after Abouammo left Twitter in 2015 and took a new job in Seattle, he continued to do the bidding of the Saudi official by enlisting the help of former Twitter colleagues, according to the complaint.
Prosecutors allege that Alzabarah was similarly recruited by Saudi intelligence operatives, though he traveled to Washington in 2015 to meet with a person identified in the complaint as "Royal Family Member-1." The Washington Post, which reported on the complaint earlier, said "Royal Family Member-1” is Mohammed bin Salman.
After returning to San Francisco, Alzabarah allegedly accessed the private data of more than 6,000 Twitter users, including at least 60 for whom Saudi law enforcement officials had sought information through official Twitter channels. After Twitter fired him, he later joined a charitable foundation in Saudi Arabia where he worked with a team “to monitor and manipulate” social media, according to the complaint.
Prosecutors say Almutairi ran a Saudi social media marketing company for the members of the Saudi royal family. He allegedly met with Abouammo before the London trip and also met Alzabarah.
“We recognize the lengths bad actors will go to try and undermine our service,” Twitter said in a statement. “Our company limits access to sensitive account information to a limited group of trained and vetted employees. We understand the incredible risks faced by many who use Twitter to share their perspectives with the world and to hold those in power accountable. We have tools in place to protect their privacy and their ability to do their vital work.”
Officials at the Saudi embassy in Washington didn’t immediately respond to a request for comment.
The dissident who sued Twitter last month claims that Saudi agents -- through information about his account provided by Alzabarah in 2015 -- were able to plant malware on his phone in 2018 and spy on his activities.
Omar Abdulaziz alleges that’s how Saudi spies discovered plans for a social media protest that he was planning with Washington Post journalist Jamal Khashoggi. Months later, Khashoggi was slain in the Saudi embassy in Istanbul.
Twitter declined to comment on Abdulaziz’s lawsuit.
The criminal case is USA v. Abouammo, 19-mj-71824 U.S. District Court, Northern District of California. The dissident’s lawsuit is Abdulaziz v. Twitter Inc., 19-cv-06694, U.S. District Court, Northern District of California (San Francisco).
--With assistance from Kurt Wagner and Glen Carey.