Khashoggi’s friends, family targeted by Saudi, UAE using Israel spyware, data leak reveals

Saudi authorities targeted the phones of those close to journalist Jamal Khashoggi before and after his murder, a new investigation into the data leak of some 50,000 phone numbers selected for hacking using the notorious Israeli spyware developed by the NSO Group, has found.

Details of the attack on Khashoggi’s inner circle were uncovered following a ground-breaking investigation by the Pegasus Project, a collaboration by more than 80 journalists from 17 media organisations in ten countries. The group’s work was coordinated by Forbidden Stories, a Paris-based non-profit media organisation, and Amnesty International.

The latest findings from the Pegasus Project are based on the data leak of 50,000 phone numbers that are said to have been targeted by ten of the most authoritarian regimes in the world, including Saudi Arabia and the UAE.

Amongst the targets were some of the world’s top media companies including the Financial Times, the Wall Street Journal, CNN, the New York Times, Al Jazeera, France 24, Radio Free Europe, Mediapart, El País, Associated Press, Le Monde, Bloomberg, Agence France-Presse, the Economist, Reuters and Voice of America. Further details on who was targeted are expected to emerge over the coming days.

Forensic analysis of phones by the investigating group has uncovered new evidence that the Israeli firm’s spyware was used in an attempt to monitor people close to Khashoggi both before and after his death. One person is said to have been hacked just four days after Khashoggi’s murder.

It’s thought that Saudi Arabia and its close ally the UAE aimed to leverage NSO’s spy technology after Khashoggi’s death to monitor his associates and the Turkish murder investigation. Their ambitious hacking operation also involved infecting the phone of Istanbul’s chief prosecutor using Israeli technology for potential surveillance.

Once hacked by NSO’s spyware, Pegasus, the targeted phone can be transformed into a surveillance device that can activate microphones and cameras without the user’s knowledge as well as read all their messages, harvest their address book, monitor their movement, and listen in on calls.

The phone belonging to Khashoggi’s wife, Hanan Elatr, was on the list of 50,000 leaked numbers selected for possible surveillance by NSO clients. Inclusion in the list, however, doesn’t necessarily mean that a successful hacking operation had been carried out against the phone’s owner.

Elatr has spoken previously about being subjected to phone hacking. “Jamal warned me before that this might happen,” Elatr is reported saying. “It makes me believe they are aware of everything that happened to Jamal through me.” She added that she was concerned his conversations with fellow dissidents might have been monitored through her phone. “I kept my phone on the tea table [in their Virginia home] while Jamal was talking to a Saudi guy twice a week.”

READ: Israel cyber firm sells iPhone spyware to Saudi Arabia

The analysis carried out by the Pegasus Project indicates that Elatr’s phone was targeted by the UAE, a prominent Saudi ally.

The iPhone of his fiancee, Hatice Cengiz, was penetrated by spyware days after the murder, the forensics showed.

In the aftermath of Khashoggi’s murder, Saudi and its ally are said to have used NSO’s spyware to monitor the campaign for justice led by friends and associates of the journalist. The phone of a close friend, Wadah Khanfar, the former director-general of the Al Jazeera television network, was hacked as was Abdullah Khashoggi, the journalist’s son; Azzam Tamimi, a Palestinian-British activist, and friend, and Madawi Al-Rasheed, a London-based scholar who co-created an opposition party of expatriate Saudis in the wake of his murder. The names of several others were also among the leaked phone numbers.

Turkish officials that were on the list along with the country’s chief prosecutor, include Yasin Aktay, a friend of Khashoggi, and a top aide to the Turkish President, Recep Tayyip Erdogan. The investigative team did not carry out a forensic check on their phones to confirm if they had been infected by the Israeli spyware. Nonetheless, Aktay has indicated previously that his phone had been hacked following Khashoggi’s murder because the Saudis were trying to create a “map” of the journalist’s connections.