The Department of Justice charged two former Twitter employees for spying on users at the behest the Saudi Arabian government, according to charges unsealed Wednesday and the criminal complaint, obtained by CyberScoop.
Three individuals are charged in all, part of an alleged scheme that was carried out by the Saudi Arabian government that started in 2014. The employees accessed the personal information of Saudi dissidents, including email addresses, phone numbers, and IP addresses that could reveal user location.
According to the complaint, Ahmad Abouammo, who formerly was head of the company’s media partnerships in the Middle East and North Africa, met with a Saudi official in London in 2014. One week later, he began accessing the private information of a Twitter user who has been a prominent critic of the Saudi government.
Another former Twitter employee, Ali Alzabarah, is also alleged to have accessed sensitive information about Twitter users. According to the complaint, Alzabarah was charged with accessing the personal information of nearly 6,000 Twitter accounts.
The Washington Post reported that among the information Alzabarah allegedly accessed was account info belonging to Omar Abdulaziz, a dissident who worked closely with Post columnist Jamal Khashoggi.
Khashoggi was killed in 2018. The CIA has concluded its likely Saudi Crown Prince Mohammed bin Salman ordered Khashoggi to be killed.
A third individual charged by the DOJ, who was not employed by Twitter, was also charged with spying. Prosecutors allege this individual, a Saudi citizen, worked as a liaison between the Twitter employees and the Saudi government.
Abouammo, a U.S. citizen, has also been charged for falsifying an invoice last year in order to obstruct an FBI investigation. According to the Associated Press, Abouammo was ordered to remain in custody pending a detention hearing to be held on Friday.
The charges raise questions about whether Twitter — and possibly other social media companies — are equipped to protect user information from insider threats.
In a statement, a Twitter spokesperson said the company “limits access to sensitive account information to a limited group of trained and vetted employees.”
“We understand the incredible risks faced by many who use Twitter to share their perspectives with the world and to hold those in power accountable,” the spokesperson said. “We have tools in place to protect their privacy and their ability to do their vital work. We’re committed to protecting those who use our service to advocate for equality, individual freedoms, and human rights.”
Twitter’s confidentially agreement with the two employees barred them from disclosing proprietary information with external parties without written consent from Twitter. Twitter’s contracts with Abouammo and Alzabarah also forbade them from engaging in other employment that may conflict with Twitter’s business.
“We will not allow U.S. companies or U.S. technology to become tools of foreign repression in violation of U.S. law,” U.S. Attorney David L. Anderson said in a statement.