Guardian Told It Was Target of Saudi Hacking Unit after Khashoggi Killing

By Staff, The Guardian

The report from Agnes Callamard, the UN special rapporteur, sets out in forensic detail concerns about the behavior of Saudi Arabia, both before and after the murder of the dissident journalist Jamal Khashoggi.

It also details the potential threats posed to journalists and academics by the kingdom’s use of intrusive spyware.

This is a threat the Guardian has had to assess with some seriousness in recent months.

Earlier this year, the Guardian was warned it was being targeted by a cybersecurity unit in Saudi Arabia that had been ordered to “hack” into the email accounts of journalists investigating the various crises engulfing the royal court.

The potential threat was initially raised by a source in Riyadh – and this account was later supported by a copy of what appears to be a confidential internal order. This instructed a technical team to carry out the “penetration” of the Guardian’s computer servers “in complete secrecy”.

The document was signed in the name of Saud al-Qahtani, an aide and confidant of the crown prince, Mohammed bin Salman. Qahtani has been accused of overseeing the operation to murder Khashoggi.

In the weeks since then, the Guardian has repeatedly asked the Saudi authorities to comment about the alleged threat to it – and to provide an on-the-record statement giving unequivocal assurance that any operation of this kind has been halted. They have so far declined to do so.

Instead, Saudi diplomats have acknowledged the seriousness of the allegations, but raised questions about the authenticity of the document.

They demanded the Guardian share the document so they could “investigate this matter more fully”.

Though experts say it is not unusual for authoritarian regimes such as Saudi Arabia to use “hacking” tactics against journalists and writers, the kingdom is under pressure.

It is only eight months since a Saudi hit-squad murdered Khashoggi, a Washington Post columnist, in a plot widely believed to have been overseen by Qahtani.

It is his name on the single-page memo which indicates the Guardian may have become a target for a Saudi-based cybersecurity team understood to be run from the private office of the crown prince.

The Guardian first became aware of a potential threat following the publication in March of a story that described strains between King Salman bin Abdulaziz Al Saud and his young and controversial heir.

The article provoked debate across the Middle East, fueling speculation the king was trying to play a more central role to help guide the kingdom through a turbulent period caused in part by the missteps of his son, or those around him.

Guardian reporters were urged to “take all necessary precautions” because elements within the royal court were attempting to identify individuals who may have spoken out. The Guardian was told it should alert relevant authorities in the UK and the US.

“You need to protect yourselves,” the source said.

Later, the Guardian received a copy of a document written in Arabic which appeared to support the initial claims.

The Guardian has not been able to independently verify the authenticity of the memo, though all the details of the document were provided to the Saudi authorities.

Dated 7 March 2019, the memo is addressed to the “heads of technological and technical departments” of what is called the cybersecurity directorate within the private office of the crown prince.

The memo refers to the “sensitive information” contained in the Guardian story and the requirement to track down its sources.

The memo states: “Based on what was published in the British newspaper, the Guardian, in its issue published on 28/6/1440 AH [March 6, 2019], and which includes sensitive information on the relationship between the custodian of the two holy mosques and his highness the crown prince, may God keep them, and due to what this constitutes in terms of grave security threats and what we knew in advance of the existence of some moves against the position of his highness the crown prince.

“We have conducted a preliminary tracking of the newspaper’s leaks, and have determined that they have two primary communication points in London, UK, and Washington, US. It appears to us that there is a strong relationship between the individuals mentioned below and the source [or sources] of the leaks.

“Based on this, carry out the penetration of the servers of the Guardian newspaper and those who worked on the report that was published, and deal with the issue with complete secrecy, then send us all the data as soon as possible.”

The memo specifically names two Guardian journalists: Nick Hopkins, a UK citizen, and Stephanie Kirchgaessner, a US citizen. Their names appear to be the subject of two attachments also referred to in the document.

Though he was supposed to have been sidelined by the crown prince after the furor over Khashoggi’s murder, sources inside and outside the kingdom have told the Guardian that Qahtani is still in the fold.

Last November the US Treasury placed Qahtani on a sanctions list, saying he was “part of the planning and execution of the operation that led to the killing of Mr. Khashoggi”. The Treasury claimed Qahtani was one of the Saudi officials involved in “the abhorrent killing” of the journalist in a targeted and brutal operation.

The US state department has included Qahtani on a list of 16 individuals barred from entering the US because of their alleged role in the killing.

The notice was issued, the state department said, because it “has credible information that officials of foreign governments have been involved in significant corruption or gross violations of human rights”.

The Guardian provided the Saudi embassies in London and Washington with all the relevant details from the document – including the date it was signed and its reference number.