The Saudi crown prince reportedly hacked Jeff Bezos

It’s been a while, but remember that allegation that the Saudi government may have hacked Amazon CEO Jeff Bezos?

A report Tuesday in the Guardian claims it wasn’t just any Saudi government hacker — it might have been Crown Prince Mohammed bin Salman (MBS) himself.

And on Wednesday, United Nations investigators who had been examining the death of Jamal Khashoggi backed up that allegation.

“The information we have received suggests the possible involvement of the Crown Prince in surveillance of Mr. Bezos, in an effort to influence, if not silence, The Washington Post’s reporting on Saudi Arabia,” UN investigators Agnes Callamard and David Kaye said in a statement.

The investigators said they were made aware of the forensic analysis of Bezos’s phone in the course of their investigation into the Saudi government. Motherboard obtained a copy of the analysis, completed by FTI Consulting in November 2019.

“The allegations reinforce other reporting pointing to a pattern of targeted surveillance of perceived opponents and those of broader strategic importance to the Saudi authorities, including nationals and non-nationals,” the statement continued.

The UN investigators released a timeline that alleges MBS personally sent Bezos an encrypted video file on May 1, 2018, via a WhatsApp message. “It is later established, with reasonable certainty, that the video’s downloader infects Mr. Bezos’ phone with malicious code,” according to the United Nations.

The Guardian also reported that a technical analysis found it was “highly probable” that the file contained malware that penetrated Bezos’s mobile phone and “exfiltrated a large amount of data within hours.”

According to the FTI Consulting report obtained by Motherboard, analysts were unable to find malware, but found the encrypted video “suspicious” because within hours of it being received, “a massive and unauthorized exfiltration of data from Bezos’ phone began, continuing and escalating for months thereafter.”

It’s still not totally clear what information was taken from Bezos’s phone during the hack, or how it may have been used.

But last February, Bezos accused American Media Inc. (AMI), the parent company of the National Enquirer, of trying to extort Bezos after the publication approached him saying it had text messages and photos that revealed Bezos was having an affair.

AMI repeatedly said its tipster was Michael Sanchez, the brother of the woman Bezos was allegedly having an affair with. (AMI’s CEO, David Pecker, is close to President Trump, and AMI was involved in the saga of hush money payments to two women who said they had affairs with Trump.)

Bezos’s security chief, Gavin de Becker, first said in March 2019 that he had evidence the Saudis had gained access to Bezos’s phone and private information. As de Becker wrote in the Daily Beast:

Our investigators and several experts concluded with high confidence that the Saudis had access to Bezos’ phone, and gained private information. As of today, it is unclear to what degree, if any, AMI was aware of the details.

De Becker hired FTI to complete the analysis, according to the report. This report, along with the UN’s announcement, offers compelling evidence that a foreign government hacked a US citizen, Bezos.

And not just any citizen, but the owner of the Washington Post, the publication that employed columnist Jamal Khashoggi. Khashoggi was murdered in Turkey in 2018, a hit the CIA believes MBS himself ordered.

The United Nations also painted the alleged hacking of Bezos as part of a broader campaign by Saudi Arabia to target opponents or critics of the regime, both by targeting personal data and through disinformation warfare on social media.

The UN called for further investigation, saying that the “hacking and surveillance of Bezos strengthen the support” for inquiry by the US and others.

“At a time when Saudi Arabia was supposedly investigating the killing of Mr. Khashoggi, and prosecuting those it deemed responsible, it was clandestinely waging a massive online campaign against Mr. Bezos and Amazon targeting him principally as the owner of The Washington Post,” the UN investigators wrote.

The Saudi government has denied the allegations, calling them “absurd” and demanding further investigation.

It’s probably not the investigation the United Nations had in mind. Callamard, a UN special rapporteur, had already completed a six-month investigation that found “credible evidence” that high-level Saudi officials — including MBS — oversaw and carried out Khashoggi’s murder.

The UN’s statement on Bezos is trying to show that the Saudi government also waged an effort to silence or smear those who kept calling out the Kingdom’s misdeeds, including the Amazon CEO for this ownership of the Post.

The hack also raises even more questions about MBS’s personal relationships, including with Trump adviser and son-in-law Jared Kushner. Kushner reportedly communicates with foreign leaders through WhatsApp, including with MBS — something that cybersecurity experts say also makes him vulnerable to hacking.

In January 2019, Bezos announced that he and his wife were seeking a divorce. Just a few hours later, the National Enquirer claimed it had completed a four-month investigation into an extramarital affair between Bezos and Laura Sanchez, a former anchor for a Fox affiliate in Los Angeles.

As Vox’s Anna North reported at the time, soon after the initial story of the affair, “the National Enquirer released what it said were ‘sleazy text messages’ sent by Bezos to Sanchez, and claimed to have seen ‘a cache of lewd selfies’ sent by the Amazon CEO as well.”

Bezos has become a regular punching bag for President Donald Trump, who dislikes the Washington Post — and, by extension, its owner — for what he sees as coverage critical of his presidency.

Pecker, the CEO of AMI, is a longtime friend of Trump’s. In August 2016, the National Enquirer arranged what’s called a “catch and kill” deal with former Playboy model Karen McDougal, who alleges she had an affair with Trump in 2006 and 2007.

Federal prosecutors also revealed in charging documents that AMI was involved in the illegal hush money payment to porn actress Stormy Daniels. Both of these payments were designed to protect Trump and influence the 2016 election. In December 2018, AMI agreed to cooperate with prosecutors in that federal investigation to avoid prosecution.

Now back to Bezos: In February 2019, Bezos wrote a lengthy post on Medium accusing AMI of trying to extort him. Bezos said he’d hired investigators (including de Becker) to look into how his private messages had been obtained. In his post, he claimed that once AMI learned of Bezos’s investigation, it contacted him claiming it had even more text messages and photographs of Bezos and threatening to publish them unless Bezos halted the investigation.

Bezos published the exchanges, which included some interesting demands from AMI, including that Bezos publicly acknowledge that he had “no knowledge or basis for suggesting that AMI’s coverage was politically motivated or influenced by political forces, and an agreement that they will cease referring to such a possibility.”

AMI also said in its correspondence with Bezos that it “affirms that it undertook no electronic eavesdropping in connection with its reporting and has no knowledge of such conduct.”

Bezos dismissed what he called “blackmail.” Meanwhile, de Becker continued with his investigation. In March 2019, he made the explosive claim that the Saudi government had gained access to Bezos’s phone.

AMI denied that it had received any information from the Saudis, calling the allegations “unsubstantiated,” and said the materials were acquired from a single source, Michael Sanchez. “There was no involvement by a third party whatsoever,” the AMI statement read.

But AMI has a connection with the Saudi government. As North explained last year:

Pecker’s relationship with Trump continued after the latter took office, according to [the New Yorker’s Ronan] Farrow. AMI employees told the reporter that Trump associates had introduced Pecker to potential funding sources for the company. In 2017, Pecker had dinner at the White House with “a French businessman known for brokering deals with Saudi Arabia,” Farrow writes. Two months later, the businessman and Pecker met with the Saudi crown prince, Mohammed bin Salman, also known as MBS.

In 2018, AMI published a nearly 100-page, ad-free magazine full of articles, many of them unbylined, praising MBS, as Spencer Ackerman reported at the Daily Beast. The magazine called MBS “our closest Middle East ally destroying terrorism” and included coverage of “New Rights for Saudi Women.” AMI said it had no outside help publishing the magazine and compared it to special issues on “The Royals, Elvis, The Kennedys, The Olympics, etc.” (all subjects better known to Americans than MBS, Ackerman notes).

AMI published the favorable coverage of MBS in the spring of 2018 when the crown prince was embarking on a goodwill press tour across the US, an attempt to recast him as a modernist reformer. Bezos met with MBS during his US visit.

According to the UN’s timeline, Bezos attended “a small dinner” with the crown prince in Los Angeles in March 2018, and again in April 2018. At the April dinner, the UN says, the two exchanged numbers “that correspond to their WhatsApp accounts.”

And, so they did:

MBS allegedly sent the file, which contained malware, to Bezos on May 1, 2018. During this time, the UN says the Saudi government also targeted Saudi critics and dissidents with spyware, including some in contact with Saudi dissident and journalist Jamal Khashoggi.

All of this led up to another major event in the fall of 2018: the brutal killing of Khashoggi. Khashoggi, who worked for the Post as a columnist, vanished in October, but soon a gruesome assassination plot was revealed. Intelligence agencies, including the CIA, linked Khashoggi’s death to MBS. The Post led coverage on the murder of its columnist, which was invariably bad coverage for MBS.

The UN’s timeline includes a rather startling detail: MBS personally texted Bezos another WhatsApp message in November 2018, about a month after Khashoggi’s killing. The message appeared to be a reference to Bezos’s alleged affair, months before it was made public in January 2019. Here’s the UN investigators:

A single photograph is texted to Mr. Bezos from the Crown Prince’s WhatsApp account, along with a sardonic caption. It is an image of a woman resembling the woman with whom Bezos is having an affair, months before the Bezos affair was known publicly

That certainly hints that the Saudi government may have some private information about Bezos, months before the affair was made public.

There are still many unanswered questions. But the allegation that a message from MBS himself might have led to a hack is troubling. A foreign leader targeting a private US citizen, if true, would be explosive. And as the UN report tries to lay out, this appears to fit with “a continuous, multi-year, direct and personal involvement of the Crown Prince in efforts to target perceived opponents.”

The Trump administration has developed a close relationship with the Saudi government, and has largely avoided holding Riyadh accountable for its misdeeds, including the killing of Khashoggi.

What’s more, MBS and Jared Kushner — the president’s son-in-law and top adviser — also reportedly communicate through encrypted messaging apps, including WhatsApp. House Democrats have tried to get access to these texts, saying Kushner conducted official government business through these tools, which could threaten national security. The question might be, however, whether MBS shared any videos.