Twitter's Saudi spy network leaves activists living in fear

Saudi activists fear they are among thousands of Twitter users whose data is thought to have been obtained by the Saudi government via spies inside the social media giant.

Several have told Middle East Eye that they fear the information, including IP addresses, may have been used to target and arrest activists who have subsequently disappeared.

Earlier this month, a complaint filed by the US government in a California federal court accused two Twitter employees of accessing and giving the details of more than 6,000 users to a Saudi official with close ties to the royal family, between December 2014 and November 2015.

Two of the users whose information was believed to have been shared are Mujtahidd, an anonymous account once described as “the Saudi version of Wikileaks”, and Omar Abdulaziz, a dissident living in Canada, who has filed his own lawsuit against Twitter.

But the identity of the remaining users is unknown – at least to Saudi activists who say the scale of the spying detailed in the complaints took their community, already on high alert in the wake of journalist Jamal Khashoggi’s murder last year, by surprise.

We always thought it would be the bigwigs, but after realising ‘Oh, it’s 6,000 accounts’, even other activists have asked me, ‘Hey, do any of you know if any of us are on this list?'

- Amani al-Ahmadi, Saudi-American feminist

“I think we always thought it would be the bigwigs, but after realising ‘Oh, it’s 6,000 accounts’, even other activists have asked me, ‘Hey, do any of you know if any of us are on this list?,” Amani al-Ahmadi, a Saudi-American feminist based in Seattle, told MEE.

Ali al-Ahmad, a Washington-based Saudi dissident and head of the US-based Institute for Gulf Affairs, said he is certain he was on the list.

“Look, if there are 6,000 people who have been targeted, I don’t think my name will not be in that 6,000 people. I am a major critic. I’ve definitely been a target,” he said.

Twitter sent a message to several dozen users in December 2015, saying that their accounts were among a small group that might have been targeted by state-sponsored actors, according to a second legal complaint filed against the company this year.

And in February 2016, Abdulaziz received a message from the company saying his email address and phone number had been accessed as the result of a bug that had potentially impacted a small number of accounts and had since been fixed.

But neither Ahmadi nor Ahmad have received any such warnings from Twitter, and say they and others have been left to speculate the extent to which their lives – and those with whom they were connected - may have been compromised.

MEE asked Twitter as well as the FBI, which has been investigating the spying, if the thousands of users whose data was allegedly accessed had been identified, and whether the company or the agency had warned those users. Both declined to comment.

“They should have at least released a press statement saying, ‘Hey this is what we are going to do, this is how we are going to protect the users, this is our next plan of action’, but nothing. Crickets. It’s crazy,” said Ahmadi.

Ahmad said: “I was not informed. So if I was not informed, why would they inform someone who was in [Saudi Arabia] that your account has been hacked or compromised? I think that goes to show what they think of us: we don’t matter very much.”

The 'Black List'

Since becoming the de facto leader of the kingdom in 2017, Crown Prince Mohammed bin Salman (MBS) has heavily cracked down on human rights activists and dissidents, in a struggle that has played out largely online.

That August, Saud al-Qahtani, the crown prince’s former top adviser, started what he called the "Black List" hashtag, which was used to target critics of the government, and tweeted that the government had ways to find anonymous Twitter users.

“Does a pseudonym protect you from #the_black_list? No. 1) States have a method to learn the owner of the pseudonym 2) the IP address can be learned using a number of methods 3) a secret I will not say,” he tweeted without explanation.

A month later, a wave of arrests started in the kingdom, first targeting academics and scholars, business people who were locked up in the Ritz Carlton in Riyadh, and then women’s rights activists, as Human Rights Watch (HRW) has detailed in a report released this month.

Commenting on the blacklist in February 2018, Khashoggi wrote in the Washington Post: "Writers like me, whose criticism is offered respectfully, seem to be considered more dangerous than the more strident Saudi opposition based in London. The government arrested dozens of intellectuals, clerics and social media figures over the past year, even though most are actually supportive of MBS's reforms."

Now activists say they are concerned that some of those arrested during this period may have been imprisoned as a result of the spying, and that the full extent of damage has yet to be fully revealed.

One person who comes up repeatedly in conversation is Turki bin Abdulaziz al-Jasser, a Saudi journalist, who is believed to have run Kashkoul, a popular anonymous Twitter account that was critical of the Saudi government.

Al-Jasser was arrested at his home in Riyadh in March 2018 and has not been seen since.

Adam Coogle, a Middle East researcher at HRW, said that without further information from Twitter about whose details were accessed, the activists’ worries are justified.

“There is every reason to be concerned that people could have been picked up based on the information collected by Twitter employees,” Coogle told MEE. “But we don’t know for certain.”

Jasser’s account, activists point out, was a popular one and his activity was known to his family. Others may have been tweeting without anyone’s knowledge, making the reason behind their arrests unclear. Or they might have family members who haven’t spoken out publicly.

“There are a lot of families that kept quiet when they took their family members away because they thought if they talked, it’s going to make things worse for their imprisoned family member,” said Ahmadi.

“So there could be a lot of people that we don’t even know about that this is affecting and they are still somewhere in a cell in Saudi Arabia getting tortured or god knows what.”

Another Saudi potentially at risk is Abdulrahman al-Sadhan.

A humanitarian worker, al-Sadhan, 35, was arrested at the offices of the Saudi Arabian Red Crescent Society, where he worked in March 2018. He is believed to have been running an anonymous Twitter account critical of the government.

According to Saudi human rights advocacy group Al-Qst, he was last seen in October 2018 at the Dhahban Prison in Jeddah, where he has been tortured.

'From those 6,000, you just never know how many actually are in jail right now'

- Areej al-Sadhan, Abdulrahman al-Sadhan's sister

“From those 6,000, you just never know how many actually are in jail right now,” Areej al-Sadhan, Abdulrahman’s sister, told MEE. She has been speaking out in an attempt to find out more about what happened to her brother.

Marc Owen Jones, a social media analyst and assistant professor at Hamad bin Khalifa University in Qatar, said concerns about Sadhan and others are “absolutely valid”.

“We know from places like Bahrain that the revealing of an anonymous user's IP address has resulted in their detaining and torture. It is entirely plausible that if his IP was compromised, his physical location was known,” he told MEE.

MEE asked Twitter and the FBI whether al-Jasser or al-Sadhan were among the users whose data had been accessed and shared with Saudi officials. Both declined to comment.

'You cannot trust an American company'

The Twitter account of Ahmed al-Mutairi, who is described in the US government’s complaint as a Saudi social media marketer with whom the two Twitter employees were sharing accessed data, has been suspended since the complaint was filed.

But some Saudi activists remain anxious and angry with Twitter and other American companies with Saudi investment whom they say are facilitating Saudi state repression with their public statements and business decisions.

As MEE reported earlier this month, Twitter CEO Jack Dorsey met with the crown prince six months after his company learned that a spy, directed by the Saudi leader's close associate, had infiltrated the company. MEE asked whether Twitter had raised concerns about the spying with Mohammed bin Salman during that meeting, but the company declined to comment.

Last week, Dara Khosrowshahi, the CEO of Uber, whose fifth-largest shareholder is Saudi Arabia, caused a stir when footage was released of an interview he gave to Axios on HBO in which he said Jamal Khashoggi’s murder had been a “mistake”.

“I think that government said that they made a mistake. It’s a serious mistake. We’ve made mistakes too with self-driving,” he said, later backtracking on his comments.

Ahmadi said a lot of these businesses associated with Saudi Arabia are now “getting this almost criminal complacent stain” because they aren’t speaking out about the state’s actions.

“They aren’t saying anything about it. They are almost condoning it. They are in bed with it. They are fine with it. The way Twitter is now – no comment, no nothing,” she said.

“It’s tainting other American businesses, and it’s also showing them our humanist values and all of that can change for the right amount of money. It’s disgusting and it’s setting a precedent for other businesses that this is okay and it’s not.”

There is also guilt among some activists over how their choices as consumers may have compromised people with whom they were in contact.

“I am so stupid,” said Ahmad. “I should have not used [Twitter] because you cannot trust an American company. And I can say that it was stupid on my part because maybe other people were hurt. I will never know. I don’t know so far. I will try to get to the bottom of it.”

They are not alone in their calls. Senator Bob Menendez, the top-ranking Democrat on the Senate Foreign Relations Committee, called this past week on both Twitter and US Secretary of State Mike Pompeo and US Ambassador to Saudi Arabia John Abizaid to raise their concerns over the alleged spying with the kingdom.

Menendez, in particular, said he was "sorely disappointed" to see high-level officials travel to the 'Davos in the Desert' conference in October. The US delegation this year included Jared Kushner, US President Donald Trump's son-in-law and adviser, Treasury Secretary Steven Mnuchin and Energy Secretary Rick Perry. 

American companies with representatives at the conference, widely panned last year in the wake of Khashoggi's murder, included Blackstone Group, BlackRock, Bridgewater Associates and Goldman Sachs Group. 

'Do the right thing'

Of course, companies may argue, like Khosrowshahi did in his Axios on HBO interview, that Saudi Arabia is “just like any other shareholder”.

“Now we are a public company, anyone can invest in our company if they chose to do so. They are a big investor just like you could be a big investor as well,” he said.

But is Saudi Arabia really like any other investor, asked one activist who lives in the US and preferred to stay anonymous for her safety.

“They have so much investment. It means they have a certain level of control and this is dangerous, especially when you are dealing with more of a Mafia-type of country,” said the activist, who has now deleted the apps of all companies with significant Saudi investment on her phone.

'These companies like Twitter should learn their lesson and stop doing business with Saudi Arabia. This is one thing you can do to stop this madness'

- US-based activist

But, she said, the real blame should fall not on tech companies, but on the US and Saudi governments “because this is a government trying to spy on another government to silence people”.

“What really pisses me off is why the US government is OK with it, why Pompeo is not saying anything,” she said. “You’re supposed to protect the US. You are supposed to do whatever is best for the US. Why are you staying quiet about it?”

Meanwhile, companies like Twitter, which have Saudi investors, have a chance to do the right thing.

“Whatever money Saudi Arabia is waving in front of your face, it’s not going to be worth it, in the end, when there is a problem or scandal like this,” she said.

“These companies like Twitter should learn their lesson and stop doing business with Saudi Arabia. This is one thing you can do to stop this madness.”

This article is available in French on Middle East Eye French edition.