Twitter accused of helping Saudi Arabia commit human rights abuses

The social media company formerly known as Twitter has been accused in a revised civil US lawsuit of helping Saudi Arabia commit grave human rights abuses against its users, including by disclosing confidential user data at the request of Saudi authorities at a much higher rate than it has for the US, UK or Canada.

The lawsuit was brought last May against X, as Twitter is now known, by Areej al-Sadhan, the sister of a Saudi aid worker who was forcibly disappeared and then later sentenced to 20 years in jail.

It centers on the events surrounding the infiltration of the California company by three Saudi agents, two of whom were posing as Twitter employees in 2014 and 2015, which ultimately led to the arrest of al-Sadhan’s brother, Abdulrahman, and the exposure of the identity of thousands of anonymous Twitter users, some of whom were later reportedly detained and tortured as part of the government’s crackdown on dissent.

Lawyers for Al-Sadhan updated their claim last week to include new allegations about how Twitter, under the leadership of then chief executive Jack Dorsey, willfully ignored or had knowledge of the Saudi government’s campaign to ferret out critics but – because of financial considerations and efforts to keep close ties to the Saudi government, a top investor in the company – provided assistance to the kingdom.

The new lawsuit details how X had originally been seen seen as a critical vehicle for democratic movements during the Arab spring, and therefore became a source of concern for the Saudi government as early as 2013.

The new legal filing comes days after Human Rights Watch condemned a Saudi court for sentencing a man to death based solely on his Twitter and YouTube activity, which it called an “escalation” of the government’s crackdown on freedom of expression.

The convicted man, Muhammad al-Ghamdi, 54, is the brother of a Saudi scholar and government critic living in exile in the UK. Saudi court records examined by HRW showed that al-Ghamdi was accused of having two accounts, which had a total of 10 followers combined. Both accounts had fewer than 1,000 tweets combined, and contained retweets of well-known critics of the government.

The Saudi crackdown can be traced back to December 2014, as Ahmad Abouammo – who was later convicted in the US for secretly acting as a Saudi agent and lying to the FBI – began accessing and sending confidential user data to Saudi Arabian officials. In the new lawsuit, it is claimed that he sent a message to Saud al-Qahtani, a close aide to Mohammed bin Salman, via the social media company’s messaging system, saying “proactively and reactively we will delete evil, my brother”. It was a reference, the lawsuit claims, to the identification and harming of perceived Saudi dissidents who were using the platform. Al-Qahtani was later accused by the US of being a mastermind behind the murder of the journalist Jamal Khashoggi in 2018.

“Twitter was either aware of this message – brazenly sent on its own platform – or was deliberately ignorant to it,” the revised lawsuit states.

Twitter, now X, does not respond to questions from the press.

The Guardian contacted the company lawyer in the case, Ben Berkowitz of Keker, Van Nest & Peters, but did not receive a response. The Guardian also contacted Dorsey’s new company, Block, Inc, to request a comment from the former Twitter chief executive, but did not receive a response.

After Abouammo resigned in May 2015, he continued to contact Twitter to field requests he was receiving from Bader al-Asaker, a senior aide of Mohammed bin Salman, for the identity of confidential users. He made clear to the company, the lawsuit alleges, that the requests were on behalf of his “old partners in the Saudi government”.

The lawsuit also alleges that Twitter had “ample notice” of security risks to internal personal data, and that there was a threat of insiders illegally accessing it, based on public reporting at the time.

Twitter “did not simply ignore all these red flags … it was aware of the malign campaign”, the lawsuit claims.

On 28 September 2015, Twitter received a complaint from a Saudi user that their accounts had been compromised. But, the lawsuit alleges, the company did not act to bar one of the Saudis who was later accused – Ali Hamad Alzabarah – from having access to confidential user data, even though he had accessed the user’s account previously.

Saudi Arabian authorities, the lawsuit alleges, would formally follow up with Twitter once it received confidential user data from its agents working inside the company, by filing so-called EDRs – or emergency disclosure requests – in order to obtain documentation that confirmed a user’s identity, which it would then use in court. Often those EDRs were approved on the same day.

In May 2015, when two Twitter users tweeted about the kingdom in a way that al-Asaker found objectionable, Albabarah accessed the users’ data within hours. EDRs about the users were then sent, and automatically approved by Twitter, the lawsuit alleges.

Between July and December 2015, Twitter granted the kingdom information requests “significantly more often” than most other countries at that time, including Canada, the UK, Australia and Spain, the lawsuit alleges.

On 5 November 2015, just days before Twitter was confronted by the FBI about its concerns about a Saudi infiltration of the company, it promoted Alzabarah – now a fugitive living in Saudi. In response, Alzabarah sent his Saudi government contact, al-Asaker, a note, conveying his “unimaginable happiness” for the promotion. The note, the lawsuit claims, is evidence that Alzabarah believed al-Asaker had “arranged” or “been influential” in connection to the promotion.

Once Twitter was made aware of the FBI’s concerns, it put Alzabarah on leave and confiscated his laptop, but not his phone, which he has used extensively to contact his Saudi state contacts. Twitter, the lawsuit alleges, “had every reason to expect that Alzabarah would immediately flee to Saudi Arabia, which is exactly what he did”.

The US attorney’s office in San Francisco, which handled the case, did not respond to the Guardian’s request for comment on the company’s handling of the matter.

Twitter would later notify users who had been exposed, telling them their data “may” have been targeted, but did not provide more specific information about the scale or certainty that the breach had, in fact, occurred.

By “failing to give this crucial information, Twitter put thousands of Twitter users at risk”, the lawsuit alleges, claiming that some may have had time to escape the kingdom had they understood the risk. Even once Twitter was aware of the breach, it continued to meet and strategize with Saudi Arabia as one of its vital partners in the region. Dorsey met with bin Salman about six months after the company was made aware of the issue by the FBI, and the two discussed how to “train and qualify Saudi cadres”.

“We believe in Areej’s case and we will zealously prosecute it – but what she wants most is for Saudi Arabia to simply release her brother and let him re-join his family in the United States,” said Jim Walden, a lawyer representing Al-Sadhan from Walden Macht & Haran. “Were that to happen, she and Abdulrahman would gratefully resume their lives and leave justice in God’s hand.”