Raven told UAE security forces Mansoor had photographed a prisoner he visited in jail, against prison policy, \u201cand then attempted to destroy the evidence on his computer,\u201d said a Powerpoint presentation reviewed by Reuters.<\/p>\n
Citizen Lab published research in 2016 showing that Mansoor and Donaghy were targeted by hackers \u2014 with researchers speculating that the UAE government was the most likely culprit. Concrete evidence of who was responsible, details on the use of American operatives, and first-hand accounts from the hacking team are reported here for the first time.<\/p>\n
Mansoor was convicted in a secret trial in 2017 of damaging the country\u2019s unity and sentenced to 10 years in jail. He is now held in solitary confinement, his health declining, a person familiar with the matter said.<\/p>\n
Mansoor\u2019s wife, Nadia, has lived in social isolation in Abu Dhabi. Neighbors are avoiding her out of fear security forces are watching.<\/p>\n
They are correct. By June 2017 Raven had tapped into her mobile device and given her the code name Purple Egret, program documents reviewed by Reuters show.<\/p>\n
To do so, Raven utilized a powerful new hacking tool called Karma, which allowed operatives to break into the iPhones of users around the world.<\/p>\n
Karma allowed Raven to obtain emails, location, text messages and photographs from iPhones simply by uploading lists of numbers into a preconfigured system, five former project employees said. Reuters had no contact with Mansoor\u2019s wife.<\/p>\n
Karma was particularly potent because it did not require a target to click on any link to download malicious software. The operatives understood the hacking tool to rely on an undisclosed vulnerability in Apple\u2019s iMessage text messaging software.<\/p>\n
In 2016 and 2017, it would be used against hundreds of targets across the Middle East and Europe, including governments of Qatar, Yemen, Iran and Turkey, documents show. Raven used Karma to hack an iPhone used by the Emir of Qatar, Sheikh Tamim bin Hamad al-Thani, as well as the phones of close associates and his brother. The embassy of Qatar in Washington did not respond to requests for comment.<\/p>\n
WHAT WASHINGTON KNEW<\/h3>\n
Former Raven operatives believed they were on the right side of the law because, they said, supervisors told them the mission was blessed by the U.S. government.<\/p>\n
Although the NSA wasn\u2019t involved in day-to-day operations, the agency approved of and was regularly briefed on Raven\u2019s activities, they said Baier told them.<\/p>\n
CyberPoint founder Gumtow said his company was not involved in hacking operations.<\/p>\n
\u201cWe were not doing offensive operations. Period,\u201d Gumtow said in a phone interview. \u201cIf someone was doing something rogue, then that\u2019s painful for me to think they would do that under our banner.\u201d<\/p>\n
Instead, he said, the company trained Emiratis to defend themselves through a program with the country\u2019s Ministry of Interior.<\/p>\n
A review of internal Raven documents shows Gumtow\u2019s description of the program as advising the Interior Ministry on cyber defense matches an \u201cunclassified cover story\u201d Raven operatives were instructed to give when asked about the project. Raven employees were told to say they worked for the Information Technology and Interoperability Office, the program document said.<\/p>\n
Providing sensitive defense technologies or services to a foreign government generally requires special licenses from the U.S. State and Commerce Departments. Both agencies declined to comment on whether they issued such licenses to CyberPoint for its operations in the UAE. They added that human rights considerations figure into any such approvals.<\/p>\n
But a 2014 State Department agreement with CyberPoint showed Washington understood the contractors were helping launch cyber surveillance operations for the UAE. The approval document explains CyberPoint\u2019s contract is to work alongside NESA in the \u201cprotection of UAE sovereignty\u201d through \u201ccollection of information from communications systems inside and outside the UAE\u201d and \u201csurveillance analysis.\u201d<\/p>\n
One section of the State Department approval states CyberPoint must receive specific approval from the NSA before giving any presentations pertaining to \u201ccomputer network exploitation or attack.\u201d Reuters identified dozens of such presentations Raven gave to NESA describing attacks against Donaghy, Mansoor and others. It\u2019s unclear whether the NSA approved Raven\u2019s operations against specific targets.<\/p>\n
The agreement clearly forbade CyberPoint employees from targeting American citizens or companies. As part of the agreement, CyberPoint promised that its own staff and even Emirati personnel supporting the program \u201cwill not be used to Exploit U.S. Persons, (i.e. U.S. citizens, permanent resident aliens, or U.S. companies.)\u201d Sharing classified U.S. information, controlled military technology, or the intelligence collection methods of U.S. agencies was also prohibited.<\/p>\n
Gumtow declined to discuss the specifics of the agreement. \u201cTo the best of my ability and to the best of my knowledge, we did everything as requested when it came to U.S. rules and regulations,\u201d he said. \u201cAnd we provided a mechanism for people to come to me if they thought that something that was done was wrong.\u201d<\/p>\n
An NSA spokesman declined to comment on Project Raven.<\/p>\n
A State Department spokesman declined to comment on the agreement but said such licenses do not authorize people to engage in human rights abuses.<\/p>\n
By late 2015, some Raven operatives said their missions became more audacious.<\/p>\n
For instance, instead of being asked to hack into individual users of an Islamist Internet forum, as before, the American contractors were called on to create computer viruses that would infect every person visiting a flagged site. Such wholesale collection efforts risked sweeping in the communications of American citizens, stepping over a line the operators knew well from their NSA days.<\/p>\n
U.S. law generally forbids the NSA, CIA and other U.S. intelligence agencies from monitoring U.S. citizens.<\/p>\n
Working together with managers, Stroud helped create a policy for what to do when Raven swept up personal data belonging to Americans. The former NSA employees were instructed to mark that material for deletion. Other Raven operatives would also be notified so the American victims could be removed from future collection.<\/p>\n
As time went on, Stroud noticed American data flagged for removal show up again and again in Raven\u2019s NESA-controlled data stores.<\/p>\n
Still, she found the work exhilarating. \u201cIt was incredible because there weren\u2019t these limitations like there was at the NSA. There wasn\u2019t that bullshit red tape,\u201d she said. \u201cI feel like we did a lot of good work on counterterrorism.\u201d<\/p>\n
DARKMATTER AND DEPARTURES<\/h3>\n
When Raven was created in 2009, Abu Dhabi had little cyber expertise. The original idea was for Americans to develop and run the program for five to 10 years until Emirati intelligence officers were skilled enough to take over, documents show. By 2013, the American contingent at Raven numbered between a dozen and 20 members at any time, accounting for the majority of the staff.<\/p>\n
In late 2015, the power dynamic at the Villa shifted as the UAE grew more uncomfortable with a core national security program being controlled by foreigners, former staff said. Emirati defense officials told Gumtow they wanted Project Raven to be run through a domestic company, named DarkMatter.<\/p>\n
Raven\u2019s American creators were given two options: Join DarkMatter or go home.<\/p>\n
At least eight operatives left Raven during this transition period. Some said they left after feeling unsettled about the vague explanations Raven managers provided when pressed on potential surveillance against other Americans.<\/p>\n
DarkMatter was founded in 2014 by Faisal Al Bannai, who also created Axiom, one of the largest sellers of mobile devices in the region. DarkMatter markets itself as an innovative developer of defensive cyber technology. A 2016 Intercept article reported the company assisted UAE\u2019s security forces in surveillance efforts and was attempting to recruit foreign cyber experts.<\/p>\n
The Emirati company of more than 650 employees publicly acknowledges its close business relationship to the UAE government, but denies involvement in state-backed hacking efforts.<\/p>\n
Project Raven\u2019s true purpose was kept secret from most executives at DarkMatter, former operatives said.<\/p>\n
DarkMatter did not respond to requests for comment. Al Bannai and the company\u2019s current chief executive, Karim Sabbagh, did not respond to interview requests. A spokeswoman for the UAE Ministry of Foreign Affairs declined to comment.<\/p>\n
Under DarkMatter, Project Raven continued to operate in Abu Dhabi from the Villa, but pressure escalated for the program to become more aggressive.<\/p>\n
Before long, senior NESA officers were given more control over daily functions, former Raven operatives said, often leaving American managers out of the loop. By mid-2016, the Emirates had begun making an increasing number of sections of Raven hidden from the Americans still managing day-to-day operations. Soon, an \u201cEmirate-eyes only\u201d designation appeared for some hacking targets.<\/p>\n
FBI QUESTIONS<\/h3>\n
By 2016, FBI agents began approaching DarkMatter employees reentering the United States to ask about Project Raven, three former operatives said.<\/p>\n
The FBI wanted to know: Had they been asked to spy on Americans? Did classified information on U.S. intelligence collection techniques and technologies end up in the hands of the Emiratis?<\/p>\n
Two agents approached Stroud in 2016 at Virginia\u2019s Dulles airport as she was returning to the UAE after a trip home. Stroud, afraid she might be under surveillance by the UAE herself, said she brushed off the FBI investigators. \u201cI\u2019m not telling you guys jack,\u201d she recounted.<\/p>\n
Stroud had been promoted and given even more access to internal Raven databases the previous year. A lead analyst, her job was to probe the accounts of potential Raven targets and learn what vulnerabilities could be used to penetrate their email or messaging systems.<\/p>\n
Targets were listed in various categories, by country. Yemeni targets were in the \u201cbrown category,\u201d for example. Iran was gray.<\/p>\n
One morning in spring 2017, after she finished her own list of targets, Stroud said she began working on a backlog of other assignments intended for a NESA officer. She noticed that a passport page of an American was in the system. When Stroud emailed supervisors to complain, she was told the data had been collected by mistake and would be deleted, according to an email reviewed by Reuters.<\/p>\n
Concerned, Stroud began searching a targeting request list usually limited to Raven\u2019s Emirati staff, which she was still able to access because of her role as lead analyst. She saw that security forces had sought surveillance against two other Americans.<\/p>\n
When she questioned the apparent targeting of Americans, she received a rebuke from an Emirati colleague for accessing the targeting list, the emails show. The target requests she viewed were to be processed by \u201ccertain people. You are not one of them,\u201d the Emirati officer wrote.<\/p>\n
Days later, Stroud said she came upon three more American names on the hidden targeting queue.<\/p>\n
Those names were in a category she hadn\u2019t seen before: the \u201cwhite category\u201d \u2014 for Americans. This time, she said, the occupations were listed: journalist.<\/p>\n
\u201cI was sick to my stomach,\u201d she said. \u201cIt kind of hit me at that macro level realizing there was a whole category for U.S. persons on this program.\u201d<\/p>\n
Once more, she said she turned to manager Baier. He attempted to downplay the concern and asked her to drop the issue, she said. But he also indicated that any targeting of Americans was supposed to be done by Raven\u2019s Emirate staff, said Stroud and two other people familiar with the discussion.<\/p>\n
Stroud\u2019s account of the incidents was confirmed by four other former employees and emails reviewed by Reuters.<\/p>\n
Slideshow (12 Images)<\/span><\/div>\n<\/div>\n When Stroud kept raising questions, she said, she was put on leave by superiors, her phones and passport were taken, and she was escorted from the building. Stroud said it all happened so quickly she was unable to recall the names of the three U.S. journalists or other Americans she came across in the files. \u201cI felt like one of those national security targets,\u201d she said. \u201cI\u2019m stuck in the country, I\u2019m being surveilled, I can\u2019t leave.\u201d<\/p>\n After two months, Stroud was allowed to return to America. Soon after, she fished out the business card of the FBI agents who had confronted her at the airport.<\/p>\n \u201cI don\u2019t think Americans should be doing this to other Americans,\u201d she told Reuters. \u201cI\u2019m a spy, I get that. I\u2019m an intelligence officer, but I\u2019m not a bad one.\u201d<\/p>\n By Christopher Bing and Joel Schectman in Washington. Editing by Ronnie Greene, Jonathan Weber and Michael Williams<\/p>\n<\/div>\n<\/div>\n