Case 3:19-cr-00621-EMC Document 53 Filed 07/28/20 Page 1 of 20 United States District Court FILED FOR THE NORTHERN DISTRICT OF CALIFORNIA VENUE: SAN FRANCISCO Jul 28 2020 SUSANY. SOONG CLERK, U.S. DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN FRANCISCO UNITED STATES OF AMERICA, V. CR 19-0621 EMC AHMAD ABOUAMMO; ALI ALZABARAH; and AHMED ALMUTAIRI, a/k/a Ahmed Aljbreen DEFENDANT(S). SUPERSEDING INDICTMENT 18 U.S.C. § 951 – Acting as an Agent of a Foreign Government Without Notice to the Attorney General; 18 U.S.C. § 1349 – Conspiracy to Commit Wire Fraud and Honest Services Wire Fraud; 18 U.S.C. §§ 1343, 1346 – Wire Fraud and Honest Services Wire Fraud; 18 U.S.C. § 1956(a)(2)(B)(i) – Money Laundering; 18 U.S.C. § 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations; 18 U.S.C. § 2 – Aiding and Abetting; 18 U.S.C. §§ 981 and 982 and 28 U.S.C. § 2461(c) – Criminal Forfeiture A true bill. /s/ Foreperson of the Grand Jury Foreman 28th Filed in open court this __________ day of July, 2020 _________________________________. ____________________________________________ Clerk ____________________________________________ Magistrate Judge Sallie Kim No process as to Abouammo; Bail, $ ____________ No Bail Arrest Warrants as to Alzabarah and Almutairi Case 3:19-cr-00621-EMC Document 53 Filed 07/28/20 Page 2 of 20 1 DAVID L. ANDERSON (CABN 149604) United States Attorney 2 FILED 3 Jul 28 2020 SUSANY. SOONG CLERK, U.S. DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN FRANCISCO 4 5 6 7 UNITED STATES DISTRICT COURT 8 NORTHERN DISTRICT OF CALIFORNIA 9 SAN FRANCISCO DIVISION 10 11 UNITED STATES OF AMERICA, 12 13 14 15 16 17 Plaintiff, v. AHMAD ABOUAMMO; ALI ALZABARAH; and AHMED ALMUTAIRI, a/k/a Ahmed Aljbreen, Defendants. 18 19 20 21 22 ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) CASE NO. 19 CR-00621 EMC VIOLATIONS: 18 U.S.C. § 951 – Acting as an Agent of a Foreign Government Without Notice to the Attorney General; 18 U.S.C. § 1349 – Conspiracy to Commit Wire Fraud and Honest Services Wire Fraud; 18 U.S.C. §§ 1343, 1346 – Wire Fraud and Honest Services Wire Fraud; 18 U.S.C. § 1956(a)(2)(B)(i) – Money Laundering; 18 U.S.C. § 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations; 18 U.S.C. § 2 – Aiding and Abetting; 18 U.S.C. §§ 981 and 982 and 28 U.S.C. § 2461(c) – Criminal Forfeiture SAN FRANCISCO VENUE SUPERSEDING INDICTMENT 23 The Grand Jury charges: 24 INTRODUCTORY ALLEGATIONS 25 At all times relevant to this Indictment, with all dates and times being approximate: 26 1. 27 28 Defendant ALI ALZABARAH is a citizen of Saudi Arabia and resided in San Case 3:19-cr-00621-EMC Document 53 Filed 07/28/20 Page 3 of 20 1 Bruno, California, in the Northern District of California, from at least August 12, 2013, until 2 December 3, 2015. 3 2. Defendant AHMAD ABOUAMMO is a dual citizen of the United States and 4 Lebanon and resided in Walnut Creek, California, in the Northern District of California, from at 5 least November 4, 2013, until May 22, 2015, and thereafter resided in Seattle, Washington. 6 3. Defendant AHMED ALMUTAIRI, also known as Ahmed Aljbreen 7 (ALMUTAIRI), is a citizen of Saudi Arabia. ALMUTAIRI was present in the United States of 8 America between approximately August 21, 2014, and approximately May 24, 2015. 9 4. Twitter, Inc. (Twitter) is a company headquartered in San Francisco, California, 10 and owns and operates a free-access social-networking website of the same name that can be 11 accessed at http://www.twitter.com. Users of Twitter, including private individuals, journalists, 12 and public figures, create user accounts that can be used to communicate and share information 13 instantly through “tweets” (i.e., 140-character messages prior to 2017) to the public at large, 14 “tweets” to a subset of Twitter users (e.g., to the public or to certain users that “follow” a user), 15 “retweets” by one user of another user, or direct messages (DMs) that are typically visible only 16 to the sender and recipient. Certain Twitter accounts of public interest, including official 17 accounts for government posts and celebrities, can be “verified” with a blue check mark, which 18 is issued by Twitter. 19 5. Twitter operates its service in many languages, including English and Arabic. 20 Many Twitter users live outside of the United States, including in Saudi Arabia. Many users are 21 of Saudi nationality or descent, some of whom live outside of Saudi Arabia, including in the 22 United States. 23 6. During 2014 and through at least 2015, Twitter employees’ work email (e.g., 24 username@twitter.com) was hosted by Google, Inc., through its Gmail platform. 25 7. Skype is an internet-based telecommunications company providing text, video 26 chat or videoconference, and voice call capability to its users on computer or smartphone 27 28 SUPERSEDING INDICTMENT, 19-CR-621 EMC 2 Case 3:19-cr-00621-EMC Document 53 Filed 07/28/20 Page 4 of 20 1 devices. Since 2011, Skype has been owned by Microsoft Corporation. 2 8. The Kingdom of Saudi Arabia (KSA) is a monarchy governed by the King and his 3 Royal Court, which is akin to a cabinet or executive office. Members of the King’s Royal 4 Family hold most of the country’s governmental posts. 5 9. From a time unknown to the Grand Jury but no later than May 2014, to at least 6 March 2016, Foreign Official-1, a citizen of Saudi Arabia, was the Secretary General of an 7 organization identified here as Organization-1, founded by a member of the Saudi Royal Family 8 (Saudi Royal Family Member-1). From a time unknown to the Grand Jury but no later than May 9 2015, Foreign Official-1 was the head of the private office of Saudi Royal Family Member-1. 10 10. From a time unknown to the Grand Jury but no later than May 2014 to at least 11 March 2016, ALMUTAIRI controlled a Saudi social media marketing company that performed 12 work for Organization-1 and members of the Saudi Royal Family, including Royal Family 13 Member-1. 14 11. Title 18, United States Code, Section 2702, provides that service providers of 15 electronic communications and remote computing services, such as Twitter, may voluntarily 16 disclose user data to a governmental entity, if the service provider, in good faith, believes than an 17 emergency involving danger of death or serious physical injury to any person requires disclosure 18 without delay of data relating to the emergency. These disclosures are referred to as “emergency 19 disclosure requests.” 20 12. ABOUAMMO was an employee of Twitter from on or about November 4, 2013, 21 to on or about May 22, 2015. ABOUAMMO was a Media Partnerships Manager responsible for 22 the Middle East and North Africa (MENA) region at Twitter. As a Media Partnerships Manager, 23 ABOUAMMO was involved in providing assistance for notable accounts, including accounts of 24 public interest or belonging to brands, journalists, and celebrities in the MENA region, with 25 content and Twitter strategy, and with sharing best practices. 26 13. ALZABARAH was an employee of Twitter from on or about August 12, 2013, to 27 28 SUPERSEDING INDICTMENT, 19-CR-621 EMC 3 Case 3:19-cr-00621-EMC Document 53 Filed 07/28/20 Page 5 of 20 1 on or about December 4, 2015. While employed at Twitter, ALZABARAH was a Site 2 Reliability Engineer whose responsibility was maintaining Twitter’s hardware and software to 3 ensure uninterrupted service. 4 14. Twitter employees, including ABOUAMMO and ALZABARAH, agreed to abide 5 by the Twitter “Playbook,” which outlines the policies Twitter employees must obey as part of 6 their employment. Twitter’s 2013 employment contracts with ABOUAMMO and 7 ALZABARAH prohibited them from engaging in outside employment or consulting “or any 8 other business activity that would create a conflict of interest with the Company.” In the 2013 9 version of Twitter’s Employee Invention Assignment and Confidentiality Agreements, 10 ABOUAMMO and ALZABARAH each affirmed “a relationship of confidence and trust” 11 between themselves and Twitter “with respect to any information of a confidential or secret 12 nature that may be disclosed to [them] by the Company or a third party that relates to the 13 business of the Company.” The Employee Invention Assignment and Confidentiality Agreement 14 further required ABOUAMMO and ALZABARAH to “keep and hold all such Proprietary 15 Information in strict confidence and trust,” and defined “Proprietary Information” to include 16 Twitter’s “customer lists and data.” In executing the agreements, ABOUAMMO and 17 ALZABARAH affirmed that they would “not use or disclose any Proprietary Information 18 without the prior written consent of the Company” or “use[] any Company information for any 19 other business or employment.” 20 15. Twitter’s “Playbook Acknowledgement,” which ABOUAMMO and 21 ALZABARAH each signed during 2013, stated that each would read, understand, and abide by 22 Twitter’s policies, including the Security Handbook, which defined user data as confidential data 23 and prohibited sharing confidential data with third parties without approval. 24 16. Twitter’s “Gift Policy” during ABOUAMMO’s and ALZABARAH’s 25 employment stated: “[f]or gifts exceeding $100 in value, bring the gift to the attention of both 26 your manager and VP of HR before returning to sender.” 27 28 SUPERSEDING INDICTMENT, 19-CR-621 EMC 4 Case 3:19-cr-00621-EMC Document 53 Filed 07/28/20 Page 6 of 20 1 17. ABOUAMMO and ALZABARAH had access to proprietary and confidential 2 Twitter information, including information about Twitter users, such as the user-provided names 3 and birthdates, device identifiers, relationships, phone numbers, internet protocol (“IP”) 4 addresses and session IP histories, among other things. 5 18. Neither ABOUAMMO’s nor ALZABARAH’s job duties involved a need to 6 access a Twitter user’s private information, and doing so was a reportable violation of the 7 Twitter Playbook policies regarding handling and protecting user data. 8 19. Neither ABOUAMMO nor ALZABARAH had authority from Twitter to receive, 9 access, or produce user information pursuant to any governmental emergency disclosure request. 10 20. ABOUAMMO, ALZABARAH, and ALMUTAIRI have never provided notice to 11 the Attorney General that they were acting as agents of a foreign government. THE SCHEME 12 13 21. ABOUAMMO and ALZABARAH fraudulently used their positions and access to 14 information at Twitter to provide Foreign Official-1 and others related to, and working for, the 15 government of KSA and the Saudi Royal Family with nonpublic information held in the accounts 16 of Twitter users. Using ALMUTAIRI as an intermediary, Foreign Official-1 provided 17 ABOUAMMO and ALZABARAH with gifts, cash payments, and promises of future 18 employment in exchange for nonpublic information about Twitter users, which constituted 19 valuable property, and which ABOUAMMO and ALZABARAH obtained fraudulently from 20 Twitter and provided to Foreign Official-1 and others without Twitter’s approval. 21 22. ABOUAMMO and ALZABARAH received from Foreign Official-1 and others 22 the names of Twitter accounts of interest to Foreign Official-1, members of the Saudi Royal 23 Family, and others in the government of KSA, including accounts posting information critical of, 24 or embarrassing to, the Saudi Royal Family and government of KSA. 25 23. Using their access privileges as employees and fiduciaries of Twitter, 26 ABOUAMMO and ALZABARAH, beyond the scope of their job duties, accessed nonpublic 27 28 SUPERSEDING INDICTMENT, 19-CR-621 EMC 5 Case 3:19-cr-00621-EMC Document 53 Filed 07/28/20 Page 7 of 20 1 account information of Twitter users of interest to the Saudi Royal Family and government of 2 KSA. Such nonpublic information included email addresses, telephone numbers, dates of birth, 3 and internet IP addresses, among other things. ABOUAMMO and ALZABARAH 4 communicated such nonpublic account information to Foreign Official-1 and others in the 5 government of KSA, contrary to Twitter policies. 6 24. In exchange for accessing nonpublic account information of Twitter users, outside 7 the scope of their job duties, and for communicating such nonpublic account information to 8 Foreign Official-1, contrary to Twitter’s policies, Foreign Official-1 rewarded ABOUAMMO 9 and ALZABARAH including with compensation such as gifts, cash payments, and promises of 10 future benefits, including employment. 11 25. ALMUTAIRI acted as an intermediary between Foreign Official-1 and 12 ABOUAMMO and ALZABARAH, representing KSA’s interests with respect to Twitter user 13 information, and met with ABOUAMMO and ALZABARAH in person at the request of, and to 14 further the goals of, Foreign Official-1 and the Saudi Royal Family. 15 26. The scheme involved the following acts, among others, which were committed or 16 caused to be committed, in the Northern District of California and elsewhere: 17 a. In April 2014, a Saudi public relations firm that represented the Embassy 18 of the Kingdom of Saudi Arabia contacted Twitter seeking to have the Twitter account of 19 a Saudi news personality verified. 20 b. On or about May 16, 2014, a representative of a U.S.-Saudi Arabian trade 21 organization in Washington, DC, emailed ABOUAMMO seeking to arrange a tour of 22 Twitter’s San Francisco office for a group of Saudi “entrepreneurs.” On June 13, 2014, a 23 delegation of individuals from Saudi Arabia visited the Twitter headquarters. The 24 delegation included Foreign Official-1 and other employees of Saudi Royal Family 25 Member-1. 26 c. On or about June 13, 2014, Foreign Official-1 emailed ABOUAMMO 27 28 SUPERSEDING INDICTMENT, 19-CR-621 EMC 6 Case 3:19-cr-00621-EMC Document 53 Filed 07/28/20 Page 8 of 20 1 2 requesting verification of Saudi Royal Family Member-1’s Twitter account. d. On or about June 14, 2014, Foreign Official-1 requested ABOUAMMO’s 3 contact information. That same day, ABOUAMMO responded with his Twitter email 4 account, cell phone number, and personal Skype account. ABOUAMMO and Foreign 5 Official-1 spoke by telephone that date. 6 e. On or about November 15, 2014, ALMUTAIRI sent an email to 7 ABOUAMMO requesting an “urgent meeting” in San Francisco to discuss their “mutual 8 interest.” On or about November 20, 2014, ALMUTAIRI and ABOUAMMO met in 9 person in San Francisco, California, near the Twitter headquarters. 10 f. ABOUAMMO and Foreign Official-1 communicated by telephone and by 11 email in late November and early December 2014 to coordinate an in-person meeting in 12 London, United Kingdom. Foreign Official-1 traveled from Paris, France to London and 13 met with ABOUAMMO. During that meeting on or about December 5, 2014, Foreign 14 Official-1 gave ABOUAMMO a valuable watch worth at least $20,000. ABOUAMMO 15 did not report the receipt of the watch to Twitter as required by Twitter. 16 g. Beginning on or about December 12, 2014, ABOUAMMO began 17 accessing without authorization through Twitter’s computer system the user data of 18 Twitter User-1, which was an account that had posted critical information about the Saudi 19 Royal Family and Saudi Royal Family Member-1. Among other account information, 20 ABOUAMMO accessed the email address and telephone number associated with Twitter 21 User-1’s account. ABOUAMMO accessed the account on or about December 12, 2014, 22 January 5, 2015, January 27, 2015, February 4, 2015, February 7, 2015, February 18, 23 2015, and February 24, 2015. 24 h. Foreign Official-1 communicated with ABOUAMMO by telephone 25 requesting that Twitter User-1’s account be removed from Twitter and requesting private 26 user account information. On January 17, 2015, Foreign Official-1 sent an email to 27 28 SUPERSEDING INDICTMENT, 19-CR-621 EMC 7 Case 3:19-cr-00621-EMC Document 53 Filed 07/28/20 Page 9 of 20 1 ABOUAMMO’s Twitter employee email account with an attachment concerning Twitter 2 User-1 and a brief message that stated, “as we discussed in london.” 3 i. On February 5, 2015, Foreign Official-1 sent an email to ABOUAMMO’s 4 Twitter employee email account with an attachment concerning a user identified as 5 Twitter User-2 who Foreign Official-1 asserted was impersonating a member of the Saudi 6 Royal Family. On February 7, 2015, ABOUAMMO accessed without authorization 7 through Twitter’s computer system the account information, including the email address, 8 of Twitter User-2. 9 j. On February 13, 2015, while ABOUAMMO worked for Twitter, Foreign 10 Official-1 deposited $100,000 into a recently opened bank account in Lebanon in the 11 name of ABOUAMMO’s relative. ABOUAMMO had online access to this account and 12 later received wire transfers from the account in Lebanon. On February 24, 2015, a wire 13 of $9,963 was sent from this account to a Bank of America account in the United States 14 in ABOUAMMO’s name. Also on February 24, 2015, ABOUAMMO accessed Twitter 15 User-1’s account. On March 8, 2015, ABOUAMMO sent Foreign Official-1 a Twitter 16 DM stating “proactive and reactively we will delete evil my brother.” On March 12, 17 2015, a wire of $9,911 was sent from the account in Lebanon referenced above to 18 ABOUAMMO’s Bank of America account. 19 k. After ABOUAMMO resigned from Twitter on or about May 22, 2015, 20 Foreign Official-1 asked ABOUAMMO to, among other things, refer requests to Twitter 21 related to accounts of Saudi Arabian government ministers as well as complaints related 22 to certain accounts critical of or impersonating individuals connected to the government 23 of KSA or the Saudi Royal Family. Between May 22, 2015, when ABOUAMMO left 24 Twitter, and January 25, 2016, Foreign Official-1 paid ABOUAMMO at least $200,000. 25 26 l. Although Twitter employees requested that ABOUAMMO direct requests from Saudi Arabian government officials directly to Twitter and not through 27 28 SUPERSEDING INDICTMENT, 19-CR-621 EMC 8 Case 3:19-cr-00621-EMC Document 53 Filed 07/28/20 Page 10 of 20 1 ABOUAMMO, ABOUAMMO continued attempting to contact Twitter employees with 2 Foreign Official-1’s requests until at least March 1, 2016. 3 m. On or before February 16, 2015, and prior to ABOUAMMO’s resignation 4 from Twitter, ABOUAMMO facilitated an introduction between ALZABARAH and 5 ALMUTAIRI. ALMUTAIRI maintained contact with ALZABARAH after 6 ABOUAMMO resigned from Twitter. 7 n. During mid-May 2015, Foreign Official-1 directed ALZABARAH to 8 travel from the Northern District of California to Fairfax, Virginia. On May 14, 2015, 9 while Saudi Royal Family Member-1, Foreign Official-1, and others were visiting 10 Washington, DC on an official delegation from KSA, ALMUTAIRI and ALZABARAH 11 met at the residence of an employee of the Saudi Arabian Embassy in Fairfax, Virginia. 12 Later on the same date, ALZABARAH returned to the Northern District of California. 13 o. After ALZABARAH returned to San Francisco, from May 21, 2015, 14 through November 18, 2015, he accessed without authorization through Twitter’s 15 computer system certain nonpublic account information of dozens of Twitter users, 16 including accounts that had posted critical or embarrassing information about the 17 government of KSA and Saudi Royal Family Member-1. ALZABARAH communicated 18 such nonpublic account information to Foreign Official-1 and others. 19 p. On May 29, 2015, Foreign Official-1 and ALZABARAH exchanged three 20 telephone calls and ALZABARAH accessed nonpublic account information of two 21 Twitter accounts over the course of approximately one hour. The same day, the 22 government of KSA submitted emergency disclosure requests to Twitter for those same 23 two Twitter accounts. 24 q. During July 2015, while ALZABARAH was on personal leave from 25 Twitter, he traveled to Saudi Arabia. While in Saudi Arabia, ALZABARAH accessed 26 nonpublic account information of hundreds of Twitter users using his Twitter credentials, 27 28 SUPERSEDING INDICTMENT, 19-CR-621 EMC 9 Case 3:19-cr-00621-EMC Document 53 Filed 07/28/20 Page 11 of 20 1 including on July 29, 2015, when ALZABARAH connected his Twitter laptop to 2 ALMUTAIRI’s company’s wireless local area network in Saudi Arabia. r. 3 ALZABARAH accessed Twitter User-1’s nonpublic account information 4 on or about May 21, 2015, June 14, 2015, July 5, 2015, August 6, 2015, August 7, 2015, 5 August 20, 2015, September 27, 2015, September 28, 2015, and September 30, 2015. On 6 September 28, 2015, ALZABARAH repeatedly accessed Twitter User-1’s nonpublic 7 account information, the same date the account holder reported that his account had been 8 hacked or compromised. s. 9 On December 2, 2015, after Twitter management confronted 10 ALZABARAH about his unauthorized access of Twitter users’ accounts and placed him 11 on administrative leave, ALZABARAH attempted to contact ALMUTAIRI, and then 12 contacted Foreign Official-1, who in turn contacted an employee of the Saudi Arabian 13 Consulate in Los Angeles, California to coordinate ALZABARAH’s departure from the 14 United States. t. 15 16 On December 3, 2015, ALZABARAH flew to Saudi Arabia and submitted a resignation letter to Twitter by email. u. 17 By no later than January 2016, ALZABARAH had obtained employment 18 in Saudi Arabia with Organization-1 and was in email contact with ALMUTAIRI, 19 Foreign Official-1, and others regarding social media influence projects on behalf of 20 KSA, Foreign Official-1, and the Saudi Royal Family. 21 27. As part of the scheme, ABOUAMMO and ALZABARAH engaged in conduct 22 and made material false representations, promises, and omissions, and engaged in acts of 23 concealment, including, but not limited to, the following: 24 a. ABOUAMMO and ALZABARAH used private means of communication, 25 including personal telephones, email addresses, and Twitter DMs, to communicate with 26 representatives and officials of the government of KSA and Saudi Royal Family, 27 28 SUPERSEDING INDICTMENT, 19-CR-621 EMC 10 Case 3:19-cr-00621-EMC Document 53 Filed 07/28/20 Page 12 of 20 1 including ALMUTAIRI and Foreign Official-1, to avoid detection of the scheme by 2 Twitter. b. 3 ABOUAMMO concealed from Twitter his receipt of a watch valued at 4 more than $20,000 from Foreign Official-1, in exchange for accessing the nonpublic 5 account information of Twitter User-1 and Twitter User-2, and providing such nonpublic 6 information to Foreign Official-1 and others outside of Twitter. c. 7 ABOUAMMO concealed from Twitter his receipt of $100,000 from 8 Foreign Official-1, and his expectation of additional payments, in exchange for his access 9 and monitoring of Twitter accounts of interest to Foreign Official-1 and other members 10 of the government of KSA and the Saudi Royal Family. d. 11 ALZABARAH misled Twitter by taking a leave of absence during July 12 and August 2015, when, in fact, he was performing work for ALMUTAIRI and Foreign 13 Official-1 in Saudi Arabia, including accessing nonpublic account information of Twitter 14 users using his Twitter credentials and Twitter-issued computer. e. 15 ALZABARAH concealed from Twitter that he expected payments and 16 other benefits, including future employment in Saudi Arabia in exchange for providing 17 nonpublic account information of Twitter users to Foreign Official-1 and others acting on 18 behalf of KSA and the Saudi Royal Family. f. 19 ALZABARAH misled Twitter by claiming he accessed Twitter accounts, 20 specifically including Twitter User-1’s account, out of curiosity, when, in fact, he 21 accessed nonpublic information of numerous accounts for the benefit of Foreign Official- 22 1, KSA, and the Saudi Royal Family. 23 28. The scheme deprived Twitter of the following: (a) its money and property by 24 enabling individuals and entities outside of Twitter, including members of the government of 25 KSA and the Saudi Royal Family, access to nonpublic account information of Twitter users, 26 including information pertaining to accounts of dissidents and accounts that posted information 27 28 SUPERSEDING INDICTMENT, 19-CR-621 EMC 11 Case 3:19-cr-00621-EMC Document 53 Filed 07/28/20 Page 13 of 20 1 critical of, and embarrassing to, KSA, the Saudi Royal Family, and Saudi Royal Family 2 Member-1; and (b) Twitter’s intangible right to the honest services of its employees and 3 fiduciaries, ABOUAMMO and ALAZABARAH. 4 COUNT ONE: (18 U.S.C. §§ 951 and 2 – Acting as an Agent of a Foreign Government Without Notice to the Attorney General) 5 6 29. Paragraphs 1 through 28 are realleged as if fully set forth herein. 7 30. From on or about December 12, 2014, and continuing until on or about March 1, 8 2016, in the Northern District of California and elsewhere, the defendant, 9 AHMAD ABOUAMMO, 10 did knowingly, without notifying the Attorney General as required by law, act as an agent of a 11 foreign government, to wit, the government of the Kingdom of Saudi Arabia and the Saudi Royal 12 Family. 13 All in violation of Title 18, United States Code, Section 951. 14 COUNT TWO: (18 U.S.C. §§ 951 and 2 – Acting as an Agent of a Foreign Government Without Notice to the Attorney General) 15 16 31. Paragraphs 1 through 28 are realleged as if fully set forth herein. 17 32. From at least on or about November 20, 2014, and continuing until at least on or 18 about May 24, 2015, in the Northern District of California and elsewhere, the defendant, 19 AHMED ALMUTAIRI, 20 did knowingly, without notifying the Attorney General as required by law, act as an agent of a 21 foreign government, to wit, the government of the Kingdom of Saudi Arabia and the Saudi Royal 22 Family. 23 24 25 26 All in violation of Title 18, United States Code, Section 951. COUNT THREE: (18 U.S.C. §§ 951 and 2 – Acting as an Agent of a Foreign Government Without Notice to the Attorney General) 33. Paragraphs 1 through 28 are realleged as if fully set forth herein. 27 28 SUPERSEDING INDICTMENT, 19-CR-621 EMC 12 Case 3:19-cr-00621-EMC Document 53 Filed 07/28/20 Page 14 of 20 1 34. From on or about May 21, 2015, and continuing until on or about December 3, 2 2015, in the Northern District of California and elsewhere, the defendant, 3 ALI ALZABARAH, 4 did knowingly, without notifying the Attorney General as required by law, act as an agent of a 5 foreign government, to wit, the government of the Kingdom of Saudi Arabia and the Saudi Royal 6 Family. 7 All in violation of Title 18, United States Code, Section 951. 8 COUNT FOUR: (18 U.S.C. § 1349 – Conspiracy to Commit Wire Fraud and Honest Services Fraud) 9 10 35. Paragraphs 1 through 28 are realleged as if fully set forth herein. 11 36. From on or about November 20, 2014, until at least on or about December 3, 12 2015, in the Northern District of California and elsewhere, the defendants, 13 AHMAD ABOUAMMO, ALI ALZABARAH, and AHMED ALMUTAIRI, 14 15 and others, did knowingly conspire to devise and intend to devise a scheme and artifice to 16 defraud Twitter, and to obtain property of Twitter by means of materially false and fraudulent 17 pretenses, representations, and promises, and by concealment of material facts and omissions of 18 material facts with a duty to disclose, and to deprive Twitter of its right to the honest and faithful 19 services of its employees and fiduciaries through bribes, and for the purpose of executing such 20 scheme and artifice, and attempting to do so, to transmit, and cause to be transmitted, by means 21 of wire communication in interstate and foreign commerce, certain writings, signs, signals, 22 pictures, and sounds, in violation of Title 18, United States Code, Sections 1343 and 1346. 23 All in violation of Title 18, United States Code, Section 1349. 24 COUNT FIVE THROUGH NINETEEN: (18 U.S.C. §§ 1343, 1346, and 2 –Wire Fraud and Honest Services Wire Fraud and Aiding and Abetting) 25 37. Paragraphs 1 through 28 and 36 are realleged as if fully set forth herein. 26 27 28 SUPERSEDING INDICTMENT, 19-CR-621 EMC 13 Case 3:19-cr-00621-EMC Document 53 Filed 07/28/20 Page 15 of 20 1 38. On or about the dates provided below, in the Northern District of California and 2 elsewhere, the defendants, 3 AHMAD ABOUAMMO, ALI ALZABARAH, and AHMED ALMUTAIRI, 4 5 and others, did knowingly, and with the intent to defraud, participate in, devise, and intend to 6 devise a scheme and artifice to defraud Twitter, and to obtain property of Twitter by means of 7 materially false and fraudulent pretenses, representations, and promises, and by concealment of 8 material facts and omissions of material facts with a duty to disclose, and to deprive Twitter of 9 its right to the honest and faithful services of its employees and fiduciaries through bribes, and 10 attempting to do so, did knowingly transmit, and cause to be transmitted, the following writings, 11 signs, signals, pictures, and sounds in interstate and foreign commerce by means of wire 12 communications: 13 COUNT 5 DATE 3/8/2015 6 5/21/2015 DESCRIPTION Twitter DM from ABOUAMMO’s personal Twitter account to Foreign Official-1 stating “proactive and reactively we will delete evil my brother.” Telephone call between ALZABARAH and ALMUTAIRI. 17 7 5/29/2015 Telephone call between ALZABARAH and Foreign Official-1. 18 8 6/1/2015 Telephone call from Foreign Official-1 to ALZABARAH. 9 6/3/2015 Telephone call from Foreign Official-1 to ALZABARAH. 10 6/14/2015 Telephone call from ALZABARAH to Foreign Official-1. 11 7/9/2015 12 7/17/2015 Twitter DMs between ABOUAMMO’s personal Twitter Foreign Official-1 regarding Foreign Official-1’s “late” payment to ABOUAMMO and whether Foreign Official-1 needed assistance with Twitter matters. Access by ALZABARAH to Twitter servers via virtual private network (“VPN”) from KSA to access information of a user identified as Twitter User-10 using his Twitter-issued computer while on personal leave. 14 15 16 19 20 21 22 23 24 25 26 27 28 SUPERSEDING INDICTMENT, 19-CR-621 EMC 14 Case 3:19-cr-00621-EMC Document 53 Filed 07/28/20 Page 16 of 20 COUNT 13 DATE 7/17/2015 14 7/17/2015 15 7/29/2015 16 7/29/2015 17 8/20/2015 DESCRIPTION Access by ALZABARAH to Twitter servers via VPN from KSA to access information of a user identified as Twitter User-11. Access by ALZABARAH to Twitter servers from via VPN from KSA to access information of a user identified as Twitter User12. Access by ALZABARAH to Twitter servers from via VPN from KSA to access information of a user identified as Twitter User13. Access by ALZABARAH to Twitter servers from via VPN from KSA to access information of a user identified as Twitter User14. Telephone call from ALZABARAH to Foreign Official-1. 9 18 9/8/2015 Telephone call from Foreign Official-1 to ALZABARAH. 10 19 12/2/2015 Telephone call from ALZABARAH to Foreign Official-1. 1 2 3 4 5 6 7 8 11 12 Each in violation of Title 18, United States Code, Sections 1343, 1346, and 2. 13 COUNT TWENTY: (18 U.S.C. § 1956(a)(2)(B)(i) – Money Laundering) 14 39. Paragraphs 1 through 28, 36, and 38 are realleged as if fully set forth herein. 15 40. On or about March 10, 2015, in the Northern District of California and elsewhere, 16 the defendant, 17 AHMAD ABOUAMMO, 18 did knowingly conduct a financial transaction affecting interstate and foreign commerce, to wit, 19 transporting, transmitting, and transferring monetary instruments and funds, that is, a total of 20 $9,911 in United States currency, transferred from a Bank Audi account in Beirut, Lebanon into 21 an account in the United States controlled by ABOUAMMO, such funds constituting the 22 proceeds of a specified unlawful activity, that is, wire fraud, honest services fraud, and 23 conspiracy, in violation of 18 U.S.C. §§ 1343 1346, and 1349, knowing that such transfer was 24 designed in whole or in part to conceal and disguise the nature, source, and ownership of the 25 proceeds of said specified unlawful activity and that while conducting such financial transaction 26 knew that the property involved in the financial transaction represented the proceeds of some 27 form of unlawful activity. SUPERSEDING INDICTMENT, 28 19-CR-621 EMC 15 Case 3:19-cr-00621-EMC Document 53 Filed 07/28/20 Page 17 of 20 1 All in violation of Title 18, United States Code, Section 1956(a)(2)(B)(i). 2 COUNT TWENTY-ONE: (18 U.S.C. § 1956(a)(2)(B)(i) – Money Laundering) 3 41. Paragraphs 1 through 28, 36, and 38 are realleged as if fully set forth herein. 4 42. On or about June 11, 2015, in the Northern District of California and elsewhere, 5 the defendant, AHMAD ABOUAMMO, 6 7 did knowingly conduct a financial transaction affecting interstate and foreign commerce, to wit, 8 transporting, transmitting, and transferring monetary instruments and funds, that is, a total of 9 $10,000 in United States currency, transferred from a Bank Audi account in Beirut, Lebanon into 10 an account in the United States controlled by ABOUAMMO, such funds constituting the 11 proceeds of a specified unlawful activity, that is, wire fraud, honest services fraud, and 12 conspiracy, in violation of 18 U.S.C. §§ 1343, 1346, and 1349, knowing that such transfer was 13 designed in whole or in part to conceal and disguise the nature, source, and ownership of the 14 proceeds of said specified unlawful activity and that while conducting such financial transaction 15 knew that the property involved in the financial transaction represented the proceeds of some 16 form of unlawful activity. 17 All in violation of Title 18, United States Code, Section 1956(a)(2)(B)(i). 18 COUNT TWENTY-TWO: (18 U.S.C. § 1956(a)(2)(B)(i) – Money Laundering) 19 43. Paragraphs 1 through 28, 36, and 38 are realleged as if fully set forth herein. 20 44. On or about July 2, 2015, in the Northern District of California and elsewhere, the 21 defendant, AHMAD ABOUAMMO, 22 23 did knowingly conduct a financial transaction affecting interstate and foreign commerce, to wit, 24 transporting, transmitting, and transferring monetary instruments and funds, that is, a total of 25 $30,000 in United States currency, transferred from a Bank Audi account in Beirut, Lebanon into 26 an account in the United States controlled by ABOUAMMO, such funds constituting the 27 28 SUPERSEDING INDICTMENT, 19-CR-621 EMC 16 Case 3:19-cr-00621-EMC Document 53 Filed 07/28/20 Page 18 of 20 1 proceeds of a specified unlawful activity, that is, wire fraud, honest services fraud, and 2 conspiracy, in violation of 18 U.S.C. §§ 1343, 1346, and 1349, knowing that such transfer was 3 designed in whole or in part to conceal and disguise the nature, source, and ownership of the 4 proceeds of said specified unlawful activity and that while conducting such financial transaction 5 knew that the property involved in the financial transaction represented the proceeds of some 6 form of unlawful activity. 7 All in violation of Title 18, United States Code, Section 1956(a)(2)(B)(i). 8 COUNT TWENTY-THREE: (18 U.S.C. § 1519 – Falsification of Records to Obstruct Investigation) 9 10 45. Paragraphs 1 through 28, 36, and 38 are realleged as if fully set forth herein. 11 46. On or about October 20, 2018, in the Northern District of California and 12 elsewhere, the defendant, 13 AHMAD ABOUAMMO, 14 unlawfully, intentionally, and knowingly did alter, destroy, mutilate, conceal, and falsify a record 15 or document, namely creating and providing by email to the Federal Bureau of Investigation a 16 fabricated, false, and backdated invoice for $100,000 for consulting services to Foreign Official17 1, from CYRCL, LLC, defendant’s sole proprietorship, with the intent to impede, obstruct and 18 influence an actual and contemplated investigation and the proper administration of a matter 19 within the jurisdiction of a department and agency of the United States, namely the Federal 20 Bureau of Investigation. 21 All in violation of Title 18, United States Code, Section 1519. 22 FORFEITURE ALLEGATION: (18 U.S.C. §§ 981(a)(1)(C), 982(a)(1); 28 U.S.C. § 2461(c)) 23 47. Paragraphs 1 through 46 are hereby realleged for the purpose of alleging 24 forfeiture to the United States of America pursuant to Title 18, United States Code, Section 25 981(a)(l)(C) and Title 28, United States Code, Section 2461(c). 26 48. Upon conviction of any of the offenses in violation of Title 18, United States 27 28 SUPERSEDING INDICTMENT, 19-CR-621 EMC 17 Case 3:19-cr-00621-EMC Document 53 Filed 07/28/20 Page 19 of 20 1 Code, Sections 1343, 1346, and 1349 set forth in Counts Four through Nineteen of this First 2 Superseding Indictment, or any of them, the defendants, 3 AHMAD ABOUAMMO, ALI ALZABARAH, and AHMED ALMUTAIRI, 4 5 6 shall forfeit to the United States of America, pursuant to Title 18, United States Code, Section 7 981(a)(1)(C) and Title 28, United States Code, Section 2461(c), any property, real or personal, 8 which constitutes or is derived from proceeds traceable to the offenses, including the sum of 9 money equal to the total amount of proceeds defendants obtained or derived, directly or 10 indirectly, from the violations, and including a forfeiture money judgment. 11 49. Upon conviction of the offenses in violation of Title 18, United States Code, 12 Section 1956 alleged in Counts Twenty through Twenty-Two of this First Superseding 13 Indictment, the defendant, AHMAD ABOUAMMO, 14 15 shall forfeit to the United States, pursuant to Title 18, United States Code, Section 982(a)(1), all 16 property, real or personal, involved in said violation, or any property traceable to such property, 17 and including all proceeds of the offense, and including, but not limited to, a forfeiture money 18 judgment. 19 50. If any of the property described above, as a result of any act or omission of the 20 defendant: 21 a. cannot be located upon the exercise of due diligence; 22 b. has been transferred or sold to, or deposited with, a third party; 23 c. has been placed beyond the jurisdiction of the court; 24 d. has been substantially diminished in value; or 25 e. has been commingled with other property which cannot be divided without 26 difficulty; 27 28 SUPERSEDING INDICTMENT, 19-CR-621 EMC 18 Case 3:19-cr-00621-EMC Document 53 Filed 07/28/20 Page 20 of 20 1 the United States of America shall be entitled to forfeiture of substitute property pursuant to Title 2 21, United States Code, Section 853(p), as incorporated by Title 28, United States Code, Section 3 2461(c). 4 All pursuant to Title 18 United States Code, Sections 981(a)(1)(C), 982(a)(1), Title 28 5 United States Code, Section 2461(c), and Federal Rule of Criminal Procedure 32.2. 6 SENTENCING ALLEGATION: 7 47. With respect to Counts One and Four through Seven of the First Superseding 8 Indictment, for the purposes of determining the maximum alternative fine, pursuant to Title 18, 9 United States Code, Section 3571(d), the defendant, AHMAD ABOUAMMO, 10 11 derived gross gains of approximately $320,000. 12 13 DATED: July 28, 2020 A TRUE BILL. 14 _/s/__________ FOREPERSON 15 16 DAVID L. ANDERSON United States Attorney 17 /s/ Colin Sampson 18 COLIN SAMPSON 19 Assistant United States Attorney BENJAMIN J. HAWK 20 Trial Attorney, National Security Division 21 22 23 24 25 26 27 28 SUPERSEDING INDICTMENT, 19-CR-621 EMC 19