{"id":27509,"date":"2019-06-26T14:20:38","date_gmt":"2019-06-26T14:20:38","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/30262\/Guardian-Told-It-Was-Target-Of-Saudi-Hacking-Unit-After-Khashoggi-Killing.html"},"modified":"2019-06-26T14:20:38","modified_gmt":"2019-06-26T14:20:38","slug":"guardian-told-it-was-target-of-saudi-hacking-unit-after-khashoggi-killing","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/guardian-told-it-was-target-of-saudi-hacking-unit-after-khashoggi-killing\/","title":{"rendered":"Guardian Told It Was Target Of Saudi Hacking Unit After Khashoggi Killing"},"content":{"rendered":"
<\/div>\n

The report from Agnes Callamard<\/a>, the UN special rapporteur, sets out in forensic detail concerns about the behaviour of Saudi Arabia, both before and after the murder of the dissident journalist Jamal Khashoggi.<\/p>\n

It also details the potential threats posed to journalists and academics by the kingdom\u2019s use of intrusive spyware.<\/p>\n

This is a threat the Guardian has had to assess with some seriousness in recent months.<\/p>\n

Earlier this year, the Guardian was warned it was being targeted by a cybersecurity unit in Saudi Arabia<\/a> that had been ordered to \u201chack\u201d into the email accounts of journalists investigating the various crises engulfing the royal court.<\/p>\n

The potential threat was initially raised by a source in Riyadh \u2013 and this account was later supported by a copy of what appears to be a confidential internal order. This instructed a technical team to carry out the \u201cpenetration\u201d of the Guardian\u2019s computer servers \u201cin complete secrecy\u201d.<\/p>\n

The document was signed in the name of Saud al-Qahtani<\/a>, an aide and confidant of the crown prince, Mohammed bin Salman<\/a>. Qahtani has been accused of overseeing the operation to murder Khashoggi.<\/p>\n

In the weeks since then, the Guardian has repeatedly asked the Saudi authorities to comment about the alleged threat to it \u2013 and to provide an on-the-record statement giving unequivocal assurance that any operation of this kind has been halted. They have so far declined to do so.<\/p>\n

Instead, Saudi diplomats have acknowledged the seriousness of the allegations, but raised questions about the authenticity of the document.<\/p>\n

They demanded the Guardian share the document so they could \u201cinvestigate this matter more fully\u201d.<\/p>\n

Though experts say it is not unusual for authoritarian regimes such as Saudi Arabia to use \u201chacking\u201d tactics against journalists and writers, the kingdom is under pressure.<\/p>\n

It is only eight months since a Saudi hit-squad murdered Khashoggi, a Washington Post columnist, in a plot widely believed to have been overseen by Qahtani<\/a>.<\/p>\n

It is his name on the single-page memo which indicates the Guardian may have become a target for a Saudi-based cybersecurity team understood to be run from the private office of the crown prince.<\/p>\n

The Guardian first became aware of a potential threat following the publication in March of a story that described strains<\/a> between King Salman bin Abdulaziz Al Saud and his young and controversial heir.<\/p>\n

The article provoked debate across the Middle East, fuelling speculation the king was trying to play a more central role to help guide the kingdom through a turbulent period caused in part by the missteps of his son, or those around him.<\/p>\n

Guardian reporters were urged to \u201ctake all necessary precautions\u201d because elements within the royal court were attempting to identify individuals who may have spoken out. The Guardian<\/a> was told it should alert relevant authorities in the UK and the US.<\/p>\n

\u201cYou need to protect yourselves,\u201d the source said.<\/p>\n

Later, the Guardian received a copy of a document written in Arabic which appeared to support the initial claims.<\/p>\n

The Guardian has not been able to independently verify the authenticity of the memo, though all the details of the document were provided to the Saudi authorities.<\/p>\n

Dated 7 March 2019, the memo is addressed to the \u201cheads of technological and technical departments\u201d of what is called the cybersecurity directorate within the private office of the crown prince.<\/p>\n

The memo refers to the \u201csensitive information\u201d contained in the Guardian story and the requirement to track down its sources.<\/p>\n

The memo states: \u201cBased on what was published in the British newspaper, the Guardian, in its issue published on 28\/6\/1440 AH (March 6, 2019), and which includes sensitive information on the relationship between the custodian of the two holy mosques and his highness the crown prince, may God keep them, and due to what this constitutes in terms of grave security threats and what we knew in advance of the existence of some moves against the position of his highness the crown prince.<\/p>\n

\u201cWe have conducted a preliminary tracking of the newspaper\u2019s leaks, and have determined that they have two primary communication points in London, UK, and Washington, US. It appears to us that there is a strong relationship between the individuals mentioned below and the source (or sources) of the leaks.<\/p>\n

\u201cBased on this, carry out the penetration of the servers of the Guardian newspaper and those who worked on the report that was published, and deal with the issue with complete secrecy, then send us all the data as soon as possible.\u201d<\/p>\n

The memo specifically names two Guardian journalists: Nick Hopkins, a UK citizen, and Stephanie Kirchgaessner, a US citizen. Their names appear to be the subject of two attachments also referred to in the document.<\/p>\n

Though he was supposed to have been sidelined by the crown prince after the furore over Khashoggi\u2019s murder, sources inside and outside the kingdom have told the Guardian that Qahtani is still in the fold.<\/p>\n

Last November the US Treasury<\/a> placed Qahtani on a sanctions list, saying he was \u201cpart of the planning and execution of the operation that led to the killing of Mr Khashoggi\u201d. The Treasury claimed Qahtani was one of the Saudi officials involved in \u201cthe abhorrent killing\u201d of the journalist in a targeted and brutal operation.<\/p>\n

The US state department has included Qahtani on a list of 16 individuals<\/a> barred from entering the US because of their alleged role in the killing.<\/p>\n

The notice was issued, the state department said<\/a>, because it \u201chas credible information that officials of foreign governments have been involved in significant corruption or gross violations of human rights\u201d.<\/p>\n

The Guardian provided the Saudi embassies in London and Washington with all the relevant details from the document \u2013 including the date it was signed and its reference number.<\/p>\n