A Saudi Prince's Attempt to Silence Critics on Twitter

An ongoing investigation reveals how Mohammed bin Salman's team allegedly infiltrated the platform—and got away with it.
A twitter bird caught in a cage.
Illustration: Elena Lacey; Getty Images

This story is adapted from Blood and Oil: Mohammed bin Salman's Ruthless Quest for Global Power, by Bradley Hope and Justin Scheck.

In 2014, Mohammed bin Salman’s uncle, King Abdullah, was nearing death. For more than 60 years, the Saudi crown had been passed from one son of the kingdom’s founder to the next, the heir being determined by a combination of seniority and consensus of the surviving brothers. Mohammed’s father, Crown Prince Salman, was set to inherit the throne upon Abdullah’s death. But anonymous Twitter users were spreading claims that Salman had dementia, and that presented a problem for Mohammed: If the rumors became accepted as fact by Saudis and foreigners, Salman’s brothers might feel pressure to elevate one of his rivals, cutting the Salman clan off from its claim to the throne and dashing Mohammed’s hopes of one day inheriting the crown.

Mohammed grasped the significance of social media long before the kingdom’s geriatric princes. A millenial himself, he spent his youth eating fast food, playing Age of Empires and first-person shooter games, and keeping up with friends on the internet, according to people who’ve known him since childhood. He was a member of the country’s core demographic: About 60 percent of the population was under thirty. And though the country had become more conservative in the last 35 years, young Saudis had unfettered access to Twitter, Facebook, and YouTube. They were the least powerful people in the country—many struggled to find jobs—but they were also the most educated and outnumbered the religious ideologues many times over.

Mohammed understood that in a country without polling or elections, platforms like Twitter could reveal how the public felt about a policy or a leader—an important consideration for a family living in perpetual fear of a people’s uprising. On the other hand, negative sentiment on Twitter could undermine a would-be ruler. As the Arab Spring showed, discontented youth could pose a threat to Al Saud rule. Or they could be co-opted by a reform-minded ruler and become the base from which his power sprang.

So Mohammed, according to legal filings from the Department of Justice, determined to secure his father’s fate and his own popularity among the Saudi youth, had Bader al-Asaker, the head of the prince’s private foundation, begin a years-long effort to unmask his family’s critics on Twitter. A court case is still underway, but the indictment claims the endeavor began with a conventional strategy: bribery. (Prosecutors filed revised charging documents this summer, dismissing an earlier indictment in a procedural move and replacing it with updated charges.)

Bader al-Asaker, a kindly looking man with dark, rectangular glasses who wouldn’t be out of place at an IT conference, wasn’t really a government official in 2014. He worked for Mohammed personally. But as an employee of Crown Prince Salman’s son, he could gain access pretty much anywhere.

On June 13 of that year, according to the indictment, Asaker traveled to San Francisco to meet Twitter’s head of Middle East partnerships, an Egyptian American named Ahmad Abouammo. It was framed as a routine visit by an important figure from an important Twitter market. Abouammo showed Asaker around Twitter headquarters in San Francisco’s South of Market district. Asaker explained that he worked for an important prince who used Twitter extensively. The men exchanged contact information and arranged to follow up in London in the fall. During that meeting, Asaker gave the Twitter employee a gift: a Hublot watch worth at least $20,000.

Then came the ask. Twitter users were making trouble for Mohammed, including one nicknamed Mujtahidd, who had been brazenly criticizing the royal family and publishing rumors about senior members that often had a kernel of truth. It was a political mess, but it wasn’t criminal or terrorist in nature, so Twitter wouldn’t reveal the identity of such users to Saudi law enforcement. Asaker asked if Abouammo could help them find information on the people who registered these accounts.

Abouammo complied, using his access to internal systems to find Mujtahidd’s email address and phone number. It was a potentially reckless move by the Twitter employee, possibly unmasking critics of a government that locked up dissidents.

Such requests continued for months. Over that time, Salman became king, Mohammed gained stature, and Asaker found himself working for one of the most powerful men in Saudi Arabia. Asaker would pay more than $300,000 to Abouammo, deposited in a Lebanese bank account that Abouammo had a relative open for him. “Proactive and reactively we will delete evil, my brother,” Abouammo texted Asaker just before one deposit of $9,911.

Abouammo had limited technical skill, and a single mole was hardly a reliable way of ensuring consistent access to Twitter users’ private information. Asaker found a better spy, according to Justice Department filings. As luck would have it, Twitter had hired a young Saudi named Ali Alzabarah, who was educated in the United States on a Saudi scholarship.

Living in San Francisco, Alzabarah struck his friends as a typical software engineer—a “nerd,” one friend called him admiringly. He didn’t seem interested in things other than software and didn’t speak much until the conversation turned to programming or the future of technology. Away from work, says a friend of his, Alzabarah seemed to spend most of his time at home or socializing with a small group of expat Saudis who worked at tech firms in the Bay Area.

In February 2015, according to the indictment, Asaker had an intermediary reach out to Alzabarah. It turned out that the engineer felt deeply patriotic toward Saudi Arabia and wanted to help the kingdom however he could. And while Alzabarah’s job entailed maintaining systems to keep Twitter working properly, his position at the company did allow him access to the private information of many users, including their phone numbers, email addresses, and IP addresses. That meant that in some instances, Alzabarah could not only help unmask an anonymous regime critic, but also pinpoint the person’s location.

A few months later, Asaker traveled to the United States as part of an official Saudi delegation and asked Alzabarah to meet him. “I am traveling to Washington at the request of the office of Mohammed bin Salman,” Alzabarah told his wife in a text message.

Soon after that meeting, Alzabarah began using internal Twitter systems to comb through the account information of more than 6,000 Twitter users. Mujtahidd, in particular, was an ongoing target. He was tweeting out what he claimed was private information about the royal family, and some of it, like the looming dismissal of King Salman’s brother, Muqrin, as crown prince in April 2015, turned out to be true. The following month, Mujtahidd posted embarrassing documents from France detailing how the widow of a former crown prince was refusing to pay millions of dollars for luxurious hotel stays.

Days later Alzabarah accessed Mujtahidd’s account and got his phone number and IP address at Asaker’s request. Further requests for other users followed. Alzabarah told Asaker that one user split time between Turkey and Iraq. Another was based in Turkey. A third, a Saudi, was “a professional” who used encryption to conceal his identity, though once he signed in without encryption, and Alzabarah was able to track his IP address.

The Twitter engineer seemed to realize he was providing valuable information to Mohammed’s men—some of the accounts he was accessing were, the Royal Court suspected, connected to terrorism, and Saudi officials announced a $1.9 million reward to anyone who helped avert an attack. In his private Apple Notes account, Alzabarah drafted language to ask Asaker about whether he could claim that money.

Alzabarah spoke by phone with Asaker on June 18 and the next day accessed the Twitter account of Omar Abdulaziz, a Saudi man who had obtained asylum in Canada after the kingdom cut off his schooling in retribution for public critiques of the government and who would form a strong bond with a Saudi journalist and regime critic named Jamal Khashoggi.

As the surveillance efforts gained momentum and sophistication, Alzabarah took a trip to Riyadh, where he continued accessing user accounts from Saudi Arabia. Now that the onetime “nerd” had become an international man of mystery, he seemed to want credit from the Saudi government and some reassurances of aid if he got into trouble. “Where am I, and how is this going to affect me?” Alzabarah contemplated in another Apple Notes entry, wondering whether he could get government help for his father or business training from Mohammed’s foundation. With the risks he was taking for senior officials, he wanted a “permanent” job, “something that secures my future and my family’s.”

Alzabarah returned to San Francisco and to Twitter and continued providing information to Asaker about Mujtahidd, the government critic. Soon after, he scored an apparent victory: Mujtahidd’s account was shut down, and Mujtahidd claimed online that Twitter had told him the account was “compromised,” though he was able to recover it days later.

A few months later, Alzabarah was promoted to a higher engineering position at Twitter. “As much as I am happy for the position, I am happier with and very proud of my work with you,” he wrote in an apparent draft of a letter to Asaker.

But Alzabarah was less careful than one might expect a worried tech expert to be. He spoke with Asaker on an open phone line and communicated via email. US intelligence agents picked up on it.

It was a sensitive situation. Intelligence agencies don’t work with the goal of developing criminal cases in US courts. They’re focused on things happening outside the United States, and using the vast amounts of data they gather to mount court cases opens up all sorts of potential problems, including revealing who’s being listened to abroad. But sometimes they come across things that clearly deserve an examination by prosecutors. An employee of a US company taking cash from a foreign government to access user information is one example. So intelligence officials passed the information on to the Justice Department, where it found its way to the San Francisco FBI office.

Late in 2015, an FBI agent walked downhill from San Francisco’s Kennedy-era federal building in the squalid Tenderloin, down a block often littered with syringes, to Market Street, where Twitter has its headquarters. The agent sat down with company lawyers and broke the news: Twitter had a mole.

By that time Abouammo had left the company, but Alzabarah was still active. The situation was sensitive, the agent explained, and the investigation was at an early stage. The agent asked that the company not tell Alzabarah what was going on—it could imperil the case if he got wind of the investigation.

But Twitter’s lawyers were skeptical of the Feds. Like many in the tech community, they resented law enforcement’s presumption that it could get whatever private information it wanted. User data was sacrosanct as far as the Twitter lawyers were concerned. Even if the US government was requesting the data in an effort to bust someone who was giving it to a foreign government, Twitter was reluctant to cooperate. So rather than follow the FBI’s request to keep things quiet to assist the case, Twitter lawyers brought Alzabarah in the following afternoon, accused him of improperly accessing user accounts, and told him he was temporarily suspended. (Twitter declined requests for comment. Abouammo, Alzabarah, and Asaker did not respond to several requests for comment.)

According to people familiar with the event, Alzabarah went home and called a friend, a Saudi-born venture capitalist he’d met in the Bay Area tech community. His friend picked him up a couple hours later, and Alzabarah told him he had a problem. He’d been “curious,” started looking into some user accounts, and got busted. Now he was suspended from Twitter and figured he had to head back to the kingdom.

“Why?” his friend asked while they sat in his car, according to people familiar, “I don’t think that this is serious.” If there were some sort of legal or security concern, he told Alzabarah, he would’ve been detained by the police or something, not allowed to leave on his own.

“No,” Alzabarah said, “I need to go.” He called Asaker on his friend’s phone, and eventually Asaker got in touch with the Saudi consul in Los Angeles, phone records obtained by the FBI show. After a long back-and-forth, Alzabarah got on the phone with the consul general shortly after midnight. Less than seven hours later, Alzabarah and his wife and daughter were on a flight to Riyadh via LA. From the plane, according to flight records, he sent a resignation email to his bosses at Twitter.

Justice Department officials were livid, says a person familiar with the discussions. Twitter had blown up their case, tipping off a man they’d hoped to arrest—a man they would accuse of violating Twitter’s rules and compromising the privacy of its users in the name of espionage for a foreign government. Now he was out of reach.

Back in Saudi Arabia, Alzabarah went to work under Asaker with Mohammed’s foundation. His responsibility, according to Justice Department court filings, was “to monitor and manipulate social media” for the benefit of the kingdom.

In May 2017, President Donald Trump made his first overseas visit, a trip to Riyadh. Not long after his arrival, the president toured King Salman’s new anti-terrorism center, which focused on tracking extremists on Twitter. Afterward, the president, his wife, the king, and Abdel-Fattah el-Sisi of Egypt gathered around an illuminated orb at the center of the room and posed for a photo. Standing just outside the frame was the kingdom’s new social media specialist, Ali Alzabarah.


Excerpted from Blood & Oil: Mohammed bin Salman's Ruthless Quest for Global Power, by Bradley Hope and Justin Scheck. Copyright © 2020. Available from Hachette Books, an imprint of Hachette Book Group, Inc.


More Great WIRED Stories