A jailed Saudi dissident's sister sues Twitter under the RICO Act, arguing its negligence let staff reveal his identity and thousands of others' to Saudi agents
Joseph Menn / Washington Post :
Context & Ripple Effects
The RICO suit is the legal sequel to a story Washington Post reporter Joseph Menn has tracked since 2019, when the DOJ charged two former Twitter employees with spying for Riyadh — one allegedly pulling data on roughly 6,000 accounts in 2015, many belonging to kingdom critics (DOJ espionage charges).
The company's handling of Saudi-linked accounts had already drawn scrutiny: in 2022 it let MBS aide Bader al-Asaker keep his verified 2.1M-follower account despite his alleged role in a plot to recruit employees (al-Asaker's retained verified account). The new filing reframes those incidents from security scandal into corporate liability, arguing negligence rather than conspiracy — a distinction that matters, because a separate case claiming X actively conspired with the Saudi government was later dismissed by a federal judge (the dismissed conspiracy case).
First-order effects
- Twitter/X now faces a civil suit that recasts its known insider-access failures — the 2019 DOJ prosecutions — as actionable RICO negligence, putting a dollar value on user-data exposure to foreign agents.
- The jailed dissident's family gains a US legal vehicle for harm that previously existed only as criminal charges against employees, not accountability claims against the platform.
Second-order effects
- Other large platforms must audit which employees can view dissidents', journalists', and activists' identities, because a single insider query is now demonstrably a life-safety and litigation event, not an HR matter.
- Saudi Arabia's recruitment of platform staff becomes more expensive and conspicuous, pushing intelligence gathering toward less visible channels than verified insiders at US companies.
Third-order effects
- If plaintiffs keep repurposing statutes like RICO for platform security failures, courts become the de facto regulator of employee data access wherever Congress and regulators have not legislated.
- The eventual split between this suit's negligence framing and the later-dismissed conspiracy theory will shape how much legal accountability platforms bear for state-directed abuse conducted through their own workforce.
The trend: Foreign governments exploiting platform insiders are colliding with a maturing litigation playbook that treats user-identity protection as enforceable corporate liability.