A0 91 (Rev. mu) Criminal Complaint UNITED STATES DISTRICT Noses AL Northern District of California United States of America v. AHMAD AHMED ALMUTAIRL a?da AHMED and ALI ALZABARAH, Case No. NOV 52 - . 0&5 803A 979 3 1 9 in"? 1 %g 4 ?Ridge? 5300429 OF 000 De?ndani?s') RT CRMAL COMPLAINT I, the complainant in this case, state that the following is true to the best .ofmy knowledge and belief. On or about the date(s) of 1 1120l2014 to' 10/20/2018 - in the county of San Francisco in the Northern District of California the defendant'(s) violated: Code Section O?me Description 18 U.S.C. 951; Acting as Agent of Foreign Government Without Notice to Attorney General; and and 18 U.S.C. 1519 Destruction, Alteration, or Falsi?ca?on of Records in Federal Investigations This criminal complaint is based on these facts: See attached af?davit Con?nued on the attached sheet. Compininant?ignaiure Letitia Wu, Special Agent, FBI Printed name and ri?e Sworn to before me and signed in my presence. I Date: he} (oft/l Q4 Judge is sign-at?ure San Francisco, California Hon. Thomas S. Hixson, U.S. MagistratL Judge City and state: Printed name and ri?e. i?l mummewwa?omasaGESEI-TS I, Letitia .L. Wu, a Special Agent with the Federal Bureau of. Investigation in Palo Alto, California, being ?rst duly sworn, hereby depose and state the following: I. PURPOSE OF AFFIDAVIT AND CRIMINAL CHARGES 1. I submit this a?davit in support of a Criminal Complaint that charges defendants Ali ALZABARAH, Ahmed ALMUTAIRI, also known as Ahmed Aljbreen, and Ahmad ABOUAMIVIO with violations of 18 951 and udth a Violation of 18 U.S.C. 151.9. 2. Speci?cally, ??om at least in or about November 20, 2014-, up to and including in or about May 24, 2015, in the Northern District of Galjfornia and elsewhere, ALMUTAIRI, the defendant, did knowingly act in the United. States as an agent of a foreign government, speci?cally, ALMUTAIRI acted within the United States under the direction and control. of the Kingdom of Saudi Arabia and foreign of?cials Working on behalf of the Kingdom of Saudi Arabia, without prior noti?cation to the Attorney General, as required by 1aw,in violation of 18 USC. 951. 3. Beginning no later than December 12, 2014, until at least March 12, 2015, in the Northern District of California and elsewhere, the defendant, did knowingly act in the United States as an agent of a foreign government, speci?cally, ABOUAMMO acted within the United States under the direction and control of the Kingdom of Saudi Arabia and foreign o?icials working on behalf of the Kingdom of Saudi Arabia, without prior noti?cation to the Attorney General, as required bylaw, in violation of 18 951. 4. Further, beginning at least in or about May 21, 2015, up to and including in or about December 2015, in the Northern District of California and elsewhere, ALZABARAH, the defendant, did knowingly act in the United States as an agent of a foreign government, speci?cally, ALZABARAH acted within the United States under the direction and control of the Kingdom of Saudi Arabia and foreign of?cials working on behalf of the Kingdom of Saudi Arabia, without prior noti?cation'to the Attorney General, as required by law, in Violation of 18 U.S.C. 9.51. 5.. On October 20, 2018, in the Northern District of California and elsewhere, ABOUAMMO, the defendant, unlawfully, intentionally, and knowingly did alter, destroy, mutilate, conceal, and falsify a record or document, namely creating and providing by email to the Federal Bureau of Investigation a fabricated, false, and backdated invoice for $100,000 for consulting services to. AFFIDAVIT OF FBI SA WU 1 Foreign Of?cial?1, from LLC, defendant?s sole proprietorship, With. the intent to impede, obstruct and in?uence an actual or contemplated investigation of a matter within the jurisdiction of a department or agency of the United States, namelythe Federal Bureau of Investigation, in violation of Title 18, United States Code, Section 1519, IL AGENT QUALIFICATIONS 6. I am a Special Agent with the FBI, and have been since July 2015. I am currently assigned to the Counterintelligence Division within the San Francisco Field Of?ce of the FBI. In my capacity as a Special Agent, my duties and the training that I have received include the investigation of violations of federal criminal law, including counterintelligence related offenses and cybercrimes (such as acting as an agent of a foreign government without neti?cation to the Attorney General, economic espionage, theft of trade secrets, and computer fraud and abuse-violations). 7. The facts in this A?idavit come from my personal observations, my training and experience, and information obtained ?om other agents, law enforcement personnel, and witnesses. 8. Unless otherwise noted, wherever in this Af?davit I reco'unt a statement, including written statements made by another person, that statement is recounted in substance and in relevant part. Statements in quotation marks, if. any, are based on preliminary translations or transcriptions, and review of or interpretations of communications, all of which may be subject to revision 9. Unless otherwise stated, all times listed in this Af?davit are Paci?c Time and are approximate times. 10. This af?davit is intended to show merely that there is suf?cient probable cause for the requested warrant and does not set forth all of my knowledge about this matter. 111. BACKGROUND 11. Twitter, Inc. (?Twitter?) is a company headquartered in San Francisco, California, and owns and operates a ?ee-access social-networking website of the same name that. can be accessed at Users of Twitter, including private individuals, journalists, and public ?gures, create user accounts that can be used to communicate and share information instantly through ?Tweets" 1-40?character messages prior to 2017) to the public at large, ?tweets? to. a'subset' of Twitter. users AFFIDAVIT OF FBI SA LETITIA WU 2 . to the public or to certain users that ?follow? a user), ?retweets? by one user of another user, or direct messages that are typically-visible only to the sender and. recipient. 12. Twitter Operates its service in many languages, including English and Arabic. Many Twitter users live in Saudi Arabia and some users of Saudi nationality or descent live outside of Saudi Arabia, including in the United States. Twitter has access to and maintains data about each of its users, and Twitter?s privacy policy outlines the circumstances in which the data maintained by Twitter about its users may be disclosed, sold, or transferred. Twitter eonSiders its user data to be valuable, and uses it for tailoring revenue-generating advertisements to its users, as well as supplying engaging contentand other purposes. i 13.. Title 18, United States Code, Section 2702, provides that service providers of electronic communications and remote computing services, such as Twitter, may Voluntarily disclose user data =to a governmental entity, if the service provider, in good faith, believes than an emergency involving danger of death or serious physical injury to any person requires disclosure without delay of data relating-to the emergency. 14. The Kingdom of Saudi Arabia is a monarchy governed by the Saudi King and his Royal Court, which is akin to a cabinet or executive o?ice. Members of the King?s Royal Family hold most of the country?s important posts. 15. From at least in or about June 2, 2014, up to and including in or about December 3, 2015, a foreign of?cial of the Kingdom of Saudi Arabia who is not identi?ed by name (?Foreign Of?cial?l?) was the secretary general of a charitable organization (?Organization No. of a member of the Saudi Arabian Royal Court (?Royal Family Member?1?). Beginning May 3, 2015', Foreign Official-1 listed his employer on his U.S. visa application as the ?Royal Court.? 16, Ali Hamad ALZABARAH is a citizen of Saudi Arabia and resided in San Bruno, California ?om at least 2014 until December 3, 2015. Funded by a Saudi Arabian scholarship, ALZABARAH entered the United States in 2005 and studied and obtained degrees in computer science from various universities in the United States. From in or about August 2013 to in or around December 20.15, ALZABARAH worked as a site reliability engineer at Twitter in San. Francisco, California. AFFIDAVIT OF FBI SA WU 3 . 17. Ahmad ABOUAMMO is a United States citizen and resided in the Northern District of California ?om at least November 2013 until May 22, 2015, and thereafter resided in Seattle, Washington. ABOUAMMO was an employee of Twitter, Inc. ??om on or about November 3, 2013 to May 22, 2015. ABOUAMMO was a Media Parbrerships Manager responsible for the Middle East and North Africa region at Twitter.- ABOUAMIMO was involved in assisting notable accounts. of public interest, brands, journalists, and celebrities for the MENA region with content, Twitter strategy, and sharing best practices. 13. Ahmed ALMUTAIRI, also known as Ahmed ALIBREEN, is a Saudi citizen. ALMUTAIRI was present in the United States of America between approximately August 21, 2014 until approximately May 24, 2015. From-at least May 2014 to the present, ALMUTAIRI has controlled a Saudi social media marketing company that does work for Organization No. 1 and members of the Saudi Royal Family, including Royal Family Member?1.. ALMUTAIRI traveled to the United States on a student visa in August 2014 for the purpose of studying English in the San Francisco Bay Area. 19. ABOUAMMO and ALZABARAH had access to proprietary and con?dential Twitter information, including information about Twitter users, including the user-provided email addresses, .birthdates, phone number, and internet protocol addresses. 20-. Twitter employees, including ABOUAMIVIO and ALZABARAH, agree to abide by the Twitter ?Playbook? which outlines the policies Twitter employees must ob?eyas part of their employment. Twitter?s 2013 employment contracts with and ALZABARAH, prohibited. them from engaging in outside employment or consulting ?or any'other business activity that would create a con?ict of interest with the Company.? Twitter?s .2013 Employee Invention Assignment and Con?dentiality Agreements with ABOUAMMO and ALZABARAH af?rmed ?a relationship of con?dence and trust? between Twitter and each employee ?with respect to any information of a con?dential or secret nature that may be disclosed to me by the Company or a third party that relates. to the business of the Company? and de?ned ?Proprietary Information? to include ?customer lists and data.? The Employee Invention Assignment and Confidentiality Agreement further required ABOUAMMO and ALZABARAH to ?keep and hold all such Proprietary Information in strict con?dence and trust. I will not use or disclose any Pr0prietary Information without the prior written AFFIDAVIT OF FBI SA LETITIA WU 4 - consent of the Company? and required them during their employment not to ?use[] any Company information for any other business or employmen 21. Twitter?s ?Playbook Acknowledgement,? which ABOUAMMO and ALZABARAH each signed during 2013, stated that each would read, understand, and abide by Twitter?s policies, including the Security Handbook, which de?ned u'ser? data as con?dential data and prohibited sharing con?dential data with third parties without approval. .22. Twitter?s ?Gitt Policy? during ABOUAMMO and employment stated: or gifts exceeding $100 in value, bring the gift to the attention of both your manager and VP of HR before returning to sender.? .23 . Neither nor job duties included a need to access a Twitter user?s private information, and doing so was a reportable violation of the Twitter Playbook policies regarding protecting user data. Since December 2015, Twitter has enhanced its controls and permissions to restrict access to user information only to those whose duties require access. 24. As of November 1, 2019, and ABOUAMMO have not provided noti?cation to the Attorney General that they were acting as an agent of foreign government. IV. SAUDI USE OF ABOUAWO AND ALZABARAH TO PRIVATE TWITTER USER DATA ON BEHALF OF THE KINGDOM OF SAUDI ARABIA A. Contact With AHMED ALMUTAEI and ForeimiO?Ecial-I Starting in June 201-4 and Meeting With Foreign Ot?cial?l in the United States and the United Kingdom 25. Foreign Of?cial-1, on behalf of KSA, began cultivating employees of Twitter in an effort to obtain private user information that it could not obtain elsewhere. 26. In April 2014, according to emails from Twitter, a public relations ?rm representing the Embassy of the Kingdom of Saudi Arabia contacted Twitter and asked for assistance in verifying the Twitter account of a Saudi Arabian news personality. Twitter assigned the task to ABOUAWO. In an email, ABOUAMMO eXplained to the public relations ?rm that he was heading the media partnerships for the LENA region, and part of his job was to work with media partners to share best practices and work on Twitter strategy. ABOUAMMO also asked the public relations ?rm to let him know if they- have any other requests regarding the Saudi government. AFFIDAVIT OF FBI SA LETITIA WU 5 27. On or about May 16, 2014, a representative from the U.S.-Saudi Arabian Business Council in Vienna, VA, emailed ABOUAMMO and asked him to arrange a tour of Tanner?s San Francisco o?ice for a group of Saudi ?entrepreneurs.? ABOUAMMO agreed and coordinated with others at Twitter to schedule the tour for June 13, 2014. A follow?up email informed that the attendees would include Foreign Official?1, who subsequently (in early 2015) became the head of Royal Family Member-1?s private of?ce. On the day of the tour, June 13, 2014, emailed his telephone number to Foreign Of?cial?1. The email subject stated ?contact for abread? and. the body of the message contained only ten?digit personal phone number and his signature block. 28. Also on the day of the tour, Foreign Of?cial-1 emailed ABOUANIMO about verifying the Twitter account of Royal Family Member-1, indicating that Foreign O?ic-?ial?l was working for and at the direction of Royal Family Member-l with respect to his online presence on the Twitter platform. 29. On June 14, 2014, Foreign O?cial-l Emailed ABOUAWO and asked for contact information ABOUAMMO responded by email with his Twitter email address and his personal Skype account, and again provided his personal telephone number. On that date, at appro?rnately 3 :36 pm. Paci?c, toll records show Foreign O?icial?l contacting ABOUAMMO in a telephone call that lasted approximately .1 minute, 47 seconds. Subsequently, on June 15 and 1'7, 2014, Foreign Of?cial?1 emailed ABOUAMMO two photographs one of Foreign Official-1 with ABOUAWO, and another of Foreign Of?cial?1, ABOUAMIMO, and the group of visitors to Twitter on June 13, 2014. 30. In or around late November 2014, Foreign Of?cial-1 and ABOUAWO communicated by telephone and email to coordinate an meeting in London, United Kingdom, in early December 2014. For example, on November 20', 2014, ABOUAMMO emailed Foreign Of?cial-1 through Twitter account and asked if Foreign O?icial?l had ?nalized his trip to London and informed Foreign O?icial?l that he would be in London between December 1, 2014 and December S, 2014. ABOUAWO traveled to London, United Kingdom on November 29, 2014 to attend a Twitter global media summit. AFFJDAVIT OF FBI SA LETITIA WU 31. Around this same time, ABOUAMMO also met with Ahmed ALMUTAIRI, whose company does work for Foreign Official-1?s charitable organization. On November 15, 2014, ALMUTAIRI sent an email to ABOUAMMO requesting an ?urgent meeting" in San Francisco to discuss their ?mutual interest.? ALMUTAIRI explained he was the advisor for a 1?it Degree Member of the Saudi Royal Family.? On November 20, 2014, ALMUTAIRI met in ?'ont of the Twitter of?ce in San. Francisco, California, and posted a photograph of himself with ABOUAMMO on Twitter account. On December 1, 2014, prior to meeting udth Foreign Of?cial-l in London, ALMUTAIRI emailed ABOUAMMO at his Twitter account and stated, ?I?m quite con?dent that by both of us cooperating and werking together, we?ll achieve the goals of Twitter in the region.? 32. Foreign Of?cial-1 emailed ABOUAMMO on December 4, 2014, and stated ?I?m in Paris. I Will come to london tomorrow for one day to meet you on Friday. When I arrive Iwill call you.? The next day, December 5, 2014, Foreign Of?cial-1 contacted ABOUAMMO by telephonein a call that lasted approximately four seconds, and Foreign Of?cial-1 and ABOUAWO met in person in LondOn, United Kingdom. On December 6, 2014, ABOUAMMO returned to San Francisco,- 3-3: As discussed below, I met with ABOUANIMO on October 20, 2018, and ABOUAMMO told me at that time that, while in London, Fereign Of?cial?l gave him a watch. Records obtained by the FBI show that, on or about December 27, 2014, ABOUAMMZO contacted an onlinegconsigmnent' store for luxury watches about a Hublot Unico Big Bang King Gold Ceramic watch. The consignment store offered to sell the watch for $20,000. In January 2015, ABOUAMMO responded to advertisements of potential buyers looking for luxury watches on Craigslistlorg, claiming his watch, whiCh he stated he purchased in London, UK, was worth $35,000 and that he would accept an offer of- no less than $25,000. At the request of the FBI, a United Kingdom law enforcement of?cial visited the. store where ABOUANEMO had claimed in his online communications to have purchased the watch, however, the store informed the law enforcement of?cial that it did not carry or sell the Hublot Unico Big Bang King Gold Ceramic watch. OF FBI SA LETITIA WU 7 \Unauthorized Access of Private Twitter. User Data and Continued Contact With oreisn Of?cial-1 34. Within one week meeting in London with. Foreign'Ofticial?l, ABOUAMMO began accessing private Twitter user information of interest to Foreign Of?cial?1 and the Saudi Royal Family. 35. On December 12, 2014, ABOUMO accessed Twitter User-1?s email address through Twitter?s computer systems. Based on the review of Twitter User?1?s public postings, TWitter User?1 was a prominent critic of the Kingdom of Saudi Arabia and the Royal Family with over 1,000,000 Twitter followers. ABOUAMMO accessed Twitter User?1?s email address again on January 5, 2015, January 27, 2015, February 4, 2015, February 7, 2015, February 18, 2015, and February '24, 20 15-. 36: On or about January 17, 2015, Foreign Of?cial?1 began communicating with ABOUANLMO on personal email in addition to his Twitter email account. On January 17, 2015, Foreign Of?cial-1 emailed ABOUAMMO at personal email and stated only ?as we discussed in london. . Foreign Of?cial-1 attached to the email a document that discussed how Twitter User-l had violated both Twitter policy and Saudi laws. On January 20, 2015, Foreign Official?- 1 called twice (the calls lasting 19 seconds and 51 seconds, respectively). On January 22, 2015, Foreign Of?cial-1 'called ABOUANEMO seven times (no answer, 6 seconds, 5 seconds, '3 seconds, 4 minutes 37 seconds, 3 minutes 36 seconds, and 39 seconds, respectively). also accessed the email address provided. by user @(ingSalman the same day. The handle @King-S almau was the-TLwitter Account for Saudi King Salman bin Abdulaziz Al. Sand. Foreign Of?cial?1 called ABOUAMMO on January 23, 24, and twice On January 25, 2015 (1 minute 57 seconds, no answer, l-mi'nute 57 seconds, and 6 seconds, respectively). On January 27, 2015, ABOUAMMO accessed Twitter User-1? 3 user email address again. The next day, Foreign Of?cial?l called ABOUAMMO three times (11 seconds, 5 seconds, and no anSWer). 37. On February 3, 2015, Foreign Of?cial-1 forwarded ABOUAMMO an email from Twitter Support revealing that Fereign Of?cial?1 ?led a complaint with Twitter against Twitter User?2, who was impersonating a member of the Saudi Royal Family. The email indicated Foreign Of?cial?1 ?led a AFFIDAVIT 0F FBI SA LETITIA WU 8 (coo-cosmereport with Twitter advising he was the representative of'the individual being impersonated by Twitter User-2. Based on the review of the Twitter User?2?s public postings, Twitter User-2 appeared to be a critic of the Kingdom of Saudi Arabia and the Royal Family. Twitter Support requested Foreign Of?cial-1 provide proof that he is authorized to represent the individual. On that same day, close relative residing in Beirut Lebanon, opened 3. Lebanese bank account at the Beshara El?Khoury branch. of Bank Audi in Beirut (?Bank AudiAccount?) and the account later received payments that were later disbursed to account in the United States, discussed below. On February 4, 2015', ABOUAMMO accessed Twitter User-1?s user information. again and was able to view account information, including the email address and telephone number associated with Twitter User-1?s account. According to. a Twitter Security Engineer that FBI interviewed, the amount of information a Twitter employee can view through Twitter computer systems depended on both the user- 'provided information and the level of access of the Twitter employee. 38. On February 5, 2015, Foreign Of?cial-1 emailed at his Twitter account and attached a document w?tten in Arabic and translated with the banner, ?Urgent Report Secret and private? that discussed. tweets by Twitter User?2. On February 7, 2015, ABOUAMMO accessed Twitter User-1?s email address and phone number as well as Twitter User-2?s email address. 39. On February 2015, ABOUANLMO registered the website for LLC at As discussed below, ABOUAMIMO used this limited liability company'to receive $100,000 USD Foreign O??icial-l in 2016. On February 12 and 13-, 2015, Foreign Of?cial-1 called ABOUAIVIMO ?ve times (7 minutes 28 seconds, 1 minute 24 seconds, .2 minutes 10 seconds on February 12, 2015, and 15. and. 17 seconds on February 13, 2015). On February 13-, 2015, Foreign sent a $100,000 wire transfer to close relative Lebanon. 40. On February 16, 2015, Foreign Of?cial?l called three times. Two days later, ABOUAWO accessed Twitter User?1?s email address and phone number. On February 19, 2015, ABOUAMMO created an online user and password to acceSs the Bank Audi Account his close relative opened in Lebanon on February 3, 2015. On February 24, 2015, accessed Twitter User-1?s email address and phone number. On the same day, a $9,963 wire transfer was sent AFFIDAVIT OF FBI SA LET-ITIA WU .. 9 4sfrom the Lebanon Bank Audi Account to Bank of America account ending in 3078 (?Bank of America Account?). 41. On March 5, 2015, Foreign Of?cial-1 called ABOUALMO 11 times. Foreign Of?cial- 1. also called ABOUAMIMO three times on March 6, 2015. On March 8, 2015, ABOUAMIMO sent Foreign O?cial?l a Twitter direct message stating ?proactive and reactively we will delete evil my brother.? On March 12, 2015, a $9,911 wire transfer was sent ?rom the Lebanon Bank Audi Account to Bank of Arnerica Account. 42-. On May 22, 2015, ABOUAMMO resigned from his position at Twitter. In sum, ABOUAMMO accessed Twitter User-1?s email address and phone number between January 5, 2015., and February 24, 2015 and accessed Twitter User?2?s email address on February 7, 2015. Based on infonnation provided by Twitter and former supervisor at Twitter, ABOUAMMO had no legitimate business use as a Media Partnerships Manager for accessing users? account information, and doing so would have been a violation of the company?s policies. C. .ABOUAIVIMO Quits Twitter and Moves to Seattle but Continues Contact With and Accepts MoneLfrom. Foreign O?icial?l Through a Relative?s Foreign Account 43. Even a?er ABOUAIMMO left Twitter, Foreign Of?cial?1 paid. him for services rendered and for continuing to contact Twitter employees on behalf of KSA of?cials. I 44. In late May 2015, ABOUAMMO moved from the. San Francisco Bay Area to Seattle, Washington for a newjob. After ABOUAMMO started his new job, Foreign Of?cial-1 continued to contact him with requests for Twitter to take action on certain user accounts, including requests to shut down certain accounts for violating Twitter?s terms of service and to verify certain omci'al users at Twitter. ABOUANEMO attempted to facilitate Foreign Of?cial?1 ?s requests by contacting his former colleagues at Twitter. .45. While facilitating requests from Foreign Of?cial?1, ABOUAMMO continued to transfer money ?om the Bank Audi Accountto the Bank of America Account. On June 15, 2015, a $10,000 wire transfer was sent ?om the Bank Audi Account to the Bank of America Account which was then used as part of- down payment for his new residence. A July 7, 201.5, a $30,000 wire AFFIDAVIT OF FBI SA LETITIA WU 10 employer identi?cation number ?om IRS for LLC. 011 January 12,. 2016, opened a business checking account at Chase Bank- On January 25, 2016, Foreign Of?cial?1 wired $100,000 from the National Commercial Bank in Saudi Arabia to. newly opened Chase Bank account. 50. On February 5, 20.16, ABOUAMMO forwarded a veri?cation request to Twitter Support 'for the Twitter account @saudiarabia and stated that it will be used by ?the King?s team.? ABOUAMMO then received two calls from Foreign Of?cial-1 on February 16, 2016 (42 seconds and 8 seconds). Then on March 1, 2016, received an email from Twitter Support con?rming he had requested veri?cation of the another Twitter account, which was used by the Saudi Ambassador to Iraq. ABOUAMMO folloWed?up with an email to someone in Twitter Support stating that the request was on behalf of his ?old partners in the Saudi Government.? Five days later, Foreign Of?cial?1 called ABOUAMMO (2 minutes and '29 seconds). D. FBI Interview of ABOUAWO, and False Statements and Documents Emailed to FBI 51. On October 20, 2018, I traveled to Seattle, Washington to interview ABOUAMMO at his residence about his receipt of the watch and his communications with Foreign Of?cial-1 and Others. I identi?ed myself as an agent of the FBI in Palo Alto, California and that I was conducting an investigation there. 52. During the courseof that intendew, as set forth in detail herein, ABOUAIVIMO communicated, in substance and in part, the following information: a. ABOUAIVIMO stated that he looked at the details of the. User-1 account after receiving an email from Foreign Of?cial-1 about that account; b. ABOUAMMO stated that he met with Foreign Of?cial?1 in London and received a watch from Foreign Of?cial-1, but described it as ?plasticky? and ?junky? and'valued it at $5 00; c. ABOUAMMO stated that he only received a $100,000 USD wire from Foreign Of?cial?1, which ABOUAMMO stated was payment fer consulting and. media strategy work; and d. ABOUAMCMO showed me communications with Foreign Of?cial-l conducted over Twitter direct messages; one of the messages contained an embedded AFF 1DAVIT OF FBI SA LETITIA WU 12 samba photograph of a wire transfer receipt fer $100,000 USD from. Foreign Official?1 to relative in Lebanon on July 9, 201.5. Immediately after showing FBI the wire transfer receipt, I observed ABOUWO delete the direct mesSage ??om his phone. 53. Based on the information above, I believe that ABOUAMMO made false statements to the FBI about the type and value of the watch he reCeived from Foreign Of?cial-1. ABOUAMNIO stated that the watch was worth $500 and was a ?Halo? watch, when in reality the watch was a Hublot watch. that ABOUAMMO had tried to sell for at least $20,000. ABOUAMMO further stated that he had received $100,000 from Foreign Of?cial-1, when in reality he had received at least $300,000 from him. 54. On' October 20, 2018, during and following the interview, ABOUAMMO produced several documents?to the FBI, one of Which was created or altered by ABOUALMO during the interview in order to corroborate his 'statentlents after the interview had begun. ABOUAMZMO claimed that he created a Consulting company, identi?ed as LLC, and that he consulted for Foreign O?icialsl in. 2015 after he le? Twitter. ABOUAMNIO stated that he received apayrnent of $100,000 - for one year of consultancy. Daring the interview, ABOUAMMO offered to obtain a copy of the consulting contract ?'om a deskt0p computer that he claimed was in his bedroom, and requested that the Agents not follow him to the bedroom. A few minutes later, ABOUAMMO emailed. an undated invoice to the email address of a Palo Alto, California based FBI Special Agent. 55. I believe that created the invoice in his residence on a computer while Agents were waiting for to provide them with the invoice that was discussed, The address on the invoice for services ABOUAMMO said were rendered in 2015 and 2016 was current address, however, public records show that the property was built in 2017 and ABOUAMMO did not purchase it until August 2017, and the metadata properties associated with the ?le emailed to the FBI indicates that the ?le was created on the date of the interview October 20, 2018). Another invoice ABOUALMO voluntarily provided the FBI to corroborate the existence of his business showed a ?le creation date several months prior to the interview. AFFDDAVIT OF FBI SA LETITIA WU _1_3 Centact With ALMUTAIRI Starting ronh February 2015 Through May. 2015 . 56. ALMUTAIRI acted as an intermediary betWeen ALZABARAH and Foreign Of?cial-1. 57. On or around February 16, 2015-, while he was employed by Twitter, ALZABARAH received a telephone call from ALMUTAIRI, ALZABARAH and ALMUTAIRI spoke. for approximately 15 minutes. Approximately three days later, error about February 19-, 2015, ALZABARAH sent his curriculum vitae to ALMUTAIRI via email. ALMUTAIRI acknowledged receipt the next day, on or about February 20, 2015. Also on Or about February 20, 2015., ALMUTAIRI posted a photograph of himself and ALZABARAH on Twitter account. Accompanying the posted photograph, commented about being honored to have had dinner with his ?iend ALZABARAH the previous day. ALMUTAIRI also commented that ALZABARAH was the only Saudi Arabian who worked at Twitter. As further examples of contact with ALMUTAIRI, in or about March 2015, about the process. of Twitter verifying user accounts as authentic, 58. On or about May 12, 2015, Foreign Of?cial-1 traveled ?om Saudi Arabia to Washington, D.C., as part of an o?cial delegation ?om the Kingdom of Saudi Arabia. 59. On or aroimd May 13, 2015, the day after Foreign Of?cial-1 arrived in the United States, made plans to travel to meet Foreign Of?cial?1 in Washington, DC. Among other things, in. Apple messages found on Twitter-owned laptOp, explained the. purpose of his trip to his wife: Okay, there. is an important subject I would like to talk to you about. I am traveling to Washington at the request of the of?ce of [Royal Family Member-1]. At ten o?clock tonight and I return tomorrow at ten o?clock at night. ALZABARAH also explained: called me. He said he was in Washington and told them about me and everything about me and they said ?we would like to meet with him wherever he is right now,? and that is the Director of the private of?ce of [Royal Family Member-1], AFFIDAVIT OF FBI SA LETITIA WU 14 ?May 2015., Foreign Official-1 was an employee of the Saudi Arabian Royal Court He was the Director of the private of?ce of Royal Family Member?1 and the Secretary General for two charitable organizations for Royal Family Member?l. That same day, ALZABARAH- purchased an airline ticket to the Washington, DC, area. Based on airline records and other evidence obtained through legal process, planned to stay, and did in fact stay, in the Washington, D.C., area for less than 12 hours on May 14-, 2015. 61. Evidence obtained by the FBI indicates that ALZABARAH communicated with representatives of the KSA during his visit to Washington, DC. Speci?cally, evidence obtained by the FBI shows the following (all times Eastern): a. Shortly after landing at Dulles Airport in the WaShington, D..C.-area, ALZABARAH made contact with ALMUTAIRI. Speci?cally, ALZABARAH called ALMUTAIRI at. approximately 8:53 am. (11 seconds), and ALMUTAIRI called ALZABARAH at approximately 9:06 am. 8 seconds). b. From the airport, ALZABARAH took a cab to a residence in Fairfax, Virginia, arriving at approximately 9:31 am. Open source databases and Deparnnent of State visa records indicate the residence was leased by an employee of the Saudi Ministry of Interior at the Embassy of the Kingdom of Saudi Arabia in Washington, DC. (the ?Fairfax Address?) c, Upon arriving at the Fairfax Address, ALMUTAIRI called ALZABARAH at approximately 9:32 am. (28 seconds) and at approximately 9:34 am. (no answer). d. Several hours later, ALMUTAIRI called ALZABARAH at approximately 1:38 pan. (26 seconds) and again at approximately 2:22 pm. ('10 seconds). e. At approximately 4:40 pm, ALMUTAIRI scheduled a trip with a ride hailing service that terminated at the intersection adjacent to the Fairfax Residence, arriving at approximately 4:42 pm. f. At approximately 4:42 pm, ALZABARAH scheduled a trip with the same ride hailing service and with the same named driver used by ALMUTAIRI. ALZABARAH travelled ?om the Fairfax Address to Dulles Airport. g. At approximately 7:59 pm, ALZABARAH boarded a ?ight at Dulles Airport and returned to San Francisco that. evening. AFFIDAVIT OF FBI SA LETITIA WU 15 .- - mummamwt?nowg?aagg??g 62. During trip to Washington, DC, ALMITAIRI, who had travelled ?om San Francisco to Washington, DC. on May 12, was staying at rental lodging adjacent to a hotel in Washington, DC, which Foreign Of?cial?l speci?ed as his intended lodging. Additionally, on or about May 13., 2015, the day before ALZABARAH travelled to Washington, DC, ALMUTAIRI posted a photograph of himself with Royal Family Member? 1., for whom Foreign Of?cial?l worked. In the caption for the posting, ALMUTAIRI wrote that it was an honor for him to meet with Royal Family Member-1 in Washington. Based on non~content phone records, ?om on or about May 6, 2015, through on. or about May 24, 2015., ALMUTAIRI exchanged at least 10 telephone contacts with Foreign Of?cial? 1.. F. Unauthorized Access. of Private Twitter'User Data and Continued Contact with ALMUTAIRI and Foreign Of?cial? l- 63. Within one week ofrettnning to San Francisco, ALZABARAH began to access without authorization private data of Twitter users en masse. Speci?cally, although ALZABARAH had not accessed the private user data of any Twitter Accounts since February 24, 2015., starting on May 21, 2015, through November 18, 2015 ALZABARAH accessed without authorization through Twitter?s computer systems the Twitter user data of over 6,000 Twitter users, including at least 33 usernanres for which Saudi Arabian law enforcement had submitted emergency disclosure requests to Twitter. A Twitter Security Engineer informed the FBI that, although. may have had grandfathered access to View user information through an internal Twitter tool called ?Pro?le Viewer,? ALZABARAH had no legitimate business purpose as a Site Reliability Engineer to access user accounts. job was to help keep the site up and running, which did not involve accessing individual user accounts. 64. On May 21, 2015, ALZABARAH ?rst accessed through Twitter?s computer systems the Twitter user data of Twitter User-1 at approximately 3: 17 pm. On May 21, 2015 Twitter User-l shared a public Twitter relating to the Royal Family. That same day, Foreign Of?cial-J asserted publicly through Twitter that Twitter User-1?s posting was false, and ALMUTAIRI and ALZABARAH exchanged 3 telephone contacts, including one call lasting approximately 21? minutes at approximately 7:30 pm, which was approximately four hours a?er ALZABARAH accessed Twitter User?1?s data. AFFDDAVIT OF FBI SA WU 16 ALZABARAH accessed Twitter User?1?s account and was able to view his email address, phone number, and IP address. Twitter User?1?s account was the only Twitter account that ALZABARAH accessed through Twitter?s computer systems on that day. In total, from May 21 through October 2015, ALZABARAH accessed through Twitter?s computer systems Twitter User?1?s account on at least nine separate days. During that time, the Kingdom of Saudi Arabia made no emergency disclosure requests to Twitter regarding Twitter User?1?s account. 65. After his 12?hour visit to Washington, DC, on May 14, 2015, phone records, which were obtained by the FBI through legal process, also show that he began having direct contact with Eoreign Of?cial?l . ALZABARAH accessed private Tudtter user data on May 21, 2015, the Same day that ALZABARAH had telephone contact with ALMUTAIRI. ALZABARAH next accessed private Twitter user data on May 29, 2015, close in time with his telephone exchanges with Foreign Of?cial?l. Speci?cally, the investigation has identi?ed the following activities on May 29, 2015: Appromate Forelgn Of?cial?1 Tune Communications With Data 0f (Raunchy-2; ALZABARAH 3; . .. Twitter User-3 (email and IP address) This account is 8-34 a now closed, but the FBI Google search for that accelimt show that it is in Arabic and had posted pictures of an improvised explosive device. ALZABARAH called 8-33 a-m' Foreign Of?cial?1 ALZABARAH called 9-17 am Foreign 9:18 am. Twitter User?3 (email and IP address). - Foreign Official?1 called 9'25 a'm- ALZABARAH 9.27 am Twitter User-4 (email and IP address). The account is now deactivated closed). Later the same day, the Kingdom of Saudi Arabia submitted emergency disclosure requests for information regarding both Twitter User-.3 and Twitter User-4, which Twitter granted. 66. Through a courtuapproved search of Apple ID account, the FBI found an Apple Note that had been last modi?ed on June 7, 2015 (initially created on May 12, 2015). That AFFHDAVIT OF FBI SA LETITIA 17 note stated in Arabic, ?[an honori?'c term for Foreign Of?cial?1,] I would like to ask your advice and opinion regarding an issue. Ijust saw' the announcement the ministry made regardingrewards. Do you think it applies to us? What do you advise? Should we ask them?? In'this statement, I believe that ALZABARAH wanted to inquire about potentially receiving some of the announced reward money in exchange for the information that he had accessed for and provided to Foreign Of?cial?1, Several days- earlier, on June 3, 2015, a U.S. based news outlet reported that Saudi Arabia o??ered a $1.9 million reward (5 million Saudi Riyals) for information that would avert future terrorist attacks. 67. ALZABARAH had access to information that was more detailed than the information Twitter did or would have disclosed to KSA in response to emergency disclosure requests. For example, ALZABARAH also had access to all recent IP addressr information, device used, user?provided biographical information, logs that contained the user?s browser informationparticular user?s actions on the Twitter platform at any given time: 68. ALZABARAH continued this conduct into the subsequent months. During June 2015, ALZABARAH accessed without authorization through Tanner?s computer systems the Twitter user data of approximately 5,726 Twitter users, including Twitter User?1?s account. 69. On June 6,2015, between approximately 12:20 p.111. and 12:50 pm. Paci?c [7:20 pm. and 7:50 pm. ALZABARAH accessed without authorization through Twitter?s computer systems the Twitter user data (email and IP address) of four specific accounts: Twitter User-5, Twitter User-6, Twitter User-7, and Twitter User-8. 70. A court-authorized search of Foreign O?icial-l?s email account revealed that on the same day, June 6, 2015, at approximately 5:33 pm. Paci?c [12:33 am. UTC on June Foreign Of?cial?1 saved a note in his email account with information about these same four Twitter users. Speci?cally, the note in Arabic stated: [Twitter User?5 [a]s far as I can tell his name is [redacted], he?s about 22,, and the TP is [redacted]. Last logged in on 06f06/2015 at 16:57 UTC. Using an iPhone. [Twitter User?6 Is not in Saudi Arabia; he goes back and forth between Turkey and Iraq. AFFIDAVIT 0F FBI SA LETITIA WU 18 '28' [Twitter User-7:] He is in Turkey and has a friend, or something, and they use the same Michigan State Uruyersity account. [Twitter User?8 This one is a professional. He?s a Saudi that uses by a British named Volter/Folter [phonetic spelling]. He signed up for the service but he does his own We tracked, him and found that 12 days ago he signed in once without ?'om [redacted] at 18:40 UTC on 05/25/2015, This one does not use acell phone at all, just a browser. He?s online right using Firefox form a windows machine. 71. The FBI obtained records ?om Twitter relating to any emergency disclosure requests submitted by Saudi Arabian law enforcement for the four accounts listed above. Twitter records showed: a. Twitter User-5: Saudi Arabian law enforcement submitted an emergency disclosure request on June 4, 2015, and Twitter granted the request on the same day. This was two days before ALZABARAH accessed information on Twitter User-?5 and Foreign Of?cial-1 updated his notes with information on Twitter User-5. 13. Twitter User?6: There are no records of any emergency disclosure requests between at least May 1, 2015 through February 16, 2016. c. Twitter User?7: There are no records of any emergency disclosure requests between at least May 1, 2015 through February 16, 2016. d. Twitter User? 8-: Saudi Arabian law enforcement submitted an emergency disclosure request on May 30, 2015 and Twitter granted the request on the same day. 72, Based on a review of the evidence, the information found in Foreign Of?cial?1 ?s email account related to the ?last access? by Twitter User?5 June 6, 2015 at 4:57 pun. UTC) was not provided by Twitter through the emergency diSclosure request response sent on June 5, 2015 at approximately 12:41 am. UTC. The ?last access" date and time of "Twitter User?5 post-dates TWitter?s response to the emergency disclosure request. Likewise, the information found in Foreign Of?cial-1?s email account related to Twitter User?6 and Twitter User-7 was not provided by Twitter through an emergency disclosure request because no such request was granted. 73. Twitter?s standard data production for emergency disclosure requests includes the account ?le, the Creation]? ?le, device ?le, and 48 hours of session IPs, which are further described as: AFFIDAVIT OF FBI SA WU 19 Account File: account ID number, date and time of account creation, last modi?ed date, user?s email address, application used to create the acCount, user name and time zone (if speci?ed by user); 0 Creation IP File: contains the IP and timestamp associated with the account creation; I Device File: date/time device is registered, date/time device is modi?ed, type of device, phone carrier, and veri?ed phone number; 0 IP Audit: account ID number, date/time of 'login, and IP address for login. 74. OnJune 14, 2015, Foreign Oi?oial-l called ALZABARAH at approximately 12:57 pm. Paci?c (unanswered), at approximately 1:17 pm. (unanswered), and at approximately 1:58 pm. (7 minutes 16 seconds). That Same day, between approximately 11:51 am. and 11:25 pm. Paci?c, ALZABARAI-I accessed without authorization the private user data of approximately 5,502 Twitter users, including possibly using bulk searches in Twitter?s internal databases. 75. On June 13, 2015, at approximately 5:00 Foreign Of?cial-1 called ALZABARAH (25 seconds). 76. Twitter User?9 is a we'll-know and in?uential critic of the gavemment and Royal Family of Saudi Arabia with asylum in Canada. On June 19-, 2015, and July 5, 2015, ALZABARAH accessed Twitter User?9?s account and was able to View the user?s account information. 77. Based on Customs and Border Protection records, ALZABARAH ?ew ?om the United States to Saudi Arabia on July 1 1, 2015, and returned on August 14, 2015. A-LZABARAH reported this absence to Twitter, and Twitter approved personal leaVe from July 13 to August 11, 2015. 78. During personal leave and concurrent with his travel to Saudi Arabia, he continued to access the private user data of numerous Twitter users, including Twitter User-1 and Twitter User-5. On July 18, 2015, one day after Twitter granted emergency disclosure requests made by Saudi Arabian law enforcement for Twitter User-10, Twitter User?1 and Twitter User-12, ALZABARAH accessed. user information for those three accounts. 79. Additionally, on July 18, 2015, while on personal leave in Saudi Arabia, ALZABARAH created and modi?ed another Apple Note, which contains further notes of ALZABARAH contemplating AFFIDAVIT OF FBI SA LETITIA WU 9.0 - mummemwwommsa?gas:5 rewards and credit in exchange for the information that he had accessed for and provided to Foreign Of?cial-1 . Speci?cally, Apple Note, which the FBI found in the search of Apple account, stated the following bullet points in Arabic: I My situation there, where am I, and how is this going to affect me? 1' Huge mistake today, I feel that we were .not included. I need to know who they are and why they are in charge of'us. If something happens to him. . .I don?t know anyone. I want to communicate directly. I feel that they are showing What .is this? Ir We served them and they didn?t give us any credit at all. They took credit for the subject. As happened 11 years ago. Those sitting we give it to them [sic] this is scary, save us all from great things [sic]. Only you and I know this is grave injustice towards me and'him. The issue.- is not purely ?nancial, the isSue is moral, honorary and credit. I I would like to improve in the lacking areas. via the [charitable organization run by Foreign I would like to become a member in it by any means or take training classes in leadership and business administration. - Father?s matter is trivial and I was expecting help at least for what we did for them. . .Now they know the issue, a phone call to the man in charge and the problem is solved. 0 I want a permanent something that secures my future and my family?s, streng?iens my relationship with them, and [makes me] feel reassured. . I need a phone, laptop, credit card, and 4G. How to connect as fast as possible [to the Internet] should I need to? To whom can I speak? 0 A weekly meeting or bi?weekly to check-in and such. - - . The subject of taxes and how I had problems with it. 80. Based on a review of the Security Set Identi?ers sequence of characters that uniquely names a wireless local area network) identi?ed in a court-approved search of Twitter? issued computer, ALZABARAH used his Twitter laptop to connect to networks of company in Saudi Arabia on July 29 and 30, 2015, during this period of personal leave. 81. After returning to the United States, oreign Of?cial-1 continued to communicate with ALZABARAH, and ALZABARAH continued to access Twitter User-1?s private account data. For example, on August 20, 2015, Foreign Of?cial?1 called ALZABARAH at approximately 12:06 p.m. Paci?c (3 seconds), and ALZABARAI-I returned Foreign Of?cial-1?s call at approximately 12: 12 pm. AFFIDAVIT OF FBI SA LETITIA WU 21 \oco-qcnm 2-8 ALZABARAH called (unansWered) the Saudi Arabian Consul General 9'26 pm. in Los Angeles from his Saudi cellular telephone. 12:21 am. The Saudi Arabian Consul General in Los Angeles called (3 minutes, 1 (Dec. 3, 2015) second) ALZABARAH on his Saudi cellular telephone. 83. The day after, on or about December 3., 2015, at approximately 7:00 am. Paci?c, ALZABARAH, his wife, and his daughter boarded a?ight at the San Francisco International Airport and ?ew (connecting through the Los Angeles International Airport) to Saudi Arabia. During the connection at the Los Angeles International Airport (ALZABARAH arrived in Los Angeles at approximately 8:32 am. and departed at approximately 3 :00 ALZABARAH and Associate-1 exchanged three telephone contacts one text message at approximately 8:31 am, one call (1 minute, 8 seconds) at approximately 9:00 am, and one call (15 seconds) at apprciximately 12:16 pm. Also during layover in Los Angeles, Saudi cellular telephone and the Saudi Arabian Consul General in Los Angeles exchanged three telephonic contacts one call ?om .ALZABARAH at approximately 9:56 am. (8 seconds), one call to ALZABARAH at approximately 10:40 am. (2 minutes) and one call to ALZABARAH at approximately 11:39 am. (1 minute 30 seconds). 89. Between the time that ALZABARAH le? the Twitter building on December 2, 2015, and his departure ?oin San Francisco at approximately 7:00 am on'December 3, 2015, telephone records for his US. cellular phone indicate contact with only ALMUTAIRI, Associate?1, the Saudi Arabian Consul General in Los Angeles, wife, his Twitter supervisor, one other Twitter employee, Wells Fargo Bank, U.S. Bank, and an Uher driver. 90. On December 3, 2015 at approximately 11:38 pm. Paci?c, Twitter received an email from ALZABARAH stating that he was resigning from .his employment at the company. Based on ?ight records, this email was transmitted while ALZABARAH was in the air .. H. Continued Work for Of?cials of The Kingdom of Saudi Arabia 91. Within one month of arriving in Saudi Arabia, emails show that ALZABARAH began using an email address at a charitable foundation where Foreign Of?cial-l is the Secretary General. In particular, emails sent to and from charitable foundation account show him working with ALMUTAIRI and several .others, on a team to monitor and manipulate social media under Foreign AFFIDAVIT or 24 mummemwwowb?JSKGESEZS Of?cial-1?s leadership and for the bene?t of the Kingdom of Saudi Arabia. In March 2016, ALZABARAH emailed the ?team,? which included ALMUTAIRI and Foreign O??icial?l, and stated that he had established a private website and virtual private network for them to use. ALZABARAH vvas working in that Capacity continuously through at least June 2016. 92. ALZABARAH has submitted several visa applications to return to the United States in which he has disclosed, among other things, employment by the Royal Family and Organization 'No. and listing Foreign Of?cial-1 as his point of contact. '93. As of May 9, 2019, ALZABARAH has a valid visa but has not yet returned to the United States. V. CONCLUSION 94. Based on the foregoing, there is probable cause to believe that Ahrnad Ali ALZABARAH and acted in the United States as agents of the Kingdom of Saudi Arabia without prior noti?cation to the Attorney General, as required by law, in violation of 18 U.S.C. 951. There is ?thher probable cause that Ahmad ABOUAMNIO knowingly falsi?ed and transmitted to agents of the FBI a falsi?ed invoice in order to obstruct a pending federal criminal investigation, in violation of 18 U.S.C. 1519. 95. Accordingly, I request the Court to issue the attached Criminal Complaint and Arrest Warrants. I If fl If AFFIDAWT or FBI SA LETITIAWU 25 to to to 10 :4 . VI. SEALING REQUEST 96. Since this investigation is ongoing, disclosure of the complaint and this affidavit may jeopardize the progress of the investigation, result in the destruction of evidence, intimidation or collusion of Witnesses, or the ?ight of a defendant. Accordingly, I request that the Court issue an order that the complaint, this a?davit in support, and any attachments thereto, along with the order itself, be ?led under seal until further order of the Court. I declare under penalty of perjury that the above is true and correct to the best of my knowledge and belief. I Letitia L. Wu Special Agent Federal Bureau of Investigation SWorn to and subscribed before me this '5 1" day of November, 2019. THE HONORABLE THOMAS S. ON UNITED STATES MAGISTRATE GE AFFIDAVIT OF FBI SALETITIA WU 26