Twitter sued over Saudi spying that allegedly landed popular user in prison [Updated]

[Update: A MENA Rights Group spokesperson told Ars that the group has been assisting Abdulrahman since 2018, detailing developments in his case here, and it has filed a complaint with the UN's Working Group on Arbitrary Detention (WGAD) in 2021. On April 5, 2022, the UN's WGAD issued an opinion finding that Abdulrahman is being detained arbitrarily.

This was partly because his arrest and detention lack a legal basis due to a "lack of legal clarity of the Anti-Terrorism and Anti-Cybercrime Laws," MENA Rights Group reported, and partly because he was deprived of his right to freedom of expression “on discriminatory grounds, because of his political opinion.” At that time, the UN called on Saudi authorities to "take urgent action to ensure his immediate unconditional release." Abdulrahman's current status remains unknown to family.

Michael Page, the deputy director of the Human Rights Watch (HRW) Middle East and North Africa division, told Ars that HRW cannot comment on Areej's complaint. He shared a letter sent to Twitter in November 2022 urging the company to "undertake a due diligence process and develop a risk mitigation strategy regarding the company’s links to a Saudi government-controlled entity that has itself been involved in abuses" and asking the company to publicly call for the immediate release of another Twitter user, Salma al-Shehab, who was imprisoned for 34 years for "peaceful comments."

Twitter never responded to the letter, which reminded the company of its human rights responsibilities. Those include taking "steps to address adverse human rights impacts that stem from their practices or operations and to provide for remediation of adverse human rights impacts directly linked to their operations, products or services."]

While based in the United States from 2008 to 2014, human rights activist Abdulrahman Al-Sadhan tweeted critically about the Kingdom of Saudi Arabia (KSA) to more than 160,000 followers. After he returned to Saudi Arabia in 2015, his anonymous account allegedly became unmasked by former Twitter employees who were charged with conspiring with the Saudi regime to silence dissidents. Now, his sister, Areej Al-Sadhan, is suing Twitter for allegedly violating its terms of service and giving her brother's "identifying information to the government of Saudi Arabia" when his Twitter speech should have been protected.

"This puts every Twitter user at risk," Areej alleged in an affidavit supporting her complaint. "As a result, Saudi Arabia kidnapped, tortured, imprisoned, and—through a sham trial— sentenced my brother to 20 years in prison, simply for criticizing Saudi repression on his Twitter account."

Areej is a US citizen who alleges that she has been stalked, threatened, and targeted by the KSA ever since she began speaking out on her brother's behalf—including on Twitter, where her account currently has nearly 15,000 followers. She filed the lawsuit on behalf of Abdulrahman in a US district court in San Francisco, claiming that her brother is an incompetent (unable to help their attorney) because he disappeared after the KSA sentenced him to prison and thus cannot defend himself. He has not been heard from since 2021, the lawsuit said.

"The Saudi government has since denied him contact with his family or access to his attorney," Areej said in her affidavit. "I am not sure if he is alive. After I began to speak out against Saudi repression, my life became a living hell.”

Twitter's privacy policy, the lawsuit noted, said in 2015 that Twitter would not share private user information, possibly lulling Abdulrahman into a false sense of security that he'd never be connected to his critical tweets:

We may share or disclose your non- private, aggregated or otherwise non-personal information, such as your public user profile information, public Tweets, the people you follow or that follow you, or the number of users who clicked on a particular link (even if only one did), or reports to advertisers about unique users who saw or clicked on their ads after we have removed any private personal information (such as your name or contact information).

"Another provision of the policy states that Twitter will preserve user information 'if we believe that it is reasonably necessary ... to protect the safety of any person.'" Areej's lawyers noted.

In 2019, however, former Twitter employees, Ahmad Abouammo and Ali Alzabarah, were formally charged with spying for the Saudi government after going against Twitter's privacy agreement and sharing private user data.

Areej's case builds on that prior case, alleging that former Twitter employees "unlawfully transmitted back the names, birthdates, device identifiers, phone numbers, IP addresses, and session IP histories associated with" approximately 6,000 accounts tweeting critically about the Saudi regime. In total, the ex-employees allegedly accessed data 30,892 times and shared confidential information on anonymous users like Abdulrahman.

"Each time they accessed this user data, they committed a racketeering act in aid of the Saudi Criminal Enterprise’s goal of transnational repression," Areej's lawsuit alleges, which is a violation of the Racketeering Influenced and Corrupt Organizations (RICO) Act.

Twitter will likely take the position that its employees acted covertly and that their spying was not approved, The Washington Post reported. But Areej's complaint alleges that the FBI alerted Twitter to the Saudi spying as early as 2015, and Twitter was financially motivated to look the other way because KSA is its most important market in the Middle East.

Also in 2015, then-Twitter CEO Jack Dorsey met Saudi Crown Prince Mohammed bin Salman—who later "approved an operation in Istanbul, Turkey to capture or kill Saudi journalist Jamal Khashoggi" in 2018—to discuss training and qualifying Saudi employees, the lawsuit said. The KSA has also heavily invested in Twitter, becoming Twitter's second-largest shareholder behind Elon Musk, the lawsuit said.

According to Areej's lawyer, Jim Walden, allowing the KSA to infiltrate US businesses to commit "flagrant acts of transnational repression" is an "utter failure of US policy."

"As long as we lay idle while the rights of Americans and their families are trampled, authoritarian regimes like Saudi Arabia will continue to penetrate US business and to use them as weapons for their criminality," Walden told Ars. "We look forward to holding Twitter and the Saudi regime to account.”

Areej has asked for a jury trial, where damages will be assessed for alleged injuries, including severe financial and professional harm for Areej and severe physical and mental pain, suffering, and anguish for Abdulrahman.

The last time Areej's family saw Abdulrahman, the complaint said, he had "trouble walking and focusing, his toenails were missing, his hand was mutilated, and his body showed other signs of torture." KSA’s secret police allegedly "gloated about obtaining confidential information" from Twitter and broke Abdulrahman's hand, taunting, “this is the hand you write and tweet with.”

Saudi users suffer after trusting Twitter

Areej's lawsuit said that "the goal" of the Saudi government's "transnational repression is to intimidate and chill political and social dissenters from voicing their criticism or otherwise exercising their fundamental civil and human rights."

For some of Saudi Arabia's most outspoken youth, Twitter became a platform of choice for a grassroots movement in 2010 during the Arab Spring, a "series of anti-government protests, uprisings, and armed rebellions." These young people depended on aliases to shield them from repression. That’s why Twitter seeming like it was OK with being a “tool” for Saudi spies so it could enhance its commercial relationship with the KSA felt like such a huge betrayal, the lawsuit alleged.

"The fair inferences from the evidence and allegations," Areej's complaint said, "demonstrate" that "Twitter’s participation in the racketeering activity was either knowing or based on its conscious avoidance and/or deliberate indifference to the criminality occurring within" Twitter's system, "as it abetted acts of murder, kidnapping, and torture."

Twitter also seemingly negligently allowed its ex-employee Alzabarah "to access sensitive and private user data for non-work-related purposes and did not disable his access." While Alzabarah and his co-conspirators accessed and disclosed confidential Twitter user data "at least 30,892 times," the lawsuit said, KSA's stake in Twitter doubled. To reward Twitter employees serving as Saudi spies during this time, like Abouammo and Alzabarah, the KSA gave out gifts and cash. Abouammo received over $300,000, according to the lawsuit.