Twitter's Saudi Government Spy: Two Employees on State Payroll in Twitter's SF Office
Two Twitter employees were charged with acting as agents of the Saudi government, accessing the private data of Twitter accounts belonging to critics of the Saudi regime — including dissidents and journalists — and providing it to Saudi intelligence.
Background
The Saudi government had been actively suppressing criticism on social media following the murder of journalist Jamal Khashoggi in 2018. Two Twitter employees — Ahmad Abouammo and Ali Alzabarah — were allegedly recruited by Saudi intelligence to access internal Twitter data.
The Attack
Abouammo and Alzabarah used their privileged Twitter employee access to search for the private account information of Twitter users who were critics of the Saudi government, including their phone numbers and IP addresses, which could be used to identify their geographic location and real identity. The data was provided to Saudi Crown Prince Mohammed bin Salman's inner circle. Khaled al-Ibrahim, a Saudi national, acted as the Saudi government's contact. One of the targets had connections to Jamal Khashoggi.
Response
The FBI investigation led to charges against both employees filed in 2019. Abouammo was arrested in Seattle. Alzabarah had already fled to Saudi Arabia where he remains protected. The third suspect (al-Ibrahim) also remained in Saudi Arabia. Abouammo was convicted in 2022 on six counts.
Outcome
The case was the first time the US government charged Saudi Arabia with spying using US tech company employees. Abouammo was sentenced to 26 years in prison in 2022. The case prompted Congress to question social media platforms about foreign government infiltration of their workforces.
Key Takeaways
- Employee access to user private data (IP addresses, phone numbers) must be logged and monitored for anomalous access patterns
- Nation-states actively recruit employees at major technology platforms — background investigations and periodic re-screening matter
- Searching for accounts of specific real-world individuals from a privileged admin interface must trigger alerts
- Whistleblower protections for employees who report state-sponsored recruitment approaches are essential