The Kingdom’s Hackers and Bots

In June of this year, Saudi dissident Omar Abdulaziz, who lives in exile in Canada, received a text message purporting to be from the courier company DHL. A package he had ordered would be delivered in a few days, it said. If he wished to track the delivery he could tap a link.

Abdulaziz didn’t think much about the message, but a research group determined later that clicking the link would have installed a powerful Israeli-made surveillance tool that would have allowed its operator to listen in on Abdulaziz’s phone calls, read his text messages, and turn on the phone’s camera and microphone.

In a report earlier this month, the group, Toronto-based Citizen Lab, concluded “with high confidence” that Abdulaziz’s phone had been infected with the surveillance tool. It pointed to Saudi Arabia as the likely culprit.

Abdulaziz is a pro-democracy activist with a large Twitter following. He collaborated with Saudi journalist Jamal Khashoggi on a range of projects until earlier this month, when Khashoggi disappeared into the Saudi consulate in Istanbul—apparently killed by Saudi officials.

Following Khashoggi’s disappearance—Saudi officials confirmed on Friday that he was killed in the consulate but said his death stemmed from a fight—the bugging operation against Abdulaziz has taken on new significance. It highlights the way Saudi Arabia is using high-tech tools to silence dissidents far from its shores—and stifle dissent.

According to experts who study Riyadh’s use of digital surveillance and propaganda, Saudi Arabia has deployed both spyware against critics of the regime and Twitter bots as part of its effort to maintain its grip on power, monitor dissident voices, and control its domestic public sphere.

One of the Saudis apparently knowledgeable in the use of surveillance software, Maher Abdulaziz Mutreb, has been described as an official close to Crown Prince Mohammed bin Salman. Mutreb also appears to have played a role in Khashoggi’s death, according to evidence compiled by Turkish authorities. He was spotted entering the Saudi consulate in Istanbul shortly before Khashoggi. According to emails published by WikiLeaks in 2015, Mutreb and other Saudi officials were due to receive training in the use of spyware similar to what the Israeli firm NSO markets from the Italian company Hacking Team.

Abdulaziz appeared on Riyadh’s radar during the Arab Spring uprisings. He created a YouTube show that satirized Saudi Arabia’s leadership. And with the benefit of hindsight, Abdulaziz said it is obvious to him he was being spied on. Earlier this year, he said, Saudi officials traveled to Montreal and tried to persuade him to return to his home country, offering money and employment. When Abdulaziz refused, authorities in Saudi Arabia detained his brother repeatedly.

“He was telling me, ‘Please, stop what you are doing! Please shut down your activities! They know everything about you!’” Abdulaziz said in an interview, referring to his conversation with his brother.

The surveillance of Abdulaziz was first revealed on Oct. 1 by Citizen Lab, a collective of hackers and academics housed at the University of Toronto that exposes state-backed digital espionage campaigns. The spyware that likely infected Abdulaziz’s phone was made by NSO and is dubbed Pegasus. Though it is impossible to determine conclusively that Saudi authorities were behind the campaign, the evidence points to Riyadh.

As sophisticated spyware has proliferated around the globe, Saudi Arabia has emerged as one of its biggest users. Among other known cases, Saudi Arabia is believed to have used NSO software to target a Saudi dissident living in London and an Amnesty International staffer.  

Bill Marczak, a senior research fellow at Citizen Lab, said Saudi Arabia has deployed Pegasus in a large number of countries, including Bahrain, Canada, Egypt, France, Iraq, Jordan, Lebanon, Morocco, Qatar, Saudi Arabia, Turkey, and the United Kingdom.

“It is possible that the Saudis were using it pretty recklessly,” he said.

Riyadh has also deployed a sizable bot army to control the online narrative and drown out criticism of the regime.

Its bots have ensured that Arabic pro-regime hashtags—such as #UnfollowEnemiesOfTheNation, #MessageOfLoveForMohammedBinSalman, and #CampaignToCloseDownTheChannelOfDiscord, a reference to television network Al Jazeera—dominate the Saudi trending lists, according to Marc Owen Jones, a lecturer at University of Exeter who studies Middle Eastern propaganda.

On Thursday, Twitter took down a bot network that was promoting pro-Saudi talking points.

According to data collected by Jones, some 70 to 80 percent of Arabic-language tweets containing the word “Saudi” in the past four months were posted by bots.

Bot activity is often accompanied by harassment, and Saudi activists working online frequently find themselves under attack by pro-regime accounts.

This flood of messages makes it difficult for dissident voices to break through. “There are so many people who are sick of Twitter in the Middle East and the Gulf, because it has become a bit of a wasteland,” Jones said. “Not just because security services are on it, but because it’s so much spam, so many bots.”

Saudi activists have dubbed these bot accounts “the fly army.” Before Khashoggi’s death, he and Abdulaziz discussed creating a counterpoint to the regime’s propaganda machine—a network of pro-democracy activists who would post and amplify one another’s messages about Saudi political issues.

“We are going to talk about the dissidents, the political prisoners, freedom of speech, human rights. We are going to make people aware of what’s really happening,” Abdulaziz said.

He and Khashoggi had a name for the nascent force—the bee army.