On Wednesday, the U.S. Justice Department filed charges against two former Twitter employees and a Saudi Arabian citizen for spying on the social network’s users. The government alleges that the accused provided Riyadh with information on known and suspected dissidents. U.S. Attorney David Anderson said that the suspects mined the platform’s systems to gather information on thousands of Twitter users.
U.S. prosecutors allege that Saudi national Ahmed Almutairi recruited Twitter employees Ali Alzabarah and Ahmad Abouammo. Using their privileged access to Twitter’s network the pair gathered email addresses, birthdates, phone numbers, and IP addresses for the Saudi Royal Family. In return, the Middle Eastern nation paid the duo a fortune for the private data.
The New York Times notes that Abouammo created a limited liability corporation that received $300,000 from the Saudi government.
Alzabarah, a Saudi national, worked as a Twitter reliability engineer from 2013 to 2015. Moreover, the social network employed Abouammo, an American citizen, as a media partnerships manager during the same timeframe. The Justice Department’s filings indicate that the Saudi government first reached out to the two workers in 2014.
The U.S. government accuses Abouammo of using his credentials to access the personally identifiable information of prominent Saudi Royal Family critics. In addition, the Justice Department claims that Abouammo used his contacts at Twitter to gather information on dissidents even after he left the company.
Alzabarah allegedly used his corporate privileges to gather data on more than 6,000 Twitter users. The Washington Post reports that the engineer even met with Saudi Crown Prince Mohammed bin Salman in person in 2015.
The Justice Department is charging Almutairi, Abouammo, and Alzabarah with illegally acting as agents of a foreign government. If convicted, all three men face a maximum 10-year prison sentence. Also, prosecutors have charged Abouammo with lying to the Federal Bureau of Investigation, which carries a maximum sentence of 20 years in prison.
In a statement, Twitter applauded the Justice Department’s action. The company also acknowledged the risks that its users take in speaking out and reiterated that it works to protect their privacy with network tools and sensitive information controls.
Dissident Files Lawsuit
In addition to the public relations fallout of having its network subverted by the Saudi government, Twitter is also facing a private lawsuit related to the scandal. Omar Abdulaziz, a noted Saudi dissident, contends that the firm put his life at risk by failing to protect his user data. The activist, who now lives in Montréal, filed his suit against the corporation in mid-October.
Abdulaziz’s filing notes that Twitter learned that Alzabarah had been transmitting user data to Saudi Arabia in 2015. Moreover, the lawsuit alleges that the firm fired the engineer after an investigation and alerted individual members about a data breach. However, though The New York Times reports that Alzabarah transmitted Abdulaziz’s data to Saudi authorities, he did not receive a notification.
Furthermore, Abdulaziz claims that the information Alzabarah harvested allowed Riyadh to plant malware on his smartphone. Consequently, the region’s intelligence services used his compromised device to spy on dissident activities in the country.
Abdulaziz also maintains that agents of the Saudi government attempted to meet with him in the county’s Ottawa-based embassy in 2018. The activist declined. Some months later, his fellow organizer and Washington Post writer Jamaal Khashoggi was killed while visiting the Saudi Consulate in Istanbul. In December, the Central Intelligence Agency determined that Prince Mohammed bin Salman ordered Khashoggi’s murder.