7 ms·

Former Twitter employee convicted of charges related to spying for Saudis

126 points by davidclark22 4y ago

radicaldreamer 4y ago
Odd that the defendant used a federal public defender instead of a private attorney and the lack of a plea deal here (in exchange for cooperation?)
- tick_tock_tick 4y ago
  He fled the country probably had no reason plans of defending himself.
  - JumpCrisscross 4y ago
    > He fled the country We don’t convict in absentia. This is the one who got left behind.
- beachy 4y ago
  Perhaps it was explained to him that he better go down quietly or his loved ones might get bonesawed.
JumpCrisscross 4y ago
> Ali Alzabarah, another former Twitter employee who was also charged in the scheme, fled the country before he could be arrested Apparently “Alzabarah [is] believed to be in Saudi Arabia” [1]. What the fuck?! Sooner we can decouple from that regime the better in my book. [1] https://www.justice.gov/opa/pr/two-former-twitter-employees-and-saudi-national-charged-acting-illegal-agents-saudi-arabia https://www.justice.gov/opa/pr/two-former-twitter-employees-...
- bingohbangoh 4y ago
  how did they try him in absentia? I'm pretty certain that's illegal in the united states.
  - JumpCrisscross 4y ago
    > how did they try him in absentia? They didn’t. “Abouammo was arrested in Seattle, Washington, on Nov. 5, 2019, and made his initial federal court appearance in Seattle at 2:00 p.m.on Nov. 6, 2019” [1]. He is the one they left behind. [1] https://www.justice.gov/opa/pr/two-former-twitter-employees-and-saudi-national-charged-acting-illegal-agents-saudi-arabia https://www.justice.gov/opa/pr/two-former-twitter-employees-...
  - aYsY4dDQ2NrcNzA 4y ago
    What led you to believe that the United States can’t try defendants in absentia? https://www.ojp.gov/ncjrs/virtual-library/abstracts/trial-absentia https://www.ojp.gov/ncjrs/virtual-library/abstracts/trial-ab...
- radicaldreamer 4y ago
  Not happening until the oil runs out in the eastern desert and gulf.
- jen729w 4y ago
  There's a fascinating profile of the crown prince, 'MBS', in this week's Economist double summer edition. I have a print copy, paywalled link is: https://www.economist.com/1843/2022/07/28/mbs-despot-in-the-desert https://www.economist.com/1843/2022/07/28/mbs-despot-in-the-...
  - radiojasper 4y ago
    doesn't seem paywalled to me, but maybe there's a limit on the amount of articles that can be read. Anyway: https://archive.ph/JQFiG https://archive.ph/JQFiG
  - biztos 4y ago
    I find it super fascination that this guy, as a strategic partner, is at the same time: 1) Completely out of his f---ing mind! 2) Indisputably important and in control. 3) Remarkably easy to please. Now, sure, I could be wrong about any of these -- my sources of information are almost exclusively the US/EU press, which are not free of bias and might hold a globally minority definition of "truth." But when you consider what's at stake, and which other famous defenders of Human Rights we're in bed with, I honestly can't understand why we (US/EU) are not working more actively with the most transparent one.
- Syonyk 4y ago
  > What the fuck?! Sooner we can decouple from that regime the better in my book. "The Saudis, a despotic, murderous regime who... er, what's that? Gas prices are where? The Saudis, a heroic, brave people, living in a wonderful country with a deep culture of..." "Yeah, hey, buddy, pal, MBS-o, think you could maybe squeak out a couple more MBPD? Elections coming up and... oh... really? Few hundred thousand, tops? Well, I guess, see what you can do... thanks!" sigh :(
m4jor 4y ago
nullc 4y ago
I wonder how many people are murdered each year due to communications platforms that haven't implemented end to end encryption for private user communications, since all these large platforms are easily infiltrated by agents of homicidal regimes.
- radicaldreamer 4y ago
  Twitter or Facebook is one thing, but imagine the iCloud hacks (not the ones which exfiltrated porn, some apparently single actors using home connections) but those from nation states targeting individuals. I'm sure the death toll is large and the harassment tool even higher.
- sneak 4y ago
  Apple has access to the plaintext of pretty much every iMessage and the vast, vast majority of iOS users' photo libraries. They are required to turn over data to the US federal authorities without a warrant (under FAA702), and they do this over 30,000 times per year per their own transparency report. The mind reels. Can you imagine how much this is used for blackmail, extortion, coercion, parallel construction, etc?
  - zip1234 4y ago
    Is iMessage not end to end encrypted? Facebook Messenger has end to end encryption. How does Apple not?
    - sneak 4y ago
      iMessage's "end to end encryption" has a key escrow backdoor which sends your endpoint keys to Apple and is maintained for the FBI. It's more like "end-to-end-and-Apple encrypted". It's "end to end encrypted" but then the device's private iMessage syncing keys ("Messages in iCloud") are included in an iCloud Backup, which is not end-to-end encrypted, backdooring the crypto. This means that Apple can decrypt the iMessages as they transit Apple's servers in realtime, using the device private keys you backed up (without e2e) the previous evening. Even if you turn off the non-e2e iCloud Backup backdoor, your iMessages will still get compromised because it's on by default and all of the other people you iMessage with haven't turned it off. https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv... iCloud Photos isn't end to end encrypted at all. It syncs every photo you take to Apple servers effectively unencrypted. Apple can see all of them, and so can the US government (without a warrant). Turning off iCloud is indeed an effective mitigation for this, which keeps your photos on-device.
TaylorAlexander 4y ago
Someone I know had been working for twitter and they said they were blown away at the lack of internal protections built in to the system. I guess it could be a goldmine of data for spies.
- octoberfranklin 4y ago
  > it could be a goldmine of data for spies. Wait until you hear about cell site location data...
- secondcoming 4y ago
  And political activists
- nradov 4y ago
  Not to defend the incompetent jerks who run Twitter or anything, but only a complete idiot would have ever trusted them with private or damaging information (including metadata such as locations). Twitter never made any reliable, verifiable guarantees about security or internal controls.
  - TaylorAlexander 4y ago
    What I have found, as a technical person, is that things like metadata which are obvious to me may be unknown to most regular people. A person can be very smart and yet not know about how computers work, or how silicon valley works.
  - m00x 4y ago
    It's not a matter of Twitter giving guarantees about optional data. This is PII, which has to be protected legally. Internal controls at a company of the size of Twitter is no longer optional. You don't have to intend malice to be guilty of negligence. Equifax never gave guarantees of security and data safety either, but it's understood that they should be responsible.
    - nradov 4y ago
trhway 4y ago
Why would a high suit shmoozing media partnership manager have access to user info? Seems like an issue of data access at Twitter.
- josh2600 4y ago
  For a long time many social networks were just any employee god mode. Access controls are just not a priority while blitz scaling and then very difficult to patch on after the fact.
  - ChrisMarshallNY 4y ago
    > Access controls are just not a priority while blitz scaling and then very difficult to patch on after the fact. That's why the app that I'm writing now, started off as seriously tinfoil. In fact, I've had to [reluctantly] loosen some of the armor, in order to add a few features. I won't say that it's Fort Knox, but it ain't gonna be easy to crack. The demographics of its target user base are pretty paranoid, so I have to do my homework.
    - techdragon 4y ago
      Is there somewhere we can learn more about the app?
      - ChrisMarshallNY 4y ago
        I am not at liberty to disclose the app, itself, but it uses many of my open-source contributions. The backend is a modified version of my BAOBAB server[0], which was actually a "learning" project, for me, but it works quite nicely. This is the Security document[1] for the generic BAOBAB server. The customization was to add support for a specific workflow that is designed for the app, itself, and the customization is proprietary, as is the source for the iOS app. This is the dependency manifest of the iOS app: // MARK: - // MARK: - DO NOT TRANSLATE BELOW THIS LINE - // MARK: - "SLUG-VERSION-BMLT" = "BMLTiOSLib: 1.5.3"; "SLUG-VERSION-KEYCHAINSWIFT" = "KeychainSwift: 20.0.0"; "SLUG-VERSION-LGVCLEANTIME" = "LGV_Cleantime: 1.3.5"; "SLUG-VERSION-UICLEANTIME" = "LGV_UICleantime: 1.1.1"; "SLUG-VERSION-AUTOFILL" = "RVS_AutofillTextField: 1.3.0"; "SLUG-VERSION-GCD" = "RVS_BasicGCDTimer: 1.5.0"; "SLUG-VERSION-CHECKBOX" = "RVS_Checkbox: 1.2.1"; "SLUG-VERSION-OBSERVER" = "RVS_GeneralObserver 1.1.0"; "SLUG-VERSION-GST" = "RVS_Generic_Swift_Toolbox: 1.10.1"; "SLUG-VERSION-MB" = "RVS_MaskButton: 1.2.0"; "SLUG-VERSION-PP" = "RVS_Persistent_Prefs: 1.3.2"; "SLUG-VERSION-UKT" = "RVS_UIKit_Toolbox: 1.3.2"; "SLUG-VERSION-WHITEDRAGON" = "White Dragon SDK: 3.2.2"; It's from my Settings bundle localization file, so the syntax is strange. These are all open-source. I did not write KeychainSwift, but I wrote everything else (I have control issues. I don't like using code that other people wrote, unless it's really good, absolutely necessary, and is something I completely trust). They should be easy to find on GitHub. They are all SPM modules. The app, itself, is fairly large, at over 30 screens (it was a lot more, but I'm doing the "Thoreau" treatment -Simplify, simplify, simplify- to it). I have been working on it for over a year and a half. [0] https://riftvalleysoftware.com/work/open-source-projects/#baobab https://riftvalleysoftware.com/work/open-source-projects/#ba... [1] https://riftvalleysoftware.com/BAOBAB/PDFs/Security.pdf https://riftvalleysoftware.com/BAOBAB/PDFs/Security.pdf (Downloads a PDF).
323 4y ago
2020: How Saudi Arabia Infiltrated Twitter > When the conversation concluded, management seized Alzabarah’s laptop, put him on administrative leave, and escorted him out of the building. > At 5:17 p.m. he called a handler, identified as Associate-1 in the FBI complaint, who arrived in a white SUV two hours later. Driving around Alzabarah’s neighborhood, the two men called “Foreign Official-l” — al-Asaker, according to the Washington Post — at 7:20 p.m., and again at 7:22 p.m. and 7:31 p.m. They then called Dr. Faisal Al Sudairi, the Saudi consul general in Los Angeles, at 8:30 p.m., 8:38 p.m., and 9:26 p.m. Shortly after midnight, the consul general called Alzabarah back and spoke with him for three minutes. > Early the next morning, Alzabarah, his wife, and daughter boarded a plane for Saudi Arabia. https://www.buzzfeednews.com/article/alexkantrowitz/how-saudi-arabia-infiltrated-twitter https://www.buzzfeednews.com/article/alexkantrowitz/how-saud... Twitter basically let him walk out. Probably afraid of backlash in case they called the cops on him.
- deleted 4y ago
  [deleted]
- mrtksn 4y ago
  Will the cops really come and arrest people on the spot for breaching internal company data access protocols? I’m curious about it if the authorities act on it as an urgent situation.
  - 323 4y ago
    By cops I meant FBI/... And the way this is done is you notify the cops first and then coordinate with them if needed. It's not like Twitter learned about this 5 minutes before.
    - mrtksn 4y ago
      Okay, so does it really happen? To me it sounds like it’s a civil case where domain specialists need to prove the wrongdoing in court.
      - 4y ago
adolph 4y ago
The F.B.I. began monitoring the Twitter employees in 2014, according to the complaint. Investigators did not contact Twitter until the end of 2015, when they informed executives that the Saudi government was grooming employees to gain information about the company’s users. [...] During his employment at Twitter, Mr. Alzabarah had grown increasingly close to Saudi intelligence operatives, Western intelligence officials told executives. The operatives eventually persuaded Mr. Alzabarah to peer into the accounts of users they sought information on, including dissidents and activists who spoke against the crown, multiple people have told The Times. https://web.archive.org/web/20191107003511/https://www.nytimes.com/2019/11/06/technology/twitter-saudi-arabia-spies.html https://web.archive.org/web/20191107003511/https://www.nytim... Mr. Khashoggi’s online attackers were part of a broad effort dictated by Crown Prince Mohammed bin Salman and his close advisers to silence critics both inside Saudi Arabia and abroad. Hundreds of people work at a so-called troll farm in Riyadh to smother the voices of dissidents like Mr. Khashoggi. The vigorous push also appears to include the grooming — not previously reported — of a Saudi employee at Twitter whom Western intelligence officials suspected of spying on user accounts to help the Saudi leadership. https://web.archive.org/web/20191107062324/https://www.nytimes.com/2018/10/20/us/politics/saudi-image-campaign-twitter.html https://web.archive.org/web/20191107062324/https://www.nytim... Charges were for acting as foreign agent without notice and records falsification. https://web.archive.org/web/20200920010209/https://www.washingtonpost.com/context/read-the-criminal-complaint-involving-former-twitter-employees/1e7768f8-36fd-4c66-8de0-3f94489673d6/ https://web.archive.org/web/20200920010209/https://www.washi...

126 points by davidclark22 4y ago

Odd that the defendant used a federal public defender instead of a private attorney and the lack of a plea deal here (in exchange for cooperation?)

tick_tock_tick 4y ago
He fled the country probably had no reason plans of defending himself.
- JumpCrisscross 4y ago
  > He fled the country We don’t convict in absentia. This is the one who got left behind.
beachy 4y ago
Perhaps it was explained to him that he better go down quietly or his loved ones might get bonesawed.

JumpCrisscross 4y ago

> Ali Alzabarah, another former Twitter employee who was also charged in the scheme, fled the country before he could be arrested Apparently “Alzabarah [is] believed to be in Saudi Arabia” [1]. What the fuck?! Sooner we can decouple from that regime the better in my book. [1] https://www.justice.gov/opa/pr/two-former-twitter-employees-and-saudi-national-charged-acting-illegal-agents-saudi-arabia https://www.justice.gov/opa/pr/two-former-twitter-employees-...

bingohbangoh 4y ago
how did they try him in absentia? I'm pretty certain that's illegal in the united states.
- JumpCrisscross 4y ago
  > how did they try him in absentia? They didn’t. “Abouammo was arrested in Seattle, Washington, on Nov. 5, 2019, and made his initial federal court appearance in Seattle at 2:00 p.m.on Nov. 6, 2019” [1]. He is the one they left behind. [1] https://www.justice.gov/opa/pr/two-former-twitter-employees-and-saudi-national-charged-acting-illegal-agents-saudi-arabia https://www.justice.gov/opa/pr/two-former-twitter-employees-...
- aYsY4dDQ2NrcNzA 4y ago
  What led you to believe that the United States can’t try defendants in absentia? https://www.ojp.gov/ncjrs/virtual-library/abstracts/trial-absentia https://www.ojp.gov/ncjrs/virtual-library/abstracts/trial-ab...
radicaldreamer 4y ago
Not happening until the oil runs out in the eastern desert and gulf.
jen729w 4y ago
There's a fascinating profile of the crown prince, 'MBS', in this week's Economist double summer edition. I have a print copy, paywalled link is: https://www.economist.com/1843/2022/07/28/mbs-despot-in-the-desert https://www.economist.com/1843/2022/07/28/mbs-despot-in-the-...
- radiojasper 4y ago
  doesn't seem paywalled to me, but maybe there's a limit on the amount of articles that can be read. Anyway: https://archive.ph/JQFiG https://archive.ph/JQFiG
- biztos 4y ago
  I find it super fascination that this guy, as a strategic partner, is at the same time: 1) Completely out of his f---ing mind! 2) Indisputably important and in control. 3) Remarkably easy to please. Now, sure, I could be wrong about any of these -- my sources of information are almost exclusively the US/EU press, which are not free of bias and might hold a globally minority definition of "truth." But when you consider what's at stake, and which other famous defenders of Human Rights we're in bed with, I honestly can't understand why we (US/EU) are not working more actively with the most transparent one.
Syonyk 4y ago
> What the fuck?! Sooner we can decouple from that regime the better in my book. "The Saudis, a despotic, murderous regime who... er, what's that? Gas prices are where? The Saudis, a heroic, brave people, living in a wonderful country with a deep culture of..." "Yeah, hey, buddy, pal, MBS-o, think you could maybe squeak out a couple more MBPD? Elections coming up and... oh... really? Few hundred thousand, tops? Well, I guess, see what you can do... thanks!" sigh :(

m4jor 4y ago

nullc 4y ago

I wonder how many people are murdered each year due to communications platforms that haven't implemented end to end encryption for private user communications, since all these large platforms are easily infiltrated by agents of homicidal regimes.

radicaldreamer 4y ago
Twitter or Facebook is one thing, but imagine the iCloud hacks (not the ones which exfiltrated porn, some apparently single actors using home connections) but those from nation states targeting individuals. I'm sure the death toll is large and the harassment tool even higher.
sneak 4y ago
Apple has access to the plaintext of pretty much every iMessage and the vast, vast majority of iOS users' photo libraries. They are required to turn over data to the US federal authorities without a warrant (under FAA702), and they do this over 30,000 times per year per their own transparency report. The mind reels. Can you imagine how much this is used for blackmail, extortion, coercion, parallel construction, etc?
- zip1234 4y ago
  Is iMessage not end to end encrypted? Facebook Messenger has end to end encryption. How does Apple not?
  - sneak 4y ago
    iMessage's "end to end encryption" has a key escrow backdoor which sends your endpoint keys to Apple and is maintained for the FBI. It's more like "end-to-end-and-Apple encrypted". It's "end to end encrypted" but then the device's private iMessage syncing keys ("Messages in iCloud") are included in an iCloud Backup, which is not end-to-end encrypted, backdooring the crypto. This means that Apple can decrypt the iMessages as they transit Apple's servers in realtime, using the device private keys you backed up (without e2e) the previous evening. Even if you turn off the non-e2e iCloud Backup backdoor, your iMessages will still get compromised because it's on by default and all of the other people you iMessage with haven't turned it off. https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv... iCloud Photos isn't end to end encrypted at all. It syncs every photo you take to Apple servers effectively unencrypted. Apple can see all of them, and so can the US government (without a warrant). Turning off iCloud is indeed an effective mitigation for this, which keeps your photos on-device.

TaylorAlexander 4y ago

Someone I know had been working for twitter and they said they were blown away at the lack of internal protections built in to the system. I guess it could be a goldmine of data for spies.

octoberfranklin 4y ago
> it could be a goldmine of data for spies. Wait until you hear about cell site location data...
secondcoming 4y ago
And political activists
nradov 4y ago
Not to defend the incompetent jerks who run Twitter or anything, but only a complete idiot would have ever trusted them with private or damaging information (including metadata such as locations). Twitter never made any reliable, verifiable guarantees about security or internal controls.
- TaylorAlexander 4y ago
  What I have found, as a technical person, is that things like metadata which are obvious to me may be unknown to most regular people. A person can be very smart and yet not know about how computers work, or how silicon valley works.
- m00x 4y ago
  It's not a matter of Twitter giving guarantees about optional data. This is PII, which has to be protected legally. Internal controls at a company of the size of Twitter is no longer optional. You don't have to intend malice to be guilty of negligence. Equifax never gave guarantees of security and data safety either, but it's understood that they should be responsible.
  - nradov 4y ago

trhway 4y ago

Why would a high suit shmoozing media partnership manager have access to user info? Seems like an issue of data access at Twitter.

josh2600 4y ago
For a long time many social networks were just any employee god mode. Access controls are just not a priority while blitz scaling and then very difficult to patch on after the fact.
- ChrisMarshallNY 4y ago
  > Access controls are just not a priority while blitz scaling and then very difficult to patch on after the fact. That's why the app that I'm writing now, started off as seriously tinfoil. In fact, I've had to [reluctantly] loosen some of the armor, in order to add a few features. I won't say that it's Fort Knox, but it ain't gonna be easy to crack. The demographics of its target user base are pretty paranoid, so I have to do my homework.
  - techdragon 4y ago
    Is there somewhere we can learn more about the app?
    - ChrisMarshallNY 4y ago
      I am not at liberty to disclose the app, itself, but it uses many of my open-source contributions. The backend is a modified version of my BAOBAB server[0], which was actually a "learning" project, for me, but it works quite nicely. This is the Security document[1] for the generic BAOBAB server. The customization was to add support for a specific workflow that is designed for the app, itself, and the customization is proprietary, as is the source for the iOS app. This is the dependency manifest of the iOS app: // MARK: - // MARK: - DO NOT TRANSLATE BELOW THIS LINE - // MARK: - "SLUG-VERSION-BMLT" = "BMLTiOSLib: 1.5.3"; "SLUG-VERSION-KEYCHAINSWIFT" = "KeychainSwift: 20.0.0"; "SLUG-VERSION-LGVCLEANTIME" = "LGV_Cleantime: 1.3.5"; "SLUG-VERSION-UICLEANTIME" = "LGV_UICleantime: 1.1.1"; "SLUG-VERSION-AUTOFILL" = "RVS_AutofillTextField: 1.3.0"; "SLUG-VERSION-GCD" = "RVS_BasicGCDTimer: 1.5.0"; "SLUG-VERSION-CHECKBOX" = "RVS_Checkbox: 1.2.1"; "SLUG-VERSION-OBSERVER" = "RVS_GeneralObserver 1.1.0"; "SLUG-VERSION-GST" = "RVS_Generic_Swift_Toolbox: 1.10.1"; "SLUG-VERSION-MB" = "RVS_MaskButton: 1.2.0"; "SLUG-VERSION-PP" = "RVS_Persistent_Prefs: 1.3.2"; "SLUG-VERSION-UKT" = "RVS_UIKit_Toolbox: 1.3.2"; "SLUG-VERSION-WHITEDRAGON" = "White Dragon SDK: 3.2.2"; It's from my Settings bundle localization file, so the syntax is strange. These are all open-source. I did not write KeychainSwift, but I wrote everything else (I have control issues. I don't like using code that other people wrote, unless it's really good, absolutely necessary, and is something I completely trust). They should be easy to find on GitHub. They are all SPM modules. The app, itself, is fairly large, at over 30 screens (it was a lot more, but I'm doing the "Thoreau" treatment -Simplify, simplify, simplify- to it). I have been working on it for over a year and a half. [0] https://riftvalleysoftware.com/work/open-source-projects/#baobab https://riftvalleysoftware.com/work/open-source-projects/#ba... [1] https://riftvalleysoftware.com/BAOBAB/PDFs/Security.pdf https://riftvalleysoftware.com/BAOBAB/PDFs/Security.pdf (Downloads a PDF).

323 4y ago

2020: How Saudi Arabia Infiltrated Twitter > When the conversation concluded, management seized Alzabarah’s laptop, put him on administrative leave, and escorted him out of the building. > At 5:17 p.m. he called a handler, identified as Associate-1 in the FBI complaint, who arrived in a white SUV two hours later. Driving around Alzabarah’s neighborhood, the two men called “Foreign Official-l” — al-Asaker, according to the Washington Post — at 7:20 p.m., and again at 7:22 p.m. and 7:31 p.m. They then called Dr. Faisal Al Sudairi, the Saudi consul general in Los Angeles, at 8:30 p.m., 8:38 p.m., and 9:26 p.m. Shortly after midnight, the consul general called Alzabarah back and spoke with him for three minutes. > Early the next morning, Alzabarah, his wife, and daughter boarded a plane for Saudi Arabia. https://www.buzzfeednews.com/article/alexkantrowitz/how-saudi-arabia-infiltrated-twitter https://www.buzzfeednews.com/article/alexkantrowitz/how-saud... Twitter basically let him walk out. Probably afraid of backlash in case they called the cops on him.

deleted 4y ago
[deleted]
mrtksn 4y ago
Will the cops really come and arrest people on the spot for breaching internal company data access protocols? I’m curious about it if the authorities act on it as an urgent situation.
- 323 4y ago
  By cops I meant FBI/... And the way this is done is you notify the cops first and then coordinate with them if needed. It's not like Twitter learned about this 5 minutes before.
  - mrtksn 4y ago
    Okay, so does it really happen? To me it sounds like it’s a civil case where domain specialists need to prove the wrongdoing in court.
    - 4y ago

adolph 4y ago

The F.B.I. began monitoring the Twitter employees in 2014, according to the complaint. Investigators did not contact Twitter until the end of 2015, when they informed executives that the Saudi government was grooming employees to gain information about the company’s users. [...] During his employment at Twitter, Mr. Alzabarah had grown increasingly close to Saudi intelligence operatives, Western intelligence officials told executives. The operatives eventually persuaded Mr. Alzabarah to peer into the accounts of users they sought information on, including dissidents and activists who spoke against the crown, multiple people have told The Times. https://web.archive.org/web/20191107003511/https://www.nytimes.com/2019/11/06/technology/twitter-saudi-arabia-spies.html https://web.archive.org/web/20191107003511/https://www.nytim... Mr. Khashoggi’s online attackers were part of a broad effort dictated by Crown Prince Mohammed bin Salman and his close advisers to silence critics both inside Saudi Arabia and abroad. Hundreds of people work at a so-called troll farm in Riyadh to smother the voices of dissidents like Mr. Khashoggi. The vigorous push also appears to include the grooming — not previously reported — of a Saudi employee at Twitter whom Western intelligence officials suspected of spying on user accounts to help the Saudi leadership. https://web.archive.org/web/20191107062324/https://www.nytimes.com/2018/10/20/us/politics/saudi-image-campaign-twitter.html https://web.archive.org/web/20191107062324/https://www.nytim... Charges were for acting as foreign agent without notice and records falsification. https://web.archive.org/web/20200920010209/https://www.washingtonpost.com/context/read-the-criminal-complaint-involving-former-twitter-employees/1e7768f8-36fd-4c66-8de0-3f94489673d6/ https://web.archive.org/web/20200920010209/https://www.washi...