DOJ charges two ex-Twitter employees, arresting one, with spying for Saudi Arabia by snooping on kingdom critics; one allegedly accessed 6,000 accounts in 2015

The Justice Department has charged two former Twitter employees with spying for Saudi Arabia in a case that raises concerns …

Washington Post 2019-11-07

Context & Ripple Effects

This case did not come out of nowhere: a year earlier, reporting had described how Saudis groomed a Twitter employee to spy on dissidents before he was investigated and fired in late 2015 after Western intelligence warnings. The DOJ has now converted that intelligence concern into criminal charges against two former employees, arresting one, and alleges one of them accessed 6,000 accounts in a single year.

The stakes are unusual for an insider-abuse case because the alleged client is a foreign state and the victims are kingdom critics whose account data — real identities behind pseudonyms — is exactly what dissidents on Twitter most need protected. The arc that follows bears this out: the FBI's complaint detailed $300K+ in payments, prosecutors later expanded two charges into seven in a superseding indictment, and by 2022 a jury had found Ahmad Abouammo guilty after a trial that heard how outed dissidents likely faced torture.

First-order effects

Two former Twitter employees now face US criminal prosecution, with one in custody, and Twitter must answer for how an insider could query thousands of accounts — including critics of Riyadh — without tripping internal controls.
Saudi dissidents who used Twitter pseudonymity as protection learn their account data was allegedly sold, forcing an immediate reassessment of what safety the platform actually offers them.

Second-order effects

Twitter faces pressure to harden insider-access controls and disclose foreign-state misuse of user data, since the case makes clear its moderation and privacy tooling was exploitable by a paying state actor.
Other platforms with dissident user bases are pushed to audit employee access logs and tighten government-request handling, because the allegation sets a template any hostile service could copy: recruit, groom, pay.

Third-order effects

If the pattern holds — recruitment, payment, conviction — platform insiders become treated as a national-security attack surface, drawing counterintelligence scrutiny into routine trust-and-safety hiring and access management at US consumer tech firms.
The case also strengthens the argument that user-data abuse by states belongs in diplomatic and regulatory conversations, not just corporate security policy, with prosecutions like Abouammo's becoming the enforcement precedent.

The trend: State-directed espionage is migrating from hacking platforms' perimeters to buying their employees, making insider threats at consumer tech companies a counterintelligence problem rather than merely a security one.

Discussion

@olivia_beavers Olivia Beavers on x
WHOA: Two former Twitter employees have been charged by the DOJ with spying for Saudi Arabia by digging into critics of the royal family. One is accused of accessing personal info of more than 6,000 Twitter accounts in 2015 on behalf of Saudi Arabia. https://www.washingtonpost.co…
@gregbensinger Greg Bensinger on x
When interviewed by an FBI agent in his home in October 2018, Abouammo allegedly created a fake invoice for $100,00 using his personal computer in an adjoining room, and then emailed the undated document to the FBI
@alexstamos Alex Stamos on x
1) This is a huge deal. 2) Lots of tech employees have access to data and families back home. 3) All big tech companies need internal monitoring and hunting teams. 4) KSA wouldn't be at the top of my list of high-risk countries with lots of citizens in SV. There will be more. htt…
@lorenzofb Lorenzo Franceschi-Bicchierai on x
Judging from when it happened, this case is likely connected to this: https://motherboard.vice.com/ ...
@billbrowder Bill Browder on x
This is highly significant. Two Twitter employees were arrested by the DOJ for supplying private information to the ‘bone saw crew’ in the Saudi gov't about dissidents which put their lives in danger. The US should throw the book at these creeps. No mercy. https://www.washingtonp…
@yoda Drew Olanoff on x
I'm gonna bet this happens at so many companies at a clip we'll never be able to keep up with and it's terrifying. https://twitter.com/...
@natashafatah Natasha Fatah on x
#BREAKING Ahmad Abouammo, arrested, is a US citizen Ali Alzabarah, a Saudi National They allegedly accessed private information of thousands of accounts for the Saudis; were rewarded with tens of thousands of dollars funneled into secret bank accounts https://www.theguardian.com/…
@sunjeevbery Sunjeev Bery on x
1. The Saudi dictatorship reportedly infiltrated Twitter to get data on its critics. 2. The head of the Saudi dictator MBS's charity @MiskKSA @MiskGlobalForum was the point of contact for Saudi spies at @Twitter. 3. FYI: The @UN has partnered with Misk. https://www.washingtonpost…
@aliamjadrizvi Ali A. Rizvi on x
This just broke: https://www.nytimes.com/... Not saying it's related, but we've had several Saudi refugees and dissidents on our @SecularJihadist show. The account was suspended, appeal rejected, and then strangely restored just hours later. @ArminNavabi
@joelcrosenberg Joel C. Rosenberg on x
The Saudis have made dozens of big, important and positive economic and social reforms in recent years — but spying on private citizens by gaining access to their social media account information, if proven true, is illegal and completely unacceptable. https://twitter.com/...
@amy_siskind @amy_siskind on x
“A complaint unsealed in U.S. District Court in San Francisco detailed a coordinated effort by Saudi government officials to recruit employees at the social media giant to look up the private data of thousands of Twitter accounts.” https://apnews.com/...
@mikko @mikko on x
One of the toughest security problems for the big tech companies is having moles of foreign intelligence agencies planted to work in your organization. https://twitter.com/...
@defenceireland Defence Ireland on x
Twitter's Europe, Middle East, and Africa HQ is in Dublin. Ireland is a critical node in the global network for information and cyber dominance. Our state will be contested space for powerful actors in the future of warfare, and it's entirely undefended. https://twitter.com/...
@mollymckew Molly McKew on x
Many things about this story should trouble you — but overall it should remind you that social media is the greatest intelligence collection tool there is. https://www.cnn.com/...
@adamsteinbaugh Adam Steinbaugh on x
cc: people who think social media companies should require users to provide their real identities https://twitter.com/...
@emilygorcenski Generic Soy Milk on x
I just gave a talk at @oredev about how our platforms are killing people and perhaps I added a layer of indirection that I needn't have https://twitter.com/...
@iyad_elbaghdadi @iyad_elbaghdadi on x
Since Jamal Khashoggi's murder. my team's work was mostly focused on Jamal's vision, which was to reclaim the Arab public sphere. It just happens that the Arab public sphere was... Twitter. Here's a quick thread: https://twitter.com/...
@vpkivimaki Veli-Pekka Kivimki on x
Counterintelligence 2.0... when the insider threat is in an external company that has your digital life in its servers. https://twitter.com/...
@profcarroll David Carroll on x
We had heard there were moles inside Twitter for KSA. Two former employees have now been charged. The trust crisis in big tech gets worse by the day. https://www.nytimes.com/...
@mastodonproject Mastodon on mastodon
We won't spy on you for the Saudi royal family, that's the Mastodon guarantee™️ https://twitter.com/...
@alexstamos Alex Stamos on x
Something I've said to security audiences: “We are all pretty good at technical infosec defense; the big tech companies are at least in the same league as state attackers. We are children when it comes to human intelligence.”
@jtregunna Jeremy Tregunna on x
Periodic reminder that all it takes is to compromise a single individual, or a small handfull of people within an organization to undermine the safety and security of their users. https://twitter.com/...
@caseynewton Casey Newton on x
Not clear in this story: - What were these guys' job titles? - Did an employee accessing 6,000 Twitter accounts set off any internal alarms? https://twitter.com/...

Chronicles