Being doxxed — having private information exposed, from your real name to your home address — on social media is scary enough. But for outspoken dissidents, having their details revealed to the authoritarian government they are criticizing can be deadly. And having it done by a worker at a social-media platform is a jaw-dropping betrayal.
But this week, a former Twitter employee was found guilty of spying for the Saudi government in 2015 — ferrying private user information to a contact with close ties to the nation’s government and its controversial crown prince, Mohammad bin Salman, aka MBS.
A San Francisco federal-court jury convicted Ahmad Abouammo, a dual Lebanese-US national, on six counts, including money laundering and conspiracy to commit wire fraud. He was found not guilty on five other counts.
Though it remains unclear what the Saudi government did with the information it obtained, “Hatching Twitter” author Nick Bilton told The Post that, while social media sites “are not vulnerable to being [directly] attacked by rogue nations,” they have vulnerabilities that can be exploited. Social media sites, he said, “are definitely vulnerable … [to] a single employee obtaining information that could easily be used to harm someone.”
Abouammo, formerly a media partnership manager at Twitter, is alleged to have focused on exposing identifying details and contact information of Twitter account holders who expressed criticism toward the Saudi government, MBS and the family of MBS. As alleged in court, he provided private email addresses and phone numbers — including for the person behind the user name @mujtahidd.
That handle (Miriam-Webster translates “mujtahid,” with one D, to mean an authoritative interpreter of the religious law of Islam) is said by Middle East Eye to be a Saudi whistleblower. The activist posts in Arabic to criticize his or her homeland’s government and ruling family for 2.6 million followers.
But obtaining personal details does not come cheaply.
Abouammo, 44, stands accused of accepting some $300,000 in cash and at least one Hublot wristwatch (reportedly valued at $42,000) from the Saudi government.
“They paid for a mole,” is how the situation was summed up by prosecutor Eric Cheng during his closing argument in the Golden State courtroom. After making the point that the illicit payments exceeded Abouammo’s annual salary by around three times, he added, “We all know that kind of money is not for nothing.”
Author Bilton is not surprised by any of this.
“At around the same time Abouammo was lying to FBI agents” — under questioning, he claimed that the watch was worth only $500 and that he received no more than $100,000 — “I wrote a story for Vanity Fair about spies from other countries, specifically rogue nations, who were coming to Silicon Valley to try to steal corporate secrets and spy on foreign nationals,” Bilton told The Post. “I remember sitting in the offices of a major tech company and an executive said, ‘Absolutely, there are spies working here. Who are they? I have no idea. But they are here.’”
Twitter and Abouammo’s attorney did not respond to requests for comment.
Abouamo’s odyssey allegedly began with a seemingly benign request. According to a criminal complaint filed by the Department of Justice, in April 2014, a public relations agency representing the Embassy of the Kingdom of Saudi Arabia reached out to Twitter and requested help in verifying the account of a Saudi news personality. The job fell to Abouammo, who had been tasked to work with Middle Eastern media partners.
It came out in court that he dealt with a man named Bader Binasaker, a highly placed advisor to MBS. The crown prince has tried to cultivate the image of being a modern royal. But US officials maintain that MBS likely ordered the murder of Washington Post columnist Jamal Khashoggi. MBS denies this.
Over the next several months, Abouammo and Binasaker established a relationship via emails and texts. In early December, Abouammo was in London, where he received a call from Binasaker who happened to be in Paris.
“I will come to London tomorrow for one day,” he is said to have explained. “When I arrive, I will call you.”
Binasaker arrived in London with a gift: The $42,000 Hublot, which has been used as evidence of what drew Abouammo to work on behalf of the Saudi government. As Cheng said in the courtroom, “The kingdom had now secured its Twitter insider.”
According to the Feds’ complaint, by December 12, 2014, Abouammo had provided the Saudis with email info for a Twitter user who is likely to have been @mujtahidd. The other, according to Buzzfeed, is a man who impersonated a member of the Saudi royal family. Court documents maintain that Abouammo formed an LLC through which a $100,000 cash transfer was sent from Saudi Arabia. By May 2015, Abouammo had delivered information on at least two Twitter users and quit the company. He moved to Seattle and continued receiving cash transfers from Saudi sources.
In defense of Abouammo, public defender Joseph Matthews claimed that his client was simply doing his job: Assisting Twitter’s VIP users. It was claimed in court that the employee did not know he was aiding the controlling Saudi government to get info on perceived enemies of the state. “Entirely legal” and “entirely proper” is how Matthews couched his client’s activities.
According to allegations from prosecutors, Abouammo also introduced Binasaker to Ali Alzabarah, then an engineer at Twitter.
Alzabarah, it is alleged in the complaint, was wooed and enlisted to work with the Saudis to provide details on various Twitter users. While it is not known how much he received for his services, it is alleged that Alzabarah provided information on some 6,000 Twitter users who were of interest to the Saudi government. That took place between May and November 2015.
As stated in the complaint, “Alzabarah began to access, without authorization, private data of Twitter users en masse.”
At an undisclosed point, a Twitter security engineer informed the FBI that Alzabarah had no legitimate reason to access information about all those accounts. As stated in the complaint, “Alzabarah’s job was to help keep the site up and running, which did not involve accessing individual user accounts.”
On December 2, 2015, according to the complaint, Twitter representatives confronted Alzabarah about his accessing of private information without prior authorization. One day later, according to the complaint, he, his wife and daughter boarded an early morning flight from San Francisco International Airport to Saudi Arabia.
While in transit, he submitted his resignation letter to Twitter.
Alzabarah remains at large and is on the FBI’s wanted list, as is the third participant, Ahmed Almutairi.
As Abouammo now awaits sentencing, the world is left to question whether or not anonymity is safe on social media. One takeaway from the government’s finding is that if the right people, with the right connections, want to out you, you’re outed whether you like it or not.
Additional reporting by Brad Hamilton
