Al Jazeera journalist files lawsuit accusing Saudi, UAE crown princes of hack-and-leak

An Al Jazeera anchor is alleging the crown princes of Saudi Arabia and the United Arab Emirates helped to coordinate a hack-and-leak operation intended to intimidate and disparage her.

In a civil suit filed Wednesday in the U.S. District Court for the Southern District of Florida, journalist Ghada Oueiss accuses Saudi Crown Prince Mohammed bin Salman (MBS) and UAE Crown Prince Mohammed bin Zayed (MBZ) of coordinating efforts to break into her iPhone and then share private photos on Twitter and various websites.

The lawsuit says the operation is connected to larger efforts by rulers in Saudi Arabia and the UAE to stifle reports about the two regimes’ alleged human rights abuses. Oueiss has been critical of both nations’ leaders as part of her work as a principal anchor and presenter for Al Jazeera, a news agency based in the nearby Persian Gulf state of Qatar, which has strained ties with Saudi Arabia and the UAE.

Oueiss and her lawyers say the scheme centered on disseminating manipulated financial documents and photos of the journalist meant to “sully her reputation” and spread “disinformation.” The suit also alleges Oueiss has faced a series of escalating threats to her life.

Oueiss and her lawyers from the Miami-based firm of Marcus Neiman Rashbaum & Pineiro LLP name 19 defendants in total, including DarkMatter, a UAE cybersecurity firm.

Oueiss and her lawyers are seeking an injunction to bar the defendants from further harassment and an award of punitive and monetary damages to be determined at trial. The lawsuit claims defendants are subject to U.S. jurisdiction because MBS and MBZ allegedly recruited a network of U.S. citizens to help spread the doctored photos online. Some of the defendants also live in Florida, according to the lawsuit.

It’s the latest lawsuit filed in the last several years that shows journalists and dissidents allegedly ensnarled in nation-state cyber-operations meant to intimidate or silence them.

Oueiss has previously detailed the alleged hack-and-leak operation in an op-ed published in The Washington Post earlier this year, in which she details some of the harassment.

“Although I was the target of this latest assault — no doubt because I regularly present critical reporting about Saudi Arabia and the UAE — the message to journalists across the Middle East is very clear: Don’t criticize the crown princes,” Oueiss wrote.

The lawsuit alleges Oueiss, who regularly reports on human rights issues, is the target of the intimidation operation because the group was tasked to “spread pro-Saudi and pro-UAE propaganda and ruthlessly attack anyone who dares to report on these regimes’ human rights abuses.” Oueiss, who also reported on the murder of American journalist Jamal Khashoggi, alleges the group behind her harassment is the same one involved in his killing. The CIA has assessed Khashoggi’s murder was likely ordered by MBS.

The Saudi Arabian and UAE embassies in the U.S. did not immediately return request for comment.

Looming disputes

The lawsuit alleges DarkMatter, which is reportedly part of the UAE’s offensive cyber-operations program, was tasked alongside another defendant with hacking into Oueiss’ iPhone XS. The lawsuit claims a series of suspicious events then occurred on her phone: She allegedly received a suspicious WhatsApp message that created a “kernel panic” on her phone, meaning it basically crashed, followed by “unexplained data egress,” suggesting abnormal amounts of data were leaving the device.

The UAE has reportedly previously targeted journalists and dissidents as part of a cyber-operation known as Project Raven, according to Reuters. Amnesty International has previously accused the UAE of using powerful spyware developed by NSO Group, an Israeli surveillance software company. Security researchers at Canada-based Citizen Lab have alleged the government of UAE has “likely” used spyware linked to NSO Group that is capable of running surveillance of targets’ texts, location, and other sensitive information.

Human rights advocates and security experts have accused NSO Group of selling its products to human rights abusers and governments around the world. NSO Group has claimed its products can only be used for legitimate law enforcement or intelligence reasons.

Oueiss’ case is also not the first time Saudi Arabia has been accused of using cyber-operations to silence or intimidate dissidents or journalists — NSO Group products are also alleged to have targeted Khashoggi and associates in the days before his murder, as well as Amazon founder and Washington Post owner Jeff Bezos.

But other efforts to limit commercial spyware’s availability and efforts to hold governments accused of hacking vulnerable targets in years past have had little success.

Facebook’s allegations that NSO Group used Facebook-owned WhatsApp to enable surveillance against thousands of users, including activists and journalists, are currently tied up in court.

Amnesty International earlier this year pushed an Israeli court to consider revoking NSO Group’s export license. A judge quashed those efforts in July, citing lack of evidence against the company.

Globally, curtailing these kinds of alleged abuses has been fraught, according to David Kaye, the former United Nations Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression.

“Governments have been extremely slow, and quite reluctant, to do anything meaningful to restrain these kinds of awful abuses,” says Kaye, who has been tracking spyware cases for years. “And those abuses are proliferating worldwide, without constraint by exporters or by end-users. It is really a lawless world for the private surveillance market.”

But where efforts to hold NSO Group and Saudi officials alleged to be responsible for Khashoggi’s murder have not gone far, Oueiss’ lawsuit could offer another path to penalizing Saudi Arabia and other governments that seek to use targeted cyber-operations against journalists and dissidents.

“This case is about much more than just Ghada Oueiss,” said Dan Rashbaum, the MNR partner leading Oueiss’ case. “By bringing this lawsuit, Ms. Oueiss is standing up for all journalists who are attacked for speaking truth to power and fighting for human rights.”

There are no deadlines or hearings set for Oueiss’ case yet, according to court records.