AO 91 (Rev. 11111) Criminal Complaint

UNITED STATES DISTRICT COURT
for the
Northern District of California

)
)

United States of America

v.

)
)
)
)
)

AHMAD ABOUAMMO;
AHMED ALMUTAIRI, a/k/a AHMED ALJBREEN;'
and ALI ALZABARAH,

Case No.

3

Defendant(s)

CRIMINAL COMPLAINT
I, the complainant

in this case, state that the following is true to the best of my knowledge
11/20/2014 to 10/20/2018

On or about the date(s) of
Northern

District of

California

in the county of

, the defendant(s)

and belief.

San Francisco

---------------------

in the

violated:

Offense Description

Code Section

Acting as Agent of Foreign Government Without Notice to Attorney General;
and
Destruction, Alteration, or Falsification of Records in Federal Investigations

18 U.S.C. § 951;
and
18 U.S.C. § 1519

This criminal complaint is based on these facts:

See attached affidavit

'

~ Continued on the attached sheet.

Letitia Wu, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.

Date:

\,

City and state:

\.;-

), 0)

San Francisco, California

Hon. Thomas S. Hixson, U.S. Magistrat
Printed name and title

Judge

 1

I, LetitiaL. Wu, a Special Agent with the Federal Bureau of Investigation ("FBI") in Palo Alto,

2

California, being first duly sworn, hereby depose and state the following:

3

I.

4

PURPOSE OF AFFIDAVIT AND CRIMINAL CHARGES
1.

I submit this affidavit in support of a Criminal Complaint that charges defendants Ali

5 ALZABARAH, Ahmed ALMUTAIRl, also known as Ahmed Aljbreen, and Ahmad ABOUAMMO
6 with violations of 18 U.S.C. § 951 and ABOUAMMO with a violation of 18 U.S.c. § 1519.
7

2.

Specifically, from at least in or about November 20, 2014, up to and including in or about

8 May 24,2015, in the Northern District of California and elsewhere, ALMUTAIRI, the defendant, did
9 knowingly act in the United States as an agent of a foreign government, specifically, ALMUT AIRl
10 acted within the United States under the direction and control of the Kingdom of Saudi Arabia and
11 foreign officials working on behalf of the Kingdom of Saudi Arabia, without prior notification to the
12 Attorney General, as required by law, in violation of 18 U.S.C. § 951.
13

3.

Beginning no later than December 12,2014, until at least March 12,2015, in the

14 Northern District of California and elsewhere, ABOUAMMO, the defendant, did knowingly act in the
15 United States as an agent of a foreign government, specifically, ABOUAMMO acted within the United
16 States under the direction and control of the Kingdom of Saudi Arabia and foreign officials working on
17 behalf of the Kingdom of Saudi Arabia, without prior notification to the Attorney General, as required
18 by law, in violation of 18 U.S.C. § 951.
19

4.

Further, beginning at least in or about May 21,2015, up to and including in or about

20

December 2015, in the Northern District of California and elsewhere, ALZABARAH, the defendant, did

21

knowingly act in the United States as an agent of a foreign government, specifically, ALZABARAH

22

acted within the United States under the direction and control of the Kingdom of Saudi Arabia and

23

foreign officials working on behalf of the Kingdom of Saudi Arabia, without prior notification to the

24

Attorney General, as required by law, in violation of 18 U.S.C. § 951.

25

5.

On October 20,2018, in the Northern District of California and elsewhere,

26

ABOUAMMO, the defendant, unlawfully, intentionally, and knowingly did alter, destroy, mutilate,

27

conceal, and falsify a record or document, namely creating and providing by email to the Federal Bureau

28

of Investigation a fabricated, false, and backdated invoice for $100,000 for consulting services to
AFFIDAVIT OF FBI SA LETITIA WU

 1 Foreign Official-I, from CYRCL, LLC, defendant's sole proprietorship, with the intent to impede,
2

obstruct and influence an actual or contemplated investigation of a matter within the jurisdiction of a

3 department or agency ofthe United States, namely the Federal Bureau ofInvestigation,
4

in violation of

Title 18, United States Code, Section 1519.

5 II.

AGENT QUALIFICATIONS

6

6.

I am a Special Agent with the FBI, and have been since July 2015. I am currently

71 assigned to the Counterintelligence Division within the San Francisco Field Office of the FBI. In my
8

capacity as a Special Agent, my duties and the training that I have received include the investigation of

9 violations of federal criminal law, including counterintelligence related offenses and cybercrimes (such
10 as acting as an agent of a foreign government without notification to the Attorney General, economic
11 espionage, theft oftrade secrets, and computer fraud and abuse violations).
12

7.

The facts in this Affidavit come from my personal observations, my training and

13 experience, and information obtained from other agents, law enforcement personnel, and witnesses.
14

8.

Unless otherwise noted, wherever in this Affidavit I recount a statement, including

15 written statements made by another person, that statement is recounted in substance and in relevant part.
16 Statements in quotation marks, if any, are based on preliminary translations or transcriptions, and review
17 of or interpretations of communications, all of which may be subject to revision.
18

9.

Unless otherwise stated, all times listed in this Affidavit are Pacific Time and are

19 approximate times.
20

10.

This affidavit is intended to show merely that there is sufficient probable cause for the

21

requested warrant and does not set forth all of my knowledge about this matter.

22

III.

23

BACKGROUND
11.

Twitter, Inc. ("Twitter") is a company headquartered in San Francisco, California, and

24

owns and operates a free-access social-networking website of the same name that can be accessed at

25

http://www.twitter.com.

26

create user accounts that can be used to communicate and share information instantly through "Tweets"

27

(i.e., 140-character messages prior to 2017) to the public at large, "tweets" to a subset of Twitter users

Users of Twitter, including private individuals, journalists, and public figures,

28 [
AFFIDAVIT OF FBI SA LETITIA WU

2

 1 (e.g., to the public or to certain users that "follow" a user), "retweets" by one user of another user, or
2
3
4

direct messages that are typically visible only to the sender and recipient.
12.

Twitter operates its service in many languages, including English and Arabic. Many

Twitter users live in Saudi Arabia and some users of Saudi nationality or descent live outside of Saudi

5 Arabia, including in the United States. Twitter has access to and maintains data about each of its users,
6

and Twitter's privacy policy outlines the circumstances in which the data maintained by Twitter about

7

its users may be disclosed, sold, or transferred. Twitter considers its user data to be valuable, and uses it

8 for tailoring revenue-generating advertisements to its users, as well as supplying engaging contentand
9
10

other purposes.
13.

Title 18, United States Code, Section 2702, provides that service providers of electronic

11 communications and remote computing services, such as Twitter, may voluntarily disclose user data to a
12 governmental entity, if the service provider, in good faith, believes than an emergency involving danger
13 of death or serious physical injury to any person requires disclosure without delay of data relating to the
14 emergency.
15

14.

The Kingdom of Saudi Arabia ("KSA") is a monarchy governed by the Saudi King and

16 his Royal Court, which is akin to a cabinet or executive office. Members of the King's Royal Family
17 hold most of the country's important posts.
18

15.

From at least in or about June 2,2014, up to and including in or about December 3, 2015,

19 a foreign official of the Kingdom of Saudi Arabia who is not identified by name ("Foreign Official-I")
20

was the secretary general of a charitable organization ("Organization No.1") of a member of the Saudi

21

Arabian Royal Court ("Royal Family Member-l "). Beginning May 3, 2015, Foreign Official-l listed

22

his employer on his U.S. visa application as the "Royal Court."

23

16.

Ali Hamad ALZABARAH is a citizen of Saudi Arabia and resided in San Bruno,

24

California from at least 2014 until December 3, 2015. Funded by a Saudi Arabian scholarship,

25

ALZABARAH entered the United States in 2005 and studied and obtained degrees in computer science

26

from various universities in the United States. From in or about August 2013 to in or around December

27

2015, ALZABARAH worked as a site reliability engineer at Twitter in San Francisco, California.

28
AFFIDAVIT OF FBI SA LETITIA WU

3

 1
2

17.

Ahmad ABOUAMMO is a United States citizen and resided in the Northern District of

California from at least November 2013 until May 22, 2015, and thereafter resided in Seattle,

3 Washington. ABOUAMMO was an employee of Twitter, Inc. from on or about November 3, 2013 to
4

May 22,2015.

ABOUAMMO was a Media Partnerships Manager responsible for the Middle East and

5 North Africa ("MENA") region at Twitter. ABOUAMMO was involved in assisting notable accounts of
6 public interest, brands, journalists, and celebrities for the MENA region with content, Twitter strategy,
7
8

and sharing best practices.
18.

Ahmed ALMUTAIRI, also known as Ahmed ALJBREEN, is a Saudi citizen.

9 ALMUTAIRI was present in the United States of America between approximately August 21,2014
10 until approximately May 24, 2015. From at least May 2014 to the present, ALMUTAIRI has controlled
11 a Saudi social media marketing company that does work for Organization No.1 and members of the
12 Saudi Royal Family, including Royal Family Member-I.

ALMUTAIRI traveled to the United States on

13 a student visa in August 2014 for the purpose of studying English in the San Francisco Bay Area.
14

19.

ABOUAMMO and ALZABARAH had access to proprietary and confidential Twitter

15 information, including information about Twitter users, including the user-provided email addresses,
16 birthdates, phone number, and internet protocol ("IP") addresses.
17

20.

Twitter employees, including ABOUAMMO and ALZABARAH, agree to abide by the

18 Twitter "Playbook" which outlines the policies Twitter employees must obey as part of their
19 employment. Twitter's 2013 employment contracts with ABOUAMMO and ALZABARAH, prohibited
20

them from engaging in outside employment or consulting "or any other business activity that would

21

create a conflict of interest with the Company." Twitter's 2013 Employee Invention Assignment and

22

Confidentiality Agreements with ABOUAMMO and ALZABARAH affirmed "a relationship of

23

confidence and trust" between Twitter and each employee "with respect to any information of a

24

confidential or secret nature that may be disclosed to me by the Company or a third party that relates to

25 the business of the Company" and defined "Proprietary Information" to include "customer lists and
26

data." The Employee Invention Assignment and Confidentiality Agreement further required

27

ABOUAMMO and ALZABARAH to "keep and hold all such Proprietary Information in strict

28

confidence and trust. I will not use or disclose any Proprietary Information without the prior written
AFFIDAVIT OF FBI SA LETITIA WU

4

 1 consent of the Company" and required them during their employment not to "use[] any Company
2

information for any other business or employment."
21.

3

4

Twitter's "Playbook Acknowledgement," which ABOUAMMO and ALZABARAH each

signed during 2013, stated that each would read, understand, and abide by Twitter's policies, including

5 the Security Handbook, which defined user data as confidential data and prohibited sharing confidential
6 data with third parties without approval.
22.

7

Twitter's "Gift Policy" during ABOUAMMO and ALZABARAH's

employment stated:

8 "[f]or gifts exceeding $100 in value, bring the gift to the attention of both your manager and VP ofHR
9 -before returning to sender."
10

23.

Neither ABOUAMMO nor ALZABARAH's job duties included a need to access a

11 Twitter user's private information, and doing so was a reportable violation ofthe Twitter Playbook
12 policies regarding protecting user data. Since December 2015, Twitter has enhanced its controls and
13 permissions to restrict access to user information only to those whose duties require access.
14

24.

As of November 1,2019, ALZABARAH, ALMUTAIRI, and ABOUAMMO have not

15 provided notification to the Attorney General that they were acting as an agent of a foreign government.
16 IV.

SAUDI ARABIA'S USE OF ABOUAMMO AND ALZABARAH TO OBTAIN PRIVATE
TWITTER USER DATA ON BEHALF OF THE KINGDOM OF SAUDI ARABIA

17

18

A.

ABOUAMMO's Contact With AHMED ALMUTAIRI and Foreign Official-l Starting in
June 2014 and Meeting With Foreign Official-l in the United States and the United
Kingdom

25.

Foreign Official-I, on behalf ofKSA, began cultivating employees of Twitter in an effort

19
20
21
22

to obtain private user information that it could not obtain elsewhere.
26.

In April 2014, according to emails from Twitter, a public relations firm representing the

23

Embassy of the Kingdom of Saudi Arabia contacted Twitter and asked for assistance in verifying the

24

Twitter account of a Saudi Arabian news personality. Twitter assigned the task to ABOUAMMO.

25

email, ABOUAMMO explained to the public relations firm that he was heading the media partnerships

26

for the MENA region, and part of his job was to work with media partners to share best practices and

27

work on Twitter strategy. ABOUAMMO also asked the public relations firm to let him know if they

28

have any other requests regarding the Saudi government.
AFFIDAVIT OF FBI SA LETITIA WU

In an

5

 1
2

27.

On or about May 16,2014, a representative from the u.S.-Saudi Arabian Business

Council in Vienna, VA, emailed ABOUAMMO and asked him to arrange a tour of Twitter's San

3 Francisco office for a group of Saudi "entrepreneurs."
4

ABOUAMMO agreed and coordinated with

others at Twitter to schedule the tour for June 13,2014. A follow-up email informed ABOUAMMO

5 that the attendees would include Foreign Official-I, who subsequently (in early 2015) became the head
6

of Royal Family Member-l 's private office. On the day of the tour, June 13,2014, ABOUAMMO

7

emailed his telephone number to Foreign Official-I. The email subject stated "contact for ahmad" and

8 the ~ody of the message contained only ABOUAMMO's ten-digit personal phone number and his
9

signature block.

10

28.

Also on the day of the tour, Foreign Official-l emailed ABOUAMMO about verifying

11 the Twitter account of Royal Family Member-I, indicating that Foreign Official-l was working for and
12 at the direction of Royal Family Member-l with respect to his online presence on the Twitter platform.
13

29.

On June 14,2014, Foreign Official-l emailed ABOUAMMO and asked for

14 ABOUAMMO's contact information. ABOUAMMO responded by email with his Twitter email
15 address and his personal Skype account, and again provided his personal telephone number. On that
16 date, at approximately 3:36 p.m. Pacific, toll records show Foreign Official-l contacting ABOUAMMO
17 in a telephone call that lasted approximately 1 minute, 47 seconds. Subsequently, on June 15 and 17,
18 2014, Foreign Official-l emailed ABOUAMMO two photographs - one of Foreign Official-l with
19 ABOUAMMO, and another of Foreign Official-I, ABOUAMMO, and the group of visitors to Twitter
20

on June 13,2014.

21

30.

In or around late November 2014, Foreign Official-l and ABOUAMMO communicated

22

by telephone and email to coordinate an in-person meeting in London, United Kingdom, in early

23

December 2014. For example, on November 20, 2014, ABOUAMMO emailed Foreign Official-l

24

through ABOUAMMO's Twitter account and asked if Foreign Official-l had finalized his trip to

25

London and informed Foreign Official-l that he would be in London between December 1,2014 and

26

December 5, 2014. ABOUAMMO traveled to London, United Kingdom on November 29, 2014 to

27

attend

a Twitter global media

summit.

28
AFFIDAVIT OF FBI SA LETITIA WU

6

 1
2

31.

Around this same time, ABOUAt\1MO also met with Ahmed ALMUTAIRI, whose

company does work for Foreign Official-l 's charitable organization. On November 15,2014,

3 ALMUTAIRI sent an email to ABOUAMMO requesting an "urgent meeting" in San Francisco to
4

discuss their "mutual interest." ALMUT AIRI explained he was the advisor for a "VVIP 1st Degree

5 Member of the Saudi Royal Family." On November 20,2014, ALMUTAIRI met with ABOUAMMO
6

in front of the Twitter office in San Francisco, California, and posted a photograph of himself with

7 ABOUAMMO on ALMUTAIRI's Twitter account. On December 1,2014, prior to ABOUAMMO's
8 meeting with Foreign Official-l in London, ALMUTAIRI emailed ABOUAMMO at his Twitter account
9 and stated, "I'm quite confident that by both of us cooperating and working together, we'll achieve the
10 goals of Twitter in the region."
11

32.

Foreign Official-l emailed ABOUAMMO on December 4,2014, and stated "I'm in Paris

12 I will come to london tomorrow for one day to meet you on Friday. When I arrive I will call you." The
13 next day, December 5, 2014, Foreign Official-l contacted ABOUAMMO by telephone in a call that
14 lasted approximately four seconds, and Foreign Official-1 and ABOUAMMO met in person in London,
15 United Kingdom. On December 6, 2014, ABOUAMMO returned to San Francisco.
16

33.

As discussed below, I met with ABOUAMMO on October 20,2018, and ABOUAMMO

17 told me at that time that, while in London, Foreign Official-1 gave him a watch. Records obtained by
18 the FBI show that, on or about December 27,2014, ABOUAMMO contacted an online consignment
19 store for luxury watches about a Hublot Unico Big Bang King Gold Ceramic watch. The consignment
20

store offered to sell the watch for $20,000. In January 2015, ABOUAMMO responded to

21

advertisements of potential buyers looking for luxury watches on Craigslist.org, claiming his watch,

22

which he stated he purchased in London, U.K., was worth $35,000 and that he would accept an offer of

23

no less than $25,000. At the request of the FBI, a United Kingdom law enforcement official visited the

24

store where ABOUAMMO had claimed in his online communications to have purchased the watch,

25

however, the store informed the law enforcement official that it did not carry or sell the Hublot Unico

26

Big Bang King Gold Ceramic watch.

27 II
28
AFFIDAVIT OF FBI SA LETITIA WU

7

 1
2

B.

ABOUAMMO's Unauthorized Access of Private Twitter User Data and Continued
Contact With Foreign Official-1

34.

Within one week of ABOUAMMO's meeting in London with Foreign Official-I,

3 ABOUAMMO began accessing private Twitter user information of interest to Foreign Official-1 and the
4

Saudi Royal Family.

5

35.

On December 12,2014, ABOUAMMO accessed Twitter User-1 's email address through

6 Twitter's computer systems. Based on the FBI's review of Twitter User-1 's public postings, Twitter
7 User-1 was a prominent critic of the Kingdom of Saudi Arabia and the Royal Family with over
8

1,000,000 Twitter followers. ABOUAMMO accessed Twitter User-1 's email address again on January

9

5,2015, January 27, 2015, February 4, 2015, February 7,2015, February 18,2015, and February 24,

10 2015.
11

36.

On or about January 17,2015, Foreign Official-1 began communicating with

12 ABOUAMMO on ABOUAMMO's personal email in addition to his Twitter email account. On January
13

17,2015, Foreign Official-1 emailed ABOUAMMO at ABOUAMMO's personal email and stated only

14 "as we discussed in london ... " Foreign Official-1 attached to the email a document that discussed how
15 Twitter User-1 had violated both Twitter policy and Saudi laws. On January 20,2015, Foreign Official16

1 called ABOUAMMO twice (the calls lasting 19 seconds and 51 seconds, respectively). On January

17 22,2015, Foreign Official-1 called ABOUAMMO seven times (no answer, 6 seconds, 5 seconds, 3
18 seconds, 4 minutes 37 seconds, 3 minutes 36 seconds, and 39 seconds, respectively). ABOUAMMO
19 also accessed the email address provided by user @KingSalman the same day. The handle
20

@KingSalman was the Twitter Account for Saudi King Salman bin Abdulaziz Al Saud. Foreign

21

Official-1 called ABOUAMMO on January 23,24, and twice on January 25, 2015 (1 minute 57 seconds,

22

no answer, 1 minute 57 seconds, and 6 seconds, respectively).

23

accessed Twitter User-1 's user email address again. The next day, Foreign Official-1 called

24

ABOUAMMO three times (11 seconds, 5 seconds, and no answer).

25

37.

On January 27, 2015, ABOUAMMO

On February 3, 2015, Foreign Official-1 forwarded ABOUAMMO an email from Twitter

26

Support revealing that Foreign Official-1 filed a complaint with Twitter against Twitter User-2, who was

27

impersonating a member of the Saudi Royal Family. The email indicated Foreign Official-1 filed a

28
AFFIDAVIT OF FBI SA LETITIA WU

8

 1 report with Twitter advising he was the representative of the individual being impersonated by Twitter
2

User-2. Based on the FBI's review of the Twitter User-2's public postings, Twitter User-2 appeared to

3 be a critic of the Kingdom of Saudi Arabia and the Royal Family. Twitter Support requested Foreign
4

Official-1 provide proof that he is authorized to represent the individual. On that same day,

5 ABOUAMMO's close relative residing in Beirut, Lebanon, opened a Lebanese bank account at the
6 Beshara EI-Khoury branch of Bank Audi in Beirut ("Bank Audi Account") and the account later
7 received payments that were later disbursed to ABOUAMMO's account in the United States, discussed
8 below.
9

On February 4,2015, ABOUAMMO accessed Twitter User-1 's user information again and was

able to view account information, including the email address and telephone number associated with

10 Twitter U ser-l 's account. According to a Twitter Security Engineer that FBI interviewed, the amount of
11 information a Twitter employee can view through Twitter computer systems depended on both the user12 provided information and the level of access of the Twitter employee.
13

38.

On February 5, 2015, Foreign Official-1 emailed ABOUAMMO at his Twitter account

14 and attached a document written in Arabic and translated with the banner, "Urgent Report - Secret and
15 private" that discussed tweets by Twitter User-2. On February 7, 2015, ABOUAMMO accessed Twitter
16 User-1 's email address and phone number as well as Twitter User-2's email address.
17

39.

18 http://cyrc1.co.

On February 9, 2015, ABOUAMMO registered the website for CYRCL, LLC at
As discussed below, ABOUAMMO used this limited liability company to receive

19 $100,000 USD from Foreign Official-1 in 2016. On February 12 and 13,2015, Foreign Official-1 called
20

ABOUAMMO five times (7 minutes 28 seconds, 1 minute 24 seconds, 2 minutes 10 seconds on

21

February 12,2015, and 15 and 17 seconds on February 13,2015).

22

Official-1 sent a $100,000 wire transfer to ABOUAMMO's close relative in Beirut, Lebanon.

23

40.

On February 13,2015, Foreign

On February 16,2015, Foreign Official-l called ABOUAMMO three times. Two days

24

later, ABOUAMMO accessed Twitter User-l 's email address and phone number. On February 19,

25

2015, ABOUAMMO created an online user ID and password to access the Bank Audi Account his close

26

relative opened in Lebanon on February 3, 2015.

27

Twitter User-1 's email address and phone number. On the same day, a $9,963 wire transfer was sent

On February 24, 2015, ABOUAMMO accessed

28
AFFIDAVIT OF FBI SA LETITIA WU

9

 1 from the Lebanon Bank Audi Account to ABOUAMMO's Bank of America account ending in 3078
2
3
4

("Bank of America Account").
41.

On March 5, 2015, Foreign Official-l called ABOUAMMO 11 times. Foreign Official-l

also called ABOUAMMO three times on March 6,2015.

On March 8, 2015, ABOUAMMO sent

5 Foreign Official-l a Twitter direct message stating "proactive and reactively we will delete evil my
6 brother." On March 12, 2015, a $9,911 wire transfer was sent from the Lebanon Bank Audi Account to
7 ABOUAMMO's Bank of America Account.
8

42.

On May 22,2015, ABOUAMMO resigned from his position at Twitter. In sum,

9 ABOUANIMO accessed Twitter User-l's email address and phone number between January 5, 2015,
10 and February 24,2015 and accessed Twitter User-2's email address on February 7, 2015. Based on
11 information provided by Twitter and ABOUAMMO's former supervisor at Twitter, ABOUAMMO had
12 no legitimate business use as a Media Partnerships Manager for accessing users' account information,
13 and doing so would have been a violation of the company's policies.
14

C.

ABOUAMMO Quits Twitter and Moves to Seattle but Continues Contact With and
Accepts Money from Foreign Official-l Through a Relative's Foreign Account

43.

Even after ABOUAMMO left Twitter, Foreign Official-l paid him for services rendered

15
16

17 and for continuing to contact Twitter employees on behalf ofKSA officials.
18

44.

In late May 2015, ABOUAMMO moved from the San Francisco Bay Area to Seattle,

19 Washington for a new job. After ABOUAMMO started his new job, Foreign Official-l continued to
20

contact him with requests for Twitter to take action on certain user accounts, including requests to shut

21

down certain accounts for violating Twitter's terms of service and to verify certain official users at

22

Twitter. ABOUAMMO attempted to facilitate Foreign Official-l 's requests by contacting his former

23

colleagues at Twitter.

24

45.

While facilitating requests from Foreign Official-I, ABOUAMMO continued to transfer

25

money from the Bank Audi Account to the Bank of America Account. On June 15, 2015, a $10,000

26

wire transfer was sent from the Bank Audi Account to the Bank of America Account which was then

27

used as part of ABOUAMMO's down payment for his new residence. A July 7,2015, a $30,000 wire

28
AFFIDAVIT OF FBI SA LETITIA WU

10

 1 transfer was sent from the Bank Audi Account to the Bank of America Account with a notation that it
2

was part of a "down payment of an appartment [sic] in USA."

3
4

Two days later, on July 9, 2015, Foreign Official-l sent ABOUAMMO a wire transfer

46.
i_

receipt through Twitter direct message showing he had wired $100,000 from the National Commercial

5 Bank in Saudi Arabia to the Bank Audi Account. Along with the wire transfer receipt, Foreign Official6

1 apologized for the late response. ABOUAMMO then responded asking whether Foreign Official-1

7 needed anything from Twitter. On July 13,2015, ABOUAMMO emailed Twitter Support and requested
8 verification (a form of authentication by Twitter that an account actually belongs to a notable individual,
9

organization, or company) of the Twitter account @majedhogail, which is used by the Minister of

10 Housing of the Kingdom of Saudi Arabia. On July 30, 2015, ABOUAMMO submitted a cashier's
11 check for $56,495.30 toward down payment for a residence in Seattle ..
12

On August 23,2015, Foreign Official-l called ABOUAMMO (3 minutes and 11

47.

13 seconds). Then on September 8, 2015, Foreign Official-l emailed ABOUAMMO at ABOUAMMO'S
14 personal email and attached two documents _ one discussing the Saudi penalties for hacking,
15 unauthorized access of information, violation of privacy and defamation of other; the other document
16 discussing the Saudi penal law on dissemination and disclosure of classified information and documents.
17 On September 17,2015, ABOUAMMO received an email from Twitter Support confirming he had
18 requested verification of the Twitter account @infographic_ksa, which based on the FBI's review of
19 public postings, appears to feature Saudi government information. Ten days later, Foreign Official-1
20
21

called ABOUAMMO (4 seconds).
On December 11,2015, Foreign Official-l emailed ABOUAMMO and stated, "Hello,

48.

22

Call me. Please as soon as possible. Thank you." Foreign Official-l also called ABOUAMMO but

23

records show the call never connected. On the same day, ABOUAMMO emailed a Director in Twitter's

24

Dubai office asking for help with the verification of the Twitter account @aleissaahmed, the Saudi

25

Minister of Education. ABOUAMMO explained that he was asking on behalf of "King Salman's team"

26

and it would be great if she could escalate it.

\

27
28

49.

On December 31, 2015, ABOUAMMO created a limited liability company, CYRCL,

LLC and registered it with the State of Washington. On the same day, ABOUAMMO received an
AFFIDAVIT OF FBI SA LETITIA WU

11

 1 employer identification number from IRS for CYRCL, LLC. On January 12,2016, ABOUAMMO
2

opened a business checking account at Chase Bank. On January 25, 2016, Foreign Official-l wired

3

$100,000 from the National Commercial Bank in Saudi Arabia to ABOUA,.\1MO's newly opened Chase

4

Bank account.

5
6

On February 5, 2016, ABOUAlVIMO forwarded a verification request to Twitter Support

50.

for the Twitter account @saudiarabia and stated that it will be used by "the King's team."

7 ABOUAMMO then received two calls from Foreign Official-Ion
8

February 16,2016 (42 seconds and 8

seconds). Then on March 1,2016, ABOUAMMO received an email from Twitter Support confirming

9 he had requested verification of the another Twitter account, which was used by the Saudi Ambassador
10 to Iraq. ABOUAMMO followed-up with an email to someone in Twitter Support stating that the
11 request was on behalf of his "old partners in the Saudi Government."

Five days later, Foreign Official-l

12 called ABOUAMMO (2 minutes and 29 seconds).
13
D.

FBI Interview of ABOUAMMO, and ABOUAMMO's False Statements and Documents
Emailed to FBI

51.

On October 20,2018, I traveled to Seattle, Washington to interview ABOUAMMO at his

14
15

16 residence about his receipt of the watch and his communications with Foreign Official-l and others. I
17 identified myself as an agent of the FBI in Palo Alto, California and that I was conducting an
18 investigation there.
19
20

During the course of that interview, as set forth in detail herein, ABOUAMMO

52.

communicated, in substance and in part, the following information:

21

a.

ABOUAMMO stated that he looked at the details of the User-1 account after
receiving an email from Foreign Official-l about that account;

b.

ABOUAMMO stated that he met with Foreign Official-l in London and
received a watch from Foreign Official-I, but described it as "plasticky" and
'junky" and valued it at $500;

c.

ABOUAMMO stated that he only received a $100,000 USD wire from Foreign
Official-I, which ABOUAMMO stated was payment for consulting and media
strategy work; and

d.

ABOUAMMO showed me communications with Foreign Official-l conducted
over Twitter direct messages; one of the messages contained an embedded

22
23
24
25

26
27
28

AFFIDAVIT OF FBI SA LETITIA WU

I

12

 photograph of a wire transfer receipt for $100,000 USD from Foreign Official-l
to ABOUAMMO's relative in Lebanon on July 9, 2015. Immediately after
showing FBI the wire transfer receipt, I observed ABOUAMMO delete the direct
message from his phone.

1
2
3
4

53.

Based on the information above, I believe that ABOUAMMO made false statements to

5 the FBI about the type and value of the watch he received from Foreign Official-l.
6

ABOUAMMO

stated that the watch was worth $500 and was a "Halo" watch, when in reality the watch was a Hublot

7 watch that ABOUAMMO had tried to sell for at least $20,000. ABOUAMMO further stated that he had
8 received $100,000 from Foreign Official-I, when in reality he had received at least $300,000 from him.

9

54.

On October 20,2018, during and following the interview, ABOUAMMO produced

10 several documents to the FBI, one of which was created or altered by ABOUAMMO during the
11 interview in order to corroborate his statements after the interview had begun. ABOUAMMO claimed
12 that he created a consulting company, identified as CYRCL, LLC, and that he consulted for Foreign
13 Official-l in 2015 after he left Twitter. ABOUAMMO stated that he received a payment of$100,000
14 for one year of consultancy. During the interview, ABOUAMMO offered to obtain a copy of the
15 consulting contract from a desktop computer that he claimed was in his bedroom, and requested that the
16 Agents not follow him to the bedroom. A few minutes later, ABOUAMMO emailed an undated invoice
17 to the email address of a Palo Alto, California based FBI Special Agent.
18

55.

I believe that ABOUAMMO created the invoice in his residence on a computer while

19 Agents were waiting for ABOUAMMO to provide them with the invoice that was discussed. The
20

address on the invoice for services ABOUAMMO said were rendered in 2015 and 2016 was

21

ABOUAMMO's current address, however, public records show that the property was built in 2017 and

22

ABOUAMMO did not purchase it until August 2017, and the metadata properties associated with the

23

file emailed to the FBI indicates that the file was created on the date of the interview (i.e., October 20,

24

2018). Another invoice ABOUAMMO voluntarily provided the FBI to corroborate the existence of his

25

business showed a file creation date several months prior to the interview.

26

II

27
28
AFFIDAVIT OF FBI SA LETITIA WU

13

 E.

ALZABARAH's Contact With ALMUTAIRI Starting From February 2015 Through
May 2015

2

56.

ALMUTAIRI acted as an intermediary between ALZABARAH and Foreign Official-I.

3

57.

On or around February 16,2015, while he was employed by Twitter, ALZABARAH

1

4 received a telephone call from ALMUT AIRI. ALZABARAH and ALMUTAIRI spoke for
5 approximately 15 minutes. Approximately three days later, on or about February 19,2015,
6 ALZABARAH sent his curriculum vitae to ALMUT AIRI via email. ALMUT AIRI acknowledged
7 receipt the next day, on or about February 20,2015.

Also on or about February 20,2015, ALMUTAIRI

8 posted a photograph of himself and ALZABARAH on ALMUTAIRI's Twitter account. Accompanying
9 the posted photograph, ALMUT AIRI commented about being honored to have had dinner with his
10 friend ALZABARAH the previous day. ALMUT AIRI also commented that ALZABARAH was the
11 only Saudi Arabian who worked at Twitter. As further examples of ALZABARAH' s contact with
12 ALMUTAIRI, in or about March 2015, ALMUTAIRI asked ALZABARAH about the process of
13 Twitter verifying user accounts as authentic.
14

58.

On or about May 12,2015, Foreign Official-l traveled from Saudi Arabia to Washington,

15 D.C., as part of an official delegation from the Kingdom of Saudi Arabia.
16

59.

On or around May 13,2015, the day after Foreign Official-l arrived in the United States,

17 ALZABARAH made plans to travel to meet Foreign Official-l in Washington, D.C. Among other
18 things, in Apple iMessages found on ALZABARAH's Twitter-owned laptop, ALZABARAH explained
19 the purpose of his trip to his wife:
20
21

22
23

24
25
26

Okay, there is an important subject I would like to talk to you about. I am
traveling to Washington at the request of the office of [Royal Family
Member-I]. At ten 0' clock tonight and I return tomorrow at ten 0' clock at
night.
ALZABARAH also explained:
[ALMUT AIRI] called me. He said he was in Washington and told them
about me and everything about me and they said 'we would like to meet
with him wherever he is right now,' and that is the Director of the private
office of [Royal Family Member-I].

27

28
AFFIDAVIT OF FBI SA LETITIA WU

14

 1
2

60.

By May 2015, Foreign Official-l was an employee of the Saudi Arabian Royal Court.

He was the Director ofthe private office of Royal Family Member-l and the Secretary General for two

3 charitable organizations for Royal Family Member-I.
4

That same day, ALZABARAH purchased an

airline ticket to the Washington, D.C., area. Based on airline records and other evidence obtained

5 through legal process, ALZABARAH planned to stay, and did in fact stay, in the Washington, D.C.,
6 area for less than 12 hours on May 14,2015,
7

61.

Evidence obtained by the FBI indicates that ALZABARAH communicated with

8 representatives of the KSA during his visit to Washington, DC. Specifically, evidence obtained by the
9 FBI shows the following (all times Eastern):
10

a.

Shortly after landing at Dulles Airport in the Washington, D.C.-area,
ALZABARAH made contact with ALMUTAIRI. Specifically, ALZABARAH
called ALMUTAIRI at approximately 8:53 a.m. (11 seconds), and ALMUTAIRI
called ALZABARAH at approximately 9:06 a.m. (58 seconds).

b.

From the airport, ALZABARAH took a cab to a residence in Fairfax, Virginia,
arriving at approximately 9:31 a.m. Open source databases and Department of
State visa records indicate the residence was leased by an employee of the Saudi
Ministry of Interior at the Embassy of the Kingdom of Saudi Arabia in
Washington, D.C. (the "Fairfax Address")

c.

Upon arriving at the Fairfax Address, ALMUTAIRI called ALZABARAH at
approximately 9:32 a.m. (28 seconds) and at approximately 9:34 a.m. (no
answer).

d.

Several hours later, ALMUTAIRI called ALZABARAH at approximately 1:38
p.m. (26 seconds) and again at approximately 2:22 p.m. (10 seconds).

e.

At approximately 4:40 p.m., ALMUTAIRI scheduled a trip with a ride hailing
service that terminated at the intersection adjacent to the Fairfax Residence,
arriving at approximately 4:42 p.m.

f.

At approximately 4:42 p.m., ALZABARAH scheduled a trip with the same ride
hailing service and with the same named driver used by ALMUT AIRI.
ALZABARAH travelled from the Fairfax Address to Dulles Airport.

g.

At approximately 7:59 p.m., ALZABARAH boarded a flight at Dulles Airport
and returned to San Francisco that evening.

11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

AFFIDAVIT OF FBI SA LETITIA WU

15

 1

62.

During ALZABARAH's trip to Washington, D.C., ALMUTAIRI, who had travelled

2

from San Francisco to Washington, D.C. on May 12, was staying at rental lodging adjacent to a hotel in

3

Washington, D.C., which Foreign Official-l specified as his intended lodging. Additionally, on or about

4

May 13,2015, the day before ALZABARAH travelled to Washington, D.C., ALMUTAIRI posted a

5 pq.otograph of himself with Royal Family Member-I, for whom Foreign Official-1 worked. In the
6

caption for the posting, ALMUTAIRI wrote that it was an honor for him to meet with Royal Family

7 Member-l in Washington. Based on non-content phone records, from on or about May 6,2015, through
8 on or about May 24,2015, ALMUTAIRI exchanged at least 10 telephone contacts with Foreign
9

Official-I.

10

F.

ALZABARAH's Unauthorized Access of Private Twitter User Data and Continued
Contact with ALMUTAIRI and Foreign Official-l

63.

Within one week of returning to San Francisco, ALZABARAH began to access without

11

12

13 authorization private data of Twitter users en masse. Specifically, although ALZABARAH had not
14 accessed the private user data of any Twitter Accounts since February 24,2015, starting on May 21,
15 2015, through November 18,2015, ALZABARAH accessed without authorization through Twitter's
16 computer systems the Twitter user data of over 6,000 Twitter users, including at least 33 usernames for
17 which Saudi Arabian law enforcement had submitted emergency disclosure requests to Twitter. A
18 Twitter Security Engineer informed the FBI that, although ALZABARAH may have had grandfathered
19 access to view user information through an internal Twitter tool called "Profile Viewer," ALZABARAH
20

had no legitimate business purpose as a Site Reliability Engineer to access user accounts.

21

ALZABARAH's job was to help keep the site up and running, which did not involve accessing

22

individual user accounts.

23

64.

On May 21,2015, ALZABARAH first accessed through Twitter's computer systems the

24

Twitter user data of Twitter User-l at approximately 3:17 p.m. On May 21,2015, Twitter User-l shared

25

a public Twitter relating to the Royal Family. That same day, Foreign Official-l asserted publicly

26

through Twitter that Twitter User-l 's posting was false, and ALMUTAIRI and ALZABARAH

27

exchanged 3 telephone contacts, including one call lasting approximately 21 minutes at approximately

28

7:30 p.m., which was approximately four hours after ALZABARAH accessed Twitter User-l 's data.
AFFIDAVIT OF FBI SA LETITIA WU

16

 1 ALZABARAH accessed Twitter User-1 's account and was able to view his email address, phone
2 number, and IP address. Twitter User-1 's account was the only Twitter account that ALZABARAH
3 accessed through Twitter's computer systems on that day. In total, from May 21 through October 2015,
4

ALZABARAH accessed through Twitter's computer systems Twitter User-l 's account on at least nine

5

separate days. During that time, the Kingdom of Saudi Arabia made no emergency disclosure requests

6 to Twitter regarding Twitter User-1 's account.
7

After his l2-hour visit to Washington, D.C., on May 14,2015, ALZABARAH's

65.

phone

8 records, which were obtained by the FBI through legal process, also show that he began having direct
9

contact with Foreign Official-I. ALZABARAH accessed private Twitter user data on May 21,2015, the

10 same day that ALZABARAH had telephone contact with ALMUT AIRI. ALZABARAH next accessed
11 private Twitter user data on May 29,2015, close in time with his telephone exchanges with Foreign
12 Official-I.

Specifically, the investigation has identified the following activities on May 29,2015:

13
14
15
16

Approximate
Time
(pacific)

Foreign Official-l
Communications With
ALZABARAH

ALZABARAH's Access of Private User Data of
Twitter Accounts
Twitter User-3 (email andIPaddress).This
account is
now closed, but the FBI Google search for that
account show that it is in Arabic and had posted
pictures of an improvised explosive device.

8:34 a.m.

17
18

8:38 a.m.

ALZABARAH called
Foreign Official-l (2:37).

19

9:17 a.m.

ALZABARAH called
Foreign Official-l (2:48).

20

9:18 a.m.

21

9:26 a.m.

22

9:27 a.m.

Twitter User-3 (email and IP address).
Foreign Official-l called
ALZABARAH (3:38).
Twitter User-4 (email and IP address). The account is
now deactivated (i.e., closed).

23
24

Later the same day, the Kingdom of Saudi Arabia submitted emergency disclosure requests for

25

information regarding both Twitter User-3 and Twitter User-4, which Twitter granted.

26
27

66.

Through a court-approved search of ALZABARAH' s Apple ID account, the FBI found

an Apple Note that had been last modified on June 7, 2015 (initially created on May 12,2015).

That

28
AFFIDA VII OF FBI SA LETITIA WU

17

 1 note stated in Arabic, "[an honorific term for Foreign Official-I,] I would like to ask your advice and
2

opinion regarding an issue. I just saw the announcement the ministry made regarding rewards. Do you

3 think it applies to us? What do you advise? Should we ask them?" In this statement, I believe that
4 ALZABARAH wanted to inquire about potentially receiving some of the announced reward money in
5

exchange for the information that he had accessed for and provided to Foreign Official-I.

Several days

6

earlier, on June 3, 2015, a U.S. based news outlet reported that Saudi Arabia offered a $1.9 million

7 reward (5 million Saudi Riyals) for information that would avert future terrorist attacks.
8
9

67.

ALZABARAH had access to information that was more detailed than the information

Twitter did or would have disclosed to KSA in response to emergency disclosure requests. For example,

10 ALZABARAH also had access to all recent IP address information, device used, user-provided
11 biographical information, logs that contained the user's browser information, and a log of all of a
12 particular user's actions on the Twitter platform at any given time.
13

68.

ALZABARAH continued this conduct into the subsequent months. During June 2015,

14 ALZABARAH accessed without authorization through Twitter's computer systems the Twitter user data
15 of approximately 5,726 Twitter users, including Twitter U ser-l 's account.
16

69.

On June 6,2015, between approximately 12:20 p.m. and 12:50 p.m. Pacific [7:20 p.m.

17 and 7:50 p.m. UTC], ALZABARAH accessed without authorization through Twitter's computer
18 systems the Twitter user data (email andIPaddress)offourspecificaccounts:TwitterUser-5.Twitter
19 User-6, TwitterUser-7, and TwitterUser-8.
20

70.

A court-authorized search of Foreign Official-l 's email account revealed that on the same

21

day, June 6, 2015, at approximately 5:33 p.m. Pacific [12:33 a.m. UTC on June 7], Foreign Official-l

22

saved a note in his email account with information about these same four Twitter users. Specifically, the

23

note in Arabic stated:

24

[Twitter User-5:]

25

[a]s far as I can tell his name is [redacted], he's about 22, and the IP is [redacted]. Last
logged in on 06/06/2015 at 16:57 UTC. Using an iPhone.

26
[Twitter User-6:]
27
Is not in Saudi Arabia; he goes back and forth between Turkey and Iraq.
28
AFFIDAVIT OF FBI SA LETITIA WU

18

 [Twitter User-7:]

1
2

He is in Turkey and has a friend, or something, and they use the same Michigan State
University account.

3

[Twitter User-8:]

4

This one is a professional. He's a Saudi that uses encryption by a British named
VolterlFolter [phonetic spelling]. He signed up for the service but he does his own
encryption. We tracked him and found that 12 days ago he signed in once without
encryption from IP [redacted] at 18:40 UTe on 05/25/2015. This one does not use a cell
phone at all, just a browser. He's online right using Firefox form a windows machine.

5
6
7
8

71.

The FBI obtained records from Twitter relating to any emergency disclosure requests

submitted by Saudi Arabian law enforcement for the four accounts listed above. Twitter records
9
10

showed:
a.

Twitter User-5: Saudi Arabian law enforcement submitted an emergency
disclosure request on June 4, 2015, and Twitter granted the request on the same
day. This was two days before ALZABARAH accessed information on Twitter
User-5 and Foreign Official-l updated his notes with information on Twitter
User-5.

b.

Twitter User-6: There are no records of any emergency d~sclosure requests
between at least May 1,2015 through February 16, 2016.

c.

Twitter User-7: There are no records of any emergency disclosure requests
between at least May 1,2015 through February 16,2016.

d.

Twitter User-8: Saudi Arabian law enforcement submitted an emergency
disclosure request on May 30, 2015 and Twitter granted the request on the same
day.

11
12
13
14
15
16
17
18
19
20

72.

Based on a review of the evidence, the information found in Foreign Official-l 's email

21

account related to the "last access" by Twitter User-5 (i.e., June 6, 2015 at 4:57 p.m. UTe) was not

22

provided by Twitter through the emergency disclosure request response sent on June 5, 2015 at

23

approximately 12:41 a.m. UTe. The "last access" date and time of Twitter User-5 post-dates Twitter's

24

response to the emergency disclosure request. Likewise, the information found in Foreign Official-l 's

25

email account related to Twitter User-6 and Twitter User-7 was not provided by Twitter through an

26

emergency disclosure request because no such request was granted.

27
28

73.

Twitter's standard data production for emergency disclosure requests includes the

account file, the creation IP file, device file, and 48 hours of session IPs, which are frniher described as:
AFFIDAVIT OF FBI SA LETITIA WU

19

 •

1

Account File: account ID number, date and time of account creation, last modified

2

date, user's email address, application used to create the account, user name and time

3

zone (if specified by user);

4

•

Creation IP File: contains the IP and timestamp associated with the account creation;

5

•

Device File: date/time device is registered, date/time device is modified, type of
device, phone carrier, and verified phone number;

6
•

7
74.

8

IP Audit: account ID number, date/time of login, and IP address for login.

On June 14,2015, Foreign Official-l called ALZABARAH at approximately 12:57 p.m.

9 Pacific (unanswered); at approximately 1:17 p.m. (unanswered), and at approximately 1:58 p.m. (7
10 minutes 16 seconds). That same day, between approximately 11 :51 a.m. and 11 :25 p.m. Pacific,
11 ALZABARAH accessed without authorization the private user data of approximately 5,502 Twitter
12 users, including possibly using bulk searches in Twitter's internal databases.
13

75.

On June 18,2015, at approximately 5:00 p.m., Foreign Official-l called ALZABARAH

14 (25 seconds).
15

76.

Twitter User-9 is a well-known and influential critic of the government and Royal Family

16 of Saudi Arabia with asylum in Canada. On June 19,2015, and July 5, 2015, ALZABARAH accessed
17 Twitter User-9's account and was able to view the user's account information.
18

77.

Based on Customs and Border Protection records, ALZABARAH flew from the United

19 States to Saudi Arabia on July 11,2015, and returned on August 14,2015. ALZABARAH reported this
20

absence to Twitter, and Twitter approved ALZABARAH's personal leave from July 13 to August 11,

21

2015.

22

78.

During ALZABARAH's personal leave and concurrent with his travel to Saudi Arabia,

23

he continued to access the private user data of numerous Twitter users, including Twitter User-1 and

24

Twitter User-5. On July 18,2015, one day after Twitter granted emergency disclosure requests made by

25

Saudi Arabian law enforcement for Twitter User-10, Twitter User-II, and Twitter User-12,

26

ALZABARAH accessed user information for those three accounts.

27
28

79.

Additionally, on July 18, 2015, while on personal leave in Saudi Arabia, ALZABARAH

created and modified another Apple Note, which contains further notes of ALZABARAH contemplating
AFFIDAVIT OF FBI SA LETITIA WU

20

 1 rewards and credit in exchange for the information that he had accessed for and provided to Foreign
2

Official-I.

Specifically, ALZABARAH's Apple Note, which the FBI found in the search of

3 ALZABARAH's Apple ID account, stated the following bullet points in Arabic:
4

•

My situation there, where am I, and how is this going to affect me?

5

•

Huge mistake today, I feel that we were not included. I need to know who they are
and why they are in charge of us. If something happens to him ... 1 don't know
anyone. I want to communicate directly. I feel that they are showing off. What is this?

•

We served them and they didn't give us any credit at all. They took credit for the
subject. As happened 11 years ago. Those sirting we give it to them [sic] this is scary,
save us all from great things [sic]. Only you and I know this is grave injustice towards
me and him. The issue is not purely financial, the issue is moral, honorary [UI], and
credit.

•

I would like to improve in the lacking areas via the [charitable organization run by
Foreign Official-I]. I would like to become a member in it by any means or take
training classes in leadership and business administration.

•

Father's matter is trivial and I was expecting help at least for what we did for
them ... Now they know the issue, a phone call to the man in charge and the problem
is solved.

•

I want a permanent position ... something that secures my future and my family's,
strengthens my relationship with them, and [makes me] feel reassured.

•

I need a phone, laptop, credit card, and 4G. How to connect as fast as possible [to the
Internet] should I need to? To whom can I speak?

17

•

A weekly meeting or bi-weekly to check-in and such.

18

[... ]

19

•

6
7
8
9
10
11
12
13
14
15
16

20

80.

The subject of taxes and how I had problems with it.

Based on a review of the Security Set Identifiers (a sequence of characters that uniquely

21

names a wireless local area network) identified in a court-approved search of ALZABARAH' s Twitter-

22

issued computer, ALZABARAH used his Twitter laptop to connect to networks of ALMUTAIRl's

2".)

company in Saudi Arabia on July 29 and 30, 2015, during this period of personal leave.

24

25

81.

After returning to the United States, Foreign Official-l continued to communicate with

ALZABARAH, and ALZABARAH continued to access Twitter User-l 's private account data. For

26 example, on August 20,2015, Foreign Official-l called ALZABARAH at approximately 12:06 p.m.
27

Pacific (3 seconds), and ALZABARAH returned Foreign Official-l's

call at approximately 12:12 p.m.

28
AFFIDAVIT OF FBI SA LETITIA WU

21

 1 (56 seconds). Later that day, ALZABARAH accessed without authorization through Twitter's computer
2

systems the Twitter user data of Twitter User-l from approximately 8:46 p.m. until 8:52 p.m. Pacific.

3 ALZABARAH accessed eleven other Twitter users' accounts on the same day, including the accounts of
4
5

a possible critic of Saudi Arabia, the King of Saudi Arabia, and ABOUAMMO.
82.

Similarly, in September 2015, Foreign Official-l called ALZABARAH on September 8,

6 2015, at approximately 8:01 p.m. Pacific (5 minutes). Later that same month, ALZABARAH accessed
7 without authorization through Twitter's computer systems the Twitter user data of Twitter User-.l on
8

September 27 and 28,2015, which was the day before and the day that Twitter User-l 's Twitter account

9 was reported "hacked," which Twitter confirmed when Twitter User-l filed a formal complaint. The
10 "hacking" was claimed in online postings, and Twitter responded to U ser-l 's· complaint stating that the
11 account appeared to have been compromised.
12

83.

The FBI's search of ALZABARAH's Apple ID account shows that, on November 5,

13 2015, between approximately 12:11 a.m. and 12:18 a.m. Pacific, ALZABARAH created another Apple
14 Note that stated in Arabic in relevant part, "Today, I became officially a member of the technical team at
15 Twitter. This is the fifth tier out of six for engineers in companies in the Silicon Valley ... My happiness
16 is unimaginable and wanted to share with you the good news ... [Foreign Official-I] thank you for
17 supporting me and for everything ... As much as I am happy for the position, I am happier with and very
18 proud of my work with you. As per your previous advice, I will not announce the news via my Twitter
19 account unless you give me your permission. May God keep you safe!"
20

G.

Twitter's Confrontation of ALZABARAH, and ALZABARAH's Flight to Saudi Arabia

21

84.

Immediately after Twitter confronted ALZABARAH about his access of user data,

22

ALZABARAH contacted ALMUT AIRl and another individual, identified here as Associate-I, to assist

23

him in fleeing the United States by the next day.

24

85.

On or about December 2,2015, Twitter confronted ALZABARAH regarding his

25

unauthorized access of private data of Twitter users. ALZABARAH admitted to accessing user account

26

information without authorization, but stated that he did so simply out of curiosity. ALZABARAH

27

expressed his concern about both his employment and the status of his work visa, which Twitter had

28
AFFIDAVIT OF FBI SA LETITIA WU

22

 1 sponsored. Twitter placed ALZABARAH on administrative leave, seized his Twitter-owned laptop
2
3
4

computer, and escorted him from the building.
86.

At approximately 4:29 p.m., ALZABARAH left the Twitter building. As he drove to his

apartment residence in San Bruno, California, ALZABARAH called ALMUT AIRl at approximately

5 4:30 p.m. Phone records indicate this call was unanswered. Shortly after arriving at his residence,
6 ALZABARAH also called (3 seconds) Associate-1 at approximately 5: 17 p.m. While at his apartment
7

complex that day, ALZABARAH visited the leasing office and told an assistant manager there that he

8 was unsure of his visa status because he had been laid-off from Twitter. ALZABARAH stated he was
9 going to try to find another job, but he may get deported.
10

87.

Next, based on the FBI's contemporaneous observations of ALZABARAH and the FBI's

11 investigation afterwards, including obtaining phone records, the following occurred:
12
13

Approximate
Time (Pacific)

14

7:18 p.m.

15
16

7:20p.m.

17
7:22 p.m.
18
19

7:31 p.m.

20

7:48 p.m.

21

7:58 p.m.

22
23

8:03 p.m.

24

8:05 p.m.

25

8:09 p.m.

26

8:30 p.m.

27
8:38 p.m.
28

Events of December 2, 2015

.~~

ALZABARAH met outside his residence Associate-I, who was driving
a white sport-utility vehicle. ALZABARAH entered Associate-l's
vehicle" and Associate-1 proceeded to drive around the area.
While Associate-l drove with ALZABARAH around ALZABARAH's
residence, Associate-l's cellular telephone called (8 seconds) Foreign
Official-l's Saudi Arabian cellular telephone.
Associate-l's cellular telephone called (unanswered) Foreign Officiall's Saudi Arabian cellular telephone.
Associate-l's cellular telephone called (unanswered) Foreign Officiall' s Saudi Arabian cellular telephone.
Associate-1 returned ALZABARAH to his residence, and Associate-l
departed the area in the vehicle.
Foreign Official-l's Saudi Arabian cellular telephone called the Saudi
Arabian Consul General in Los Angeles (unanswered), and the Consul
General returned the call at 8:03 p.m. (unanswered).
Foreign Official-l 's Saudi Arabian cellular telephone called (8 seconds)
Associate-I' s cellular telephone.
Foreign Official-l 's Saudi Arabian cellular telephone called (3 minutes
48 seconds) the Saudi Arabian Consul General in Los Angeles.
Foreign Official-l 's Saudi Arabian cellular telephone called (5 seconds)
Associate-l's cellular telephone.
ALZABARAH called (unanswered) the Saudi Arabian Consul General
in Los Angeles.
Associate-l called (3 minutes, 48 seconds) the Saudi Arabian Consul
General in Los Angeles.

AFFIDAVIT OF FBI SA LETITIA WU

23

 1

9:26 p.m.

2

12:21 a.m.
(Dec. 3,2015)

ALZABARAH called (unanswered) the Saudi Arabian Consul General
in Los Angeles from his Saudi cellular telephone.
The Saudi Arabian Consul General in Los Angeles called (3 minutes, 1
second) ALZABARAH on his Saudi cellular telephone.

3
4

88.

The day after, on or about December 3,2015, at approximately 7:00 a.m. Pacific,

5 ALZABARAH, his wife, and his daughter boarded a flight at the San Francisco International Airport
6 and flew (connecting through the Los Angeles International Airport) to Saudi Arabia. During the
7 connection at the Los Angeles International Airport (ALZABARAH arrived in Los Angeles at
8 approximately 8:32 a.m. and departed at approximately 3:00 p.m.), ALZABARAH and Associate-l
9

exchanged three telephone contacts - one text message at approximately 8:31 a.m., one call (1 minute, 8

10 seconds) at approximately 9:00 a.m., and one call (15 seconds) at approximately 12:16 p.m. Also during
11 ALZABARAH's layover in Los Angeles, ALZABARAH's

Saudi cellular telephone and the Saudi

12 Arabian Consul General in Los Angeles exchanged three telephonic contacts - one call from
13 ALZABARAH at approximately 9:56 a.m. (8 seconds), one call to ALZABARAH at approximately
14

10:40 a.m. (2 minutes) and one call to ALZABARAH at approximately 11:39 a.m. (1 minute 30

15 seconds).
16

89.

Between the time that ALZABARAH left the Twitter building on December 2,2015, and

17 his departure from San Francisco at approximately 7:00 am on December 3, 2015, ALZABARAH'_s
18 telephone records for his U. S. cellular phone indicate contact with only ALMUT AIRl, Associate-I, the
19 Saudi Arabian Consul General in Los Angeles, ALZABARAH's wife, his Twitter supervisor, one other
20
21

Twitter employee, Wells Fargo Bank, U.S. Bank, and an Uber driver.
90.

On December 3, 2015 at approximately 11:38 p.m. Pacific, Twitter received an email

22

from ALZABARAH stating that he was resigning from his employment at the company. Based on

23

flight records, this email was transmitted while ALZABARAH was in the air.

24

H.

ALZABARAH's Continued Work for Officials of The Kingdom of Saudi Arabia

25

91.

Within one month of arriving in Saudi Arabia, emails show that ALZABARAH began

26

using an email address at a charitable foundation where Foreign Official-l is the Secretary General. In

27

particular, emails sent to and from ALZABARAH's charitable foundation account show him working

28

with ALMUTAIRl and several others, on a team to monitor and manipulate social media under Foreign
AFFIDAVIT OF FBI SA LETITIA WU

24

 1 Official-I' s leadership and for the benefit of the Kingdom of Saudi Arabia. In March 2016,
2

ALZABARAH emailed the "team," which included ALMUTAIRl and Foreign Official-I, and stated

3 that he had established a private website and virtual private network for them to use. ALZABARAH
4 'Yas working in that capacity continuously through at least June 2016.
5

92.

ALZABARAH has submitted several visa applications to return to the United States in

6 which he has disclosed, among other things, employment by the Royal Family and Organization No. 1
7

and listing Foreign Official-l as his point of contact.

8

93.

As of May 9, 2019, ALZABARAH has a valid BI/B2 visa but has not yet returned to the

9 United States.
10 V.

CONCLUSION

11

94.

Based on the foregoing, there is probable cause to believe that Ahmad ABOUAMMO,

12 Ali ALZABARAH and Ahmed ALMUTAIRl acted in the United States as agents of the Kingdom of
13 Saudi Arabia without prior notification to the Attorney General, as required by law, in violation of 18
14 U.S.c. § 951. There is further probable cause that Ahmad ABOUAMMO knowingly falsified and
15 transmitted to agents of the FBI a falsified invoice in order to obstruct a pending federal criminal
16 investigation, in violation of 18 U.S.C. § 1519.
17

95.

Accordingly, I request the Court to issue the attached Criminal Complaint and Arrest

18 Warrants.
19
20

II

21
22

II

23
24

II

25
26 II
27
28

II
AFFIDAVIT OF FBI SA LETITIA WU

25

 1 VI.

SEALING REQUEST

2

96.

Since this investigation is ongoing, disclosure of the complaint and this affidavit may

3 jeopardize the progress of the investigation, result in the destruction of evidence, intimidation or
4

collusion of witnesses, or the flight of a defendant. Accordingly, I request that the Court issue an order

5 that the complaint, this affidavit in support, and any attachments thereto, along with the order itself, be
6 filed under seal until further order of the Court.
7

I declare under penalty of perjury that the above is true and correct to the best of my knowledge

8 andbelief.

~

9
10

LetitiaL.WU
Special Agent
Federal Bureau of Investigation

11
12

13
14

Sworn to and subscribed before me
this S~... day of November, 2019.

('\~

15 THE HONORABLE THOMAS S. H
16

UNITED STATES MAGISTRATE

ON
GE

17
18
19
20

21
22
23
24
25
26
27
28
AFFIDAVIT OF FBI SA LETITIA WU

26