AO 257 (Rev. 6/78) Case 3:19-cr-00621-EMC Document 42 Filed 04/07/20 Page 1 of 21 DEFENDANT INFORMATION RELATIVE TO A CRIMINAL ACTION - IN U.S. DISTRICT COURT BY: COMPLAINT INFORMATION INDICTMENT NORTHERN DISTRICT OF CALIFORNIA SUPERSEDING OFFENSE CHARGED SAN FRANCISCO DIVISION Petty 18 U.S.C. § 951 – Acting as an Agent of a Foreign Government Without Notice to the Attorney General; 18 U.S.C. § 1349 – Conspiracy to Commit Wire Fraud and Honest Services Fraud; 18 U.S.C. §§ 1343 and 1346 and 2 – Wire fraud and Honest Services Fraud; 18 U.S.C. §§ 1956(a) (2)(B)(i) and 2 – International Money Laundering; and 18 U.S.C. §§ 1519 – Destruction, Alteration, or Falsification of PENALTY: Name of District Court, and/or Judge/Magistrate Location Minor FILED DEFENDANT - U.S Misdemeanor  AHMAD ABOUAMMO Felony Apr 07 2020 DISTRICT COURT NUMBER 18 U.S.C. § 951 – 10 yrs prison, $640,000 fine, 3 yrs supervised release (SR), $100 special assessment (SA); 18 U.S.C. § 1349 – 20 yrs prison, $640,000 fine, 3 yrs SR, $100 SA; 18 U.S.C. §§ 1343 and 1346 – 20 yrs prison, $640,000 fine, 3 yrs SR, $100 SA; 18 U.S.C. §§ 1956(a)(2)(B)(i) and 2 – 20 yrs prison, $250,000 fine, 3 yrs SR, $100 SA; and 18 U S C § 1519 20 yrs prison $250 000 fine 3 yrs SR 19 CR-00621 EMC SUSANY. SOONG CLERK, U.S. DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN FRANCISCO DEFENDANT IS NOT IN CUSTODY PROCEEDING Name of Complaintant Agency, or Person (& Title, if any) 1) Has not been arrested, pending outcome this proceeding. If not detained give date any prior summons was served on above charges 2) Is a Fugitive 3) Is on Bail or Release from (show District)  FBI person is awaiting trial in another Federal or State Court, give name of court this person/proceeding is transferred from another district per (circle one) FRCrp 20, 21, or 40. Show District IS IN CUSTODY this is a reprosecution of charges previously dismissed which were dismissed on motion of: U.S. ATTORNEY DEFENSE } this prosecution relates to a pending case involving this same defendant prior proceedings or appearance(s) before U.S. Magistrate regarding this defendant were recorded under Name and Office of Person Furnishing Information on this form } On this charge 5) On another conviction 6) } Federal State Awaiting trial on other charges If answer to (6) is "Yes", show name of institution MAGISTRATE CASE NO. Yes Has detainer been filed? DATE OF ARREST No  } If "Yes" give date filed Month/Day/Year 3:19-71824 Or... if Arresting Agency & Warrant were not DAVID L. ANDERSON U.S. Attorney Name of Assistant U.S. Attorney (if assigned) SHOW DOCKET NO. 4) DATE TRANSFERRED TO U.S. CUSTODY  Month/Day/Year Other U.S. Agency This report amends AO 257 previously submitted Colin Sampson, AUSA ADDITIONAL INFORMATION OR COMMENTS PROCESS: SUMMONS NO PROCESS* If Summons, complete following: Arraignment Initial Appearance WARRANT Bail Amount: * Where defendant previously apprehended on complaint, no new summons or warrant needed, since Magistrate has scheduled arraignment Defendant Address: Date/Time: Comments: Before Judge: AO 257 (Rev. 6/78) Case 3:19-cr-00621-EMC Document 42 Filed 04/07/20 Page 2 of 21 DEFENDANT INFORMATION RELATIVE TO A CRIMINAL ACTION - IN U.S. DISTRICT COURT BY: COMPLAINT INFORMATION INDICTMENT Name of District Court, and/or Judge/Magistrate Location NORTHERN DISTRICT OF CALIFORNIA SUPERSEDING OFFENSE CHARGED SAN FRANCISCO DIVISION Petty 18 U.S.C. § 951 – Acting as an Agent of a Foreign Government Without Notice to the Attorney General; 18 U.S.C. § 1349 – Conspiracy to Commit Wire Fraud and Honest Services Fraud; and 18 U.S.C. §§ 1343 and 1346 and 2 – Wire fraud and Honest Services Fraud Minor Misdemeanor  ALI ALZABARAH Felony PENALTY: 19 CR-00621 EMC IS NOT IN CUSTODY Name of Complaintant Agency, or Person (& Title, if any) 1) Has not been arrested, pending outcome this proceeding. If not detained give date any prior summons was served on above charges 2) Is a Fugitive 3) Is on Bail or Release from (show District)  FBI person is awaiting trial in another Federal or State Court, give name of court this person/proceeding is transferred from another district per (circle one) FRCrp 20, 21, or 40. Show District DEFENSE this prosecution relates to a pending case involving this same defendant prior proceedings or appearance(s) before U.S. Magistrate regarding this defendant were recorded under Name and Office of Person Furnishing Information on this form } } 4) On this charge 5) On another conviction 6) Awaiting trial on other charges Federal State If answer to (6) is "Yes", show name of institution MAGISTRATE CASE NO. Yes Has detainer been filed? DATE OF ARREST No  } If "Yes" give date filed Month/Day/Year Or... if Arresting Agency & Warrant were not DATE TRANSFERRED TO U.S. CUSTODY  Month/Day/Year This report amends AO 257 previously submitted ADDITIONAL INFORMATION OR COMMENTS NO PROCESS* WARRANT Bail Amount: * Where defendant previously apprehended on complaint, no new summons or warrant needed, since Magistrate has scheduled arraignment Date/Time: Comments: } Other U.S. Agency If Summons, complete following: Arraignment Initial Appearance Defendant Address: IS IN CUSTODY Colin Sampson, AUSA PROCESS: SUMMONS SHOW DOCKET NO. DAVID L. ANDERSON U.S. Attorney Name of Assistant U.S. Attorney (if assigned) SUSANY. SOONG CLERK, U.S. DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN FRANCISCO DEFENDANT PROCEEDING U.S. ATTORNEY Apr 07 2020 DISTRICT COURT NUMBER 18 U.S.C. § 951 – 10 yrs prison, $640,000 fine, 3 yrs supervised release (SR), $100 special assessment (SA); 18 U.S.C. § 1349 – 20 yrs prison, $640,000 fine, 3 yrs SR, $100 SA; and 18 U.S.C. §§ 1343 and 1346 – 20 yrs prison, $640,000 fine, 3 yrs SR, $100 SA this is a reprosecution of charges previously dismissed which were dismissed on motion of: FILED DEFENDANT - U.S Before Judge: AO 257 (Rev. 6/78) Case 3:19-cr-00621-EMC Document 42 Filed 04/07/20 Page 3 of 21 DEFENDANT INFORMATION RELATIVE TO A CRIMINAL ACTION - IN U.S. DISTRICT COURT BY: COMPLAINT INFORMATION INDICTMENT Name of District Court, and/or Judge/Magistrate Location NORTHERN DISTRICT OF CALIFORNIA SUPERSEDING OFFENSE CHARGED SAN FRANCISCO DIVISION Petty 18 U.S.C. § 951 – Acting as an Agent of a Foreign Government Without Notice to the Attorney General; 18 U.S.C. § 1349 – Conspiracy to Commit Wire Fraud and Honest Services Fraud; and 18 U.S.C. §§ 1343 and 1346 and 2 – Wire fraud and Honest Services Fraud Minor DEFENDANT - U.S Misdemeanor  AHMED ALMUTAIRI, a/k/a Ahmed Aljbreen Felony PENALTY: FILED DISTRICT COURT NUMBER 18 U.S.C. § 951 – 10 yrs prison, $640,000 fine, 3 yrs supervised release (SR), $100 special assessment (SA); 18 U.S.C. § 1349 – 20 yrs prison, $640,000 fine, 3 yrs SR, $100 SA; and 18 U.S.C. §§ 1343 and 1346 – 20 yrs prison, $640,000 fine, 3 yrs SR, $100 SA 19 CR-00621 EMC Apr 07 2020 SUSANY. SOONG CLERK, U.S. DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA DEFENDANT SAN FRANCISCO IS NOT IN CUSTODY PROCEEDING Name of Complaintant Agency, or Person (& Title, if any) 1) Has not been arrested, pending outcome this proceeding. If not detained give date any prior summons was served on above charges 2) Is a Fugitive 3) Is on Bail or Release from (show District)  FBI person is awaiting trial in another Federal or State Court, give name of court this person/proceeding is transferred from another district per (circle one) FRCrp 20, 21, or 40. Show District IS IN CUSTODY this is a reprosecution of charges previously dismissed which were dismissed on motion of: U.S. ATTORNEY DEFENSE } this prosecution relates to a pending case involving this same defendant prior proceedings or appearance(s) before U.S. Magistrate regarding this defendant were recorded under Name and Office of Person Furnishing Information on this form } On this charge 5) On another conviction 6) } Federal State Awaiting trial on other charges If answer to (6) is "Yes", show name of institution MAGISTRATE CASE NO. Yes Has detainer been filed? DATE OF ARREST No  } If "Yes" give date filed Month/Day/Year Or... if Arresting Agency & Warrant were not DAVID L. ANDERSON U.S. Attorney Name of Assistant U.S. Attorney (if assigned) SHOW DOCKET NO. 4) DATE TRANSFERRED TO U.S. CUSTODY  Month/Day/Year Other U.S. Agency This report amends AO 257 previously submitted Colin Sampson, AUSA ADDITIONAL INFORMATION OR COMMENTS PROCESS: SUMMONS NO PROCESS* If Summons, complete following: Arraignment Initial Appearance WARRANT Bail Amount: * Where defendant previously apprehended on complaint, no new summons or warrant needed, since Magistrate has scheduled arraignment Defendant Address: Date/Time: Comments: Before Judge: Case 3:19-cr-00621-EMC Document 42 Filed 04/07/20 Page 4 of 21 FILED 1 DAVID L. ANDERSON (CABN 149604) United States Attorney 2 Apr 07 2020 SUSANY. SOONG CLERK, U.S. DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA SAN FRANCISCO 3 4 5 6 7 UNITED STATES DISTRICT COURT 8 NORTHERN DISTRICT OF CALIFORNIA 9 SAN FRANCISCO DIVISION 10 11 UNITED STATES OF AMERICA, 12 13 Plaintiff, v. 14 AHMAD ABOUAMMO; ALI ALZABARAH; and 15 AHMED ALMUTAIRI, a/k/a Ahmed Aljbreen, 16 17 Defendants. 18 19 20 ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) CASE NO. 19 CR-00621 EMC VIOLATIONS: 18 U.S.C. § 951 – Acting as an Agent of a Foreign Government Without Notice to the Attorney General; 18 U.S.C. § 1349 – Conspiracy to Commit Wire Fraud and Honest Services Wire Fraud; 18 U.S.C. §§ 1343, 1346 – Wire Fraud and Honest Services Wire Fraud; 18 U.S.C. § 1956(a)(2)(B)(i) – Money Laundering; 18 U.S.C. § 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations; 18 U.S.C. § 2 – Aiding and Abetting; 18 U.S.C. §§ 981 and 982 and 28 U.S.C. § 2461(c) – Criminal Forfeiture SAN FRANCISCO VENUE 21 22 SU PE RS ED I NG I N FOR MA T I ON 23 The United States Attorney charges: 24 INTRODUCTORY ALLEGATIONS 25 At all times relevant to this Superseding Information, with all dates and times being 26 approximate: 27 1. Defendant ALI ALZABARAH is a citizen of Saudi Arabia and resided in San 28 Bruno, California, in the Northern District of California, from at least August 12, 2013, until Case 3:19-cr-00621-EMC Document 42 Filed 04/07/20 Page 5 of 21 1 December 3, 2015. 2 2. Defendant AHMAD ABOUAMMO is a dual citizen of the United States and 3 Lebanon and resided in Walnut Creek, California, in the Northern District of California, from at 4 least November 4, 2013, until May 22, 2015, and thereafter resided in Seattle, Washington. 5 3. Defendant AHMED ALMUTAIRI, also known as Ahmed Aljbreen 6 (ALMUTAIRI), is a citizen of Saudi Arabia. ALMUTAIRI was present in the United States of 7 America between approximately August 21, 2014, and approximately May 24, 2015. 8 4. Twitter, Inc. (Twitter) is a company headquartered in San Francisco, California, 9 and owns and operates a free-access social-networking website of the same name that can be 10 accessed at http://www.twitter.com. Users of Twitter, including private individuals, journalists, 11 and public figures, create user accounts that can be used to communicate and share information 12 instantly through “tweets” (i.e., 140-character messages prior to 2017) to the public at large, 13 “tweets” to a subset of Twitter users (e.g., to the public or to certain users that “follow” a user), 14 “retweets” by one user of another user, or direct messages (DMs) that are typically visible only 15 to the sender and recipient. Certain Twitter accounts of public interest, including official 16 accounts for government posts and celebrities, can be “verified” with a blue check mark, which 17 is issued by Twitter. 18 5. Twitter operates its service in many languages, including English and Arabic. 19 Many Twitter users live outside of the United States, including in Saudi Arabia. Many users are 20 of Saudi nationality or descent, some of whom live outside of Saudi Arabia, including in the 21 United States. 22 6. During 2014 and through at least 2015, Twitter employees’ work email (e.g., 23 username@twitter.com) was hosted by Google, Inc., through its Gmail platform. 24 7. Skype is an internet-based telecommunications company providing text, video 25 chat or videoconference, and voice call capability to its users on computer or smartphone 26 devices. Since 2011, Skype has been owned by Microsoft Corporation. 27 8. The Kingdom of Saudi Arabia (KSA) is a monarchy governed by the King and his 28 SUPERSEDING INFORM ATION, 19-CR-621 EMC 2 Case 3:19-cr-00621-EMC Document 42 Filed 04/07/20 Page 6 of 21 1 Royal Court, which is akin to a cabinet or executive office. Members of the King’s Royal 2 Family hold most of the country’s governmental posts. 3 9. No later than May 2014, to at least March 2016, Foreign Official-1, a citizen of 4 Saudi Arabia, was the Secretary General of an organization identified here as Organization-1, 5 founded by a member of the Saudi Royal Family (Saudi Royal Family Member-1). No later than 6 May 2015, Foreign Official-1 was the head of the private office of Saudi Royal Family Member7 1. 8 10. No later than May 2014 to at least March 2016, ALMUTAIRI controlled a Saudi 9 social media marketing company that performed work for Organization-1 and members of the 10 Saudi Royal Family, including Saudi Royal Family Member-1. 11 11. Title 18, United States Code, Section 2702, provides that service providers of 12 electronic communications and remote computing services, such as Twitter, may voluntarily 13 disclose user data to a governmental entity, if the service provider, in good faith, believes than an 14 emergency involving danger of death or serious physical injury to any person requires disclosure 15 without delay of data relating to the emergency. These disclosures are referred to as “emergency 16 disclosure requests.” 17 12. ABOUAMMO was an employee of Twitter from on or about November 4, 2013, 18 to on or about May 22, 2015. ABOUAMMO was a Media Partnerships Manager responsible for 19 the Middle East and North Africa (MENA) region at Twitter. As a Media Partnerships Manager, 20 ABOUAMMO was involved in providing assistance for notable accounts, including accounts of 21 public interest or belonging to brands, journalists, and celebrities in the MENA region, with 22 content and Twitter strategy, and with sharing best practices. 23 13. ALZABARAH was an employee of Twitter from on or about August 12, 2013, to 24 on or about December 4, 2015. While employed at Twitter, ALZABARAH was a Site 25 Reliability Engineer whose responsibility was maintaining Twitter’s hardware and software to 26 ensure uninterrupted service. 27 14. Twitter employees, including ABOUAMMO and ALZABARAH, agreed to abide 28 SUPERSEDING INFORM ATION, 19-CR-621 EMC 3 Case 3:19-cr-00621-EMC Document 42 Filed 04/07/20 Page 7 of 21 1 by the Twitter “Playbook,” which outlines the policies Twitter employees must obey as part of 2 their employment. Twitter’s 2013 employment contracts with ABOUAMMO and 3 ALZABARAH prohibited them from engaging in outside employment or consulting “or any 4 other business activity that would create a conflict of interest with the Company.” In the 2013 5 version of Twitter’s Employee Invention Assignment and Confidentiality Agreements, 6 ABOUAMMO and ALZABARAH each affirmed “a relationship of confidence and trust” 7 between themselves and Twitter “with respect to any information of a confidential or secret 8 nature that may be disclosed to [them] by the Company or a third party that relates to the 9 business of the Company.” The Employee Invention Assignment and Confidentiality Agreement 10 further required ABOUAMMO and ALZABARAH to “keep and hold all such Proprietary 11 Information in strict confidence and trust,” and defined “Proprietary Information” to include 12 Twitter’s “customer lists and data.” In executing the agreements, ABOUAMMO and 13 ALZABARAH affirmed that they would “not use or disclose any Proprietary Information 14 without the prior written consent of the Company” or “use[] any Company information for any 15 other business or employment.” 16 15. Twitter’s “Playbook Acknowledgement,” which ABOUAMMO and 17 ALZABARAH each signed during 2013, stated that each would read, understand, and abide by 18 Twitter’s policies, including the Security Handbook, which defined user data as confidential data 19 and prohibited sharing confidential data with third parties without approval. 20 16. Twitter’s “Gift Policy” during ABOUAMMO’s and ALZABARAH’s 21 employment stated: “[f]or gifts exceeding $100 in value, bring the gift to the attention of both 22 your manager and VP of HR before returning to sender.” 23 17. ABOUAMMO and ALZABARAH had access to proprietary and confidential 24 Twitter information, including information about Twitter users, such as the user-provided names 25 and birthdates, device identifiers, relationships, phone numbers, internet protocol (“IP”) 26 addresses and session IP histories, among other things. 27 18. Neither ABOUAMMO’s nor ALZABARAH’s job duties involved a need to 28 SUPERSEDING INFORM ATION, 19-CR-621 EMC 4 Case 3:19-cr-00621-EMC Document 42 Filed 04/07/20 Page 8 of 21 1 access a Twitter user’s private information, and doing so was a reportable violation of the 2 Twitter Playbook policies regarding handling and protecting user data. 3 19. Neither ABOUAMMO nor ALZABARAH had authority from Twitter to receive, 4 access, or produce user information pursuant to any governmental emergency disclosure request. 5 20. ABOUAMMO, ALZABARAH, and ALMUTAIRI have never provided notice to 6 the Attorney General that they were acting as agents of a foreign government. 7 8 THE SCHEME 21. ABOUAMMO and ALZABARAH fraudulently used their positions and access to 9 information at Twitter to provide Foreign Official-1 and others related to, and working for, the 10 government of KSA and the Saudi Royal Family with nonpublic information held in the accounts 11 of Twitter users. Using ALMUTAIRI as an intermediary, Foreign Official-1 provided 12 ABOUAMMO and ALZABARAH with gifts, cash payments, and promises of future 13 employment in exchange for nonpublic information about Twitter users, which constituted 14 valuable property, and which ABOUAMMO and ALZABARAH obtained fraudulently from 15 Twitter and provided to Foreign Official-1 and others without Twitter’s approval. 16 22. ABOUAMMO and ALZABARAH received from Foreign Official-1 and others 17 the names of Twitter accounts of interest to Foreign Official-1, members of the Saudi Royal 18 Family, and others in the government of KSA, including accounts posting information critical of, 19 or embarrassing to, the Saudi Royal Family and government of KSA. 20 23. Using their access privileges as employees and fiduciaries of Twitter, 21 ABOUAMMO and ALZABARAH, beyond the scope of their job duties, accessed nonpublic 22 account information of Twitter users of interest to the Saudi Royal Family and government of 23 KSA. Such nonpublic information included email addresses, telephone numbers, dates of birth, 24 and internet IP addresses, among other things. ABOUAMMO and ALZABARAH 25 communicated such nonpublic account information to Foreign Official-1 and others in the 26 government of KSA, contrary to Twitter policies. 27 24. In exchange for accessing nonpublic account information of Twitter users, outside 28 SUPERSEDING INFORM ATION, 19-CR-621 EMC 5 Case 3:19-cr-00621-EMC Document 42 Filed 04/07/20 Page 9 of 21 1 the scope of their job duties, and for communicating such nonpublic account information to 2 Foreign Official-1, contrary to Twitter’s policies, Foreign Official-1 rewarded ABOUAMMO 3 and ALZABARAH including with compensation such as gifts, cash payments, and promises of 4 future benefits, including employment. 5 25. ALMUTAIRI acted as an intermediary between Foreign Official-1 and 6 ABOUAMMO and ALZABARAH, representing KSA’s interests with respect to Twitter user 7 information, and met with ABOUAMMO and ALZABARAH in person at the request of, and to 8 further the goals of, Foreign Official-1 and the Saudi Royal Family. 9 26. The scheme involved the following acts, among others, which were committed or 10 caused to be committed, in the Northern District of California and elsewhere: 11 a. In April 2014, a Saudi public relations firm that represented the Embassy 12 of the Kingdom of Saudi Arabia contacted Twitter seeking to have the Twitter account of 13 a Saudi news personality verified. 14 b. On or about May 16, 2014, a representative of a U.S.-Saudi Arabian trade 15 organization in Washington, DC, emailed ABOUAMMO seeking to arrange a tour of 16 Twitter’s San Francisco office for a group of Saudi “entrepreneurs.” On June 13, 2014, a 17 delegation of individuals from Saudi Arabia visited the Twitter headquarters. The 18 delegation included Foreign Official-1 and other employees of Saudi Royal Family 19 Member-1. 20 21 22 c. On or about June 13, 2014, Foreign Official-1 emailed ABOUAMMO requesting verification of Saudi Royal Family Member-1’s Twitter account. d. On or about June 14, 2014, Foreign Official-1 requested ABOUAMMO’s 23 contact information. That same day, ABOUAMMO responded with his Twitter email 24 account, cell phone number, and personal Skype account. ABOUAMMO and Foreign 25 Official-1 spoke by telephone that date. 26 27 e. On or about November 15, 2014, ALMUTAIRI sent an email to ABOUAMMO requesting an “urgent meeting” in San Francisco to discuss their “mutual 28 SUPERSEDING INFORM ATION, 19-CR-621 EMC 6 Case 3:19-cr-00621-EMC Document 42 Filed 04/07/20 Page 10 of 21 1 interest.” On or about November 20, 2014, ALMUTAIRI and ABOUAMMO met in 2 person in San Francisco, California, near the Twitter headquarters. 3 f. ABOUAMMO and Foreign Official-1 communicated by telephone and by 4 email in late November and early December 2014 to coordinate an in-person meeting in 5 London, United Kingdom. Foreign Official-1 traveled from Paris, France to London and 6 met with ABOUAMMO. During that meeting on or about December 5, 2014, Foreign 7 Official-1 gave ABOUAMMO a valuable watch worth at least $20,000. ABOUAMMO 8 did not report the receipt of the watch to Twitter as required by Twitter. 9 g. Beginning on or about December 12, 2014, ABOUAMMO began 10 accessing without authorization through Twitter’s computer system the user data of 11 Twitter User-1, which was an account that had posted critical information about the Saudi 12 Royal Family and Saudi Royal Family Member-1. Among other account information, 13 ABOUAMMO accessed the email address and telephone number associated with Twitter 14 User-1’s account. ABOUAMMO accessed the account on or about December 12, 2014, 15 January 5, 2015, January 27, 2015, February 4, 2015, February 7, 2015, February 18, 16 2015, and February 24, 2015. 17 h. Foreign Official-1 communicated with ABOUAMMO by telephone 18 requesting that Twitter User-1’s account be removed from Twitter and requesting private 19 user account information. On January 17, 2015, Foreign Official-1 sent an email to 20 ABOUAMMO’s Twitter employee email account with an attachment concerning Twitter 21 User-1 and a brief message that stated, “as we discussed in london.” 22 i. On February 5, 2015, Foreign Official-1 sent an email to ABOUAMMO’s 23 Twitter employee email account with an attachment concerning a user identified as 24 Twitter User-2 who Foreign Official-1 asserted was impersonating a member of the Saudi 25 Royal Family. On February 7, 2015, ABOUAMMO accessed without authorization 26 through Twitter’s computer system the account information, including the email address, 27 of Twitter User-2. 28 SUPERSEDING INFORM ATION, 19-CR-621 EMC 7 Case 3:19-cr-00621-EMC Document 42 Filed 04/07/20 Page 11 of 21 1 j. On February 13, 2015, while ABOUAMMO worked for Twitter, Foreign 2 Official-1 deposited $100,000 into a recently opened bank account in Lebanon in the 3 name of ABOUAMMO’s relative. ABOUAMMO had online access to this account and 4 later received wire transfers from the account in Lebanon. On February 24, 2015, a wire 5 of $9,963 was sent from this account to a Bank of America account in the United States 6 in ABOUAMMO’s name. Also on February 24, 2015, ABOUAMMO accessed Twitter 7 User-1’s account. On March 8, 2015, ABOUAMMO sent Foreign Official-1 a Twitter 8 DM stating “proactive and reactively we will delete evil my brother.” On March 12, 9 2015, a wire of $9,911 was sent from the account in Lebanon referenced above to 10 11 ABOUAMMO’s Bank of America account. k. After ABOUAMMO resigned from Twitter on or about May 22, 2015, 12 Foreign Official-1 asked ABOUAMMO to, among other things, refer requests to Twitter 13 related to accounts of Saudi Arabian government ministers as well as complaints related 14 to certain accounts critical of or impersonating individuals connected to the government 15 of KSA or the Saudi Royal Family. Between May 22, 2015, when ABOUAMMO left 16 Twitter, and January 25, 2016, Foreign Official-1 paid ABOUAMMO at least $200,000. 17 l. Although Twitter employees requested that ABOUAMMO direct requests 18 from Saudi Arabian government officials directly to Twitter and not through 19 ABOUAMMO, ABOUAMMO continued attempting to contact Twitter employees with 20 Foreign Official-1’s requests until at least March 1, 2016. 21 m. On or before February 16, 2015, and prior to ABOUAMMO’s resignation 22 from Twitter, ABOUAMMO facilitated an introduction between ALZABARAH and 23 ALMUTAIRI. ALMUTAIRI maintained contact with ALZABARAH after 24 ABOUAMMO resigned from Twitter. 25 n. During mid-May 2015, Foreign Official-1 directed ALZABARAH to 26 travel from the Northern District of California to Fairfax, Virginia. On May 14, 2015, 27 while Saudi Royal Family Member-1, Foreign Official-1, and others were visiting 28 SUPERSEDING INFORM ATION, 19-CR-621 EMC 8 Case 3:19-cr-00621-EMC Document 42 Filed 04/07/20 Page 12 of 21 1 Washington, DC on an official delegation from KSA, ALMUTAIRI and ALZABARAH 2 met at the residence of an employee of the Saudi Arabian Embassy in Fairfax, Virginia. 3 Later on the same date, ALZABARAH returned to the Northern District of California. 4 o. After ALZABARAH returned to San Francisco, from May 21, 2015, 5 through November 18, 2015, he accessed without authorization through Twitter’s 6 computer system certain nonpublic account information of dozens of Twitter users, 7 including accounts that had posted critical or embarrassing information about the 8 government of KSA and Saudi Royal Family Member-1. ALZABARAH communicated 9 such nonpublic account information to Foreign Official-1 and others. 10 p. On May 29, 2015, Foreign Official-1 and ALZABARAH exchanged three 11 telephone calls and ALZABARAH accessed nonpublic account information of two 12 Twitter accounts over the course of approximately one hour. The same day, the 13 government of KSA submitted emergency disclosure requests to Twitter for those same 14 two Twitter accounts. 15 q. During July 2015, while ALZABARAH was on personal leave from 16 Twitter, he traveled to Saudi Arabia. While in Saudi Arabia, ALZABARAH accessed 17 nonpublic account information of hundreds of Twitter users using his Twitter credentials, 18 including on July 29, 2015, when ALZABARAH connected his Twitter laptop to 19 ALMUTAIRI’s company’s wireless local area network in Saudi Arabia. 20 r. ALZABARAH accessed Twitter User-1’s nonpublic account information 21 on or about May 21, 2015, June 14, 2015, July 5, 2015, August 6, 2015, August 7, 2015, 22 August 20, 2015, September 27, 2015, September 28, 2015, and September 30, 2015. On 23 September 28, 2015, ALZABARAH repeatedly accessed Twitter User-1’s nonpublic 24 account information, the same date the account holder reported that his account had been 25 hacked or compromised. 26 27 s. On December 2, 2015, after Twitter management confronted ALZABARAH about his unauthorized access of Twitter users’ accounts and placed him 28 SUPERSEDING INFORM ATION, 19-CR-621 EMC 9 Case 3:19-cr-00621-EMC Document 42 Filed 04/07/20 Page 13 of 21 1 on administrative leave, ALZABARAH attempted to contact ALMUTAIRI, and then 2 contacted Foreign Official-1, who in turn contacted an employee of the Saudi Arabian 3 Consulate in Los Angeles, California to coordinate ALZABARAH’s departure from the 4 United States. 5 6 t. On December 3, 2015, ALZABARAH flew to Saudi Arabia and submitted a resignation letter to Twitter by email. 7 u. By no later than January 2016, ALZABARAH had obtained employment 8 in Saudi Arabia with Organization-1 and was in email contact with ALMUTAIRI, 9 Foreign Official-1, and others regarding social media influence projects on behalf of 10 KSA, Foreign Official-1, and the Saudi Royal Family. 11 27. As part of the scheme, ABOUAMMO and ALZABARAH engaged in conduct 12 and made material false representations, promises, and omissions, and engaged in acts of 13 concealment, including, but not limited to, the following: 14 a. ABOUAMMO and ALZABARAH used private means of communication, 15 including personal telephones, email addresses, and Twitter DMs, to communicate with 16 representatives and officials of the government of KSA and Saudi Royal Family, 17 including ALMUTAIRI and Foreign Official-1, to avoid detection of the scheme by 18 Twitter. 19 b. ABOUAMMO concealed from Twitter his receipt of a watch valued at 20 more than $20,000 from Foreign Official-1, in exchange for accessing the nonpublic 21 account information of Twitter User-1 and Twitter User-2, and providing such nonpublic 22 information to Foreign Official-1 and others outside of Twitter. 23 c. ABOUAMMO concealed from Twitter his receipt of $100,000 from 24 Foreign Official-1, and his expectation of additional payments, in exchange for his access 25 and monitoring of Twitter accounts of interest to Foreign Official-1 and other members 26 of the government of KSA and the Saudi Royal Family. 27 d. ALZABARAH misled Twitter by taking a leave of absence during July 28 SUPERSEDING INFORM ATION, 19-CR-621 EMC 10 Case 3:19-cr-00621-EMC Document 42 Filed 04/07/20 Page 14 of 21 1 and August 2015, when, in fact, he was performing work for ALMUTAIRI and Foreign 2 Official-1 in Saudi Arabia, including accessing nonpublic account information of Twitter 3 users using his Twitter credentials and Twitter-issued computer. 4 e. ALZABARAH concealed from Twitter that he expected payments and 5 other benefits, including future employment in Saudi Arabia in exchange for providing 6 nonpublic account information of Twitter users to Foreign Official-1 and others acting on 7 behalf of KSA and the Saudi Royal Family. 8 f. 9 ALZABARAH misled Twitter by claiming he accessed Twitter accounts, specifically including Twitter User-1’s account, out of curiosity, when, in fact, he 10 accessed nonpublic information of numerous accounts for the benefit of Foreign Official- 11 1, KSA, and the Saudi Royal Family. 12 28. The scheme deprived Twitter of the following: (a) its money and property by 13 enabling individuals and entities outside of Twitter, including members of the government of 14 KSA and the Saudi Royal Family, access to nonpublic account information of Twitter users, 15 including information pertaining to accounts of dissidents and accounts that posted information 16 critical of, and embarrassing to, KSA, the Saudi Royal Family, and Saudi Royal Family 17 Member-1; and (b) Twitter’s intangible right to the honest services of its employees and 18 fiduciaries, ABOUAMMO and ALAZABARAH. 19 COUNT ONE: (18 U.S.C. §§ 951 and 2 – Acting as an Agent of a Foreign Government Without Notice to the Attorney General) 20 21 29. Paragraphs 1 through 28 are realleged as if fully set forth herein. 22 30. From on or about December 12, 2014, and continuing until on or about March 1, 23 2016, in the Northern District of California and elsewhere, the defendant, 24 25 26 27 AHMAD ABOUAMMO, did knowingly, without notifying the Attorney General as required by law, act as an agent of a foreign government, to wit, the government of the Kingdom of Saudi Arabia and the Saudi Royal Family. 28 SUPERSEDING INFORM ATION, 19-CR-621 EMC 11 Case 3:19-cr-00621-EMC Document 42 Filed 04/07/20 Page 15 of 21 1 All in violation of Title 18, United States Code, Section 951. 2 COUNT TWO: (18 U.S.C. §§ 951 and 2 – Acting as an Agent of a Foreign Government Without Notice to the Attorney General) 3 4 31. Paragraphs 1 through 28 are realleged as if fully set forth herein. 5 32. From at least on or about November 20, 2014, and continuing until at least on or 6 about May 24, 2015, in the Northern District of California and elsewhere, the defendant, 7 AHMED ALMUTAIRI, 8 did knowingly, without notifying the Attorney General as required by law, act as an agent of a 9 foreign government, to wit, the government of the Kingdom of Saudi Arabia and the Saudi Royal 10 Family. All in violation of Title 18, United States Code, Section 951. 11 12 COUNT THREE: (18 U.S.C. §§ 951 and 2 – Acting as an Agent of a Foreign Government Without Notice to the Attorney General) 13 14 33. Paragraphs 1 through 28 are realleged as if fully set forth herein. 15 34. From on or about May 21, 2015, and continuing until on or about December 3, 16 2015, in the Northern District of California and elsewhere, the defendant, ALI ALZABARAH, 17 18 did knowingly, without notifying the Attorney General as required by law, act as an agent of a 19 foreign government, to wit, the government of the Kingdom of Saudi Arabia and the Saudi Royal 20 Family. All in violation of Title 18, United States Code, Section 951. 21 22 COUNT FOUR: (18 U.S.C. § 1349 – Conspiracy to Commit Wire Fraud and Honest Services 23 Fraud) 24 35. Paragraphs 1 through 28 are realleged as if fully set forth herein. 25 36. From on or about November 20, 2014, until at least on or about December 3, 26 2015, in the Northern District of California and elsewhere, the defendants, 27 28 SUPERSEDING INFORM ATION, 19-CR-621 EMC AHMAD ABOUAMMO, ALI ALZABARAH, and AHMED ALMUTAIRI, 12 Case 3:19-cr-00621-EMC Document 42 Filed 04/07/20 Page 16 of 21 1 and others, did knowingly conspire to devise and intend to devise a scheme and artifice to 2 defraud Twitter, and to obtain property of Twitter by means of materially false and fraudulent 3 pretenses, representations, and promises, and by concealment of material facts and omissions of 4 material facts with a duty to disclose, and to deprive Twitter of its right to the honest and faithful 5 services of its employees and fiduciaries through bribes, and for the purpose of executing such 6 scheme and artifice, and attempting to do so, to transmit, and cause to be transmitted, by means 7 of wire communication in interstate and foreign commerce, certain writings, signs, signals, 8 pictures, and sounds, in violation of Title 18, United States Code, Sections 1343 and 1346. 9 All in violation of Title 18, United States Code, Section 1349. 10 COUNT FIVE THROUGH NINETEEN: (18 U.S.C. §§ 1343, 1346, and 2 –Wire Fraud and Honest Services Wire Fraud and Aiding and Abetting) 11 37. Paragraphs 1 through 28 and 36 are realleged as if fully set forth herein. 12 38. On or about the dates provided below, in the Northern District of California and 13 elsewhere, the defendants, 14 AHMAD ABOUAMMO, 15 ALI ALZABARAH, and AHMED ALMUTAIRI, 16 17 and others, did knowingly, and with the intent to defraud, participate in, devise, and intend to 18 devise a scheme and artifice to defraud Twitter, and to obtain property of Twitter by means of 19 materially false and fraudulent pretenses, representations, and promises, and by concealment of 20 material facts and omissions of material facts with a duty to disclose, and to deprive Twitter of 21 its right to the honest and faithful services of its employees and fiduciaries through bribes, and 22 attempting to do so, did knowingly transmit, and cause to be transmitted, the following writings, 23 signs, signals, pictures, and sounds in interstate and foreign commerce by means of wire 24 communications: 25 26 27 28 COUNT 5 DATE 3/8/2015 DESCRIPTION Twitter DM from ABOUAMMO’s personal Twitter account to Foreign Official-1 stating “proactive and reactively we will delete evil my brother.” 6 7/9/2015 Twitter DMs between ABOUAMMO’s personal Twitter Foreign Official-1 regarding Foreign Official-1’s “late” payment to SUPERSEDING INFORM ATION, 13 19-CR-621 EMC Case 3:19-cr-00621-EMC Document 42 Filed 04/07/20 Page 17 of 21 COUNT DATE 7 5/21/2015 DESCRIPTION ABOUAMMO and whether Foreign Official-1 needed assistance with Twitter matters. Telephone call between ALZABARAH and ALMUTAIRI. 8 5/29/2015 Telephone call between ALZABARAH and Foreign Official-1. 5 9 6/1/2015 Telephone call from Foreign Official-1 to ALZABARAH. 6 10 6/3/2015 Telephone call from Foreign Official-1 to ALZABARAH. 11 6/14/2015 Telephone call from ALZABARAH to Foreign Official-1. 12 7/17/2015 11 13 7/17/2015 12 14 7/17/2015 15 7/29/2015 16 7/29/2015 17 8/20/2015 Access by ALZABARAH to Twitter servers via virtual private network (“VPN”) from KSA to access information of a user identified as Twitter User-10 using his Twitter-issued computer while on personal leave. Access by ALZABARAH to Twitter servers via VPN from KSA to access information of a user identified as Twitter User-11. Access by ALZABARAH to Twitter servers from via VPN from KSA to access information of a user identified as Twitter User12. Access by ALZABARAH to Twitter servers from via VPN from KSA to access information of a user identified as Twitter User13. Access by ALZABARAH to Twitter servers from via VPN from KSA to access information of a user identified as Twitter User14. Telephone call from ALZABARAH to Foreign Official-1. 18 9/8/2015 Telephone call from Foreign Official-1 to ALZABARAH. 19 12/2/2015 Telephone call from ALZABARAH to Foreign Official-1. 1 2 3 4 7 8 9 10 13 14 15 16 17 18 19 20 21 Each in violation of Title 18, United States Code, Sections 1343, 1346, and 2. 22 23 COUNT TWENTY: (18 U.S.C. § 1956(a)(2)(B)(i) – Money Laundering) 24 39. Paragraphs 1 through 28, 36, and 38 are realleged as if fully set forth herein. 25 // 26 27 // 28 SUPERSEDING INFORM ATION, 19-CR-621 EMC 14 Case 3:19-cr-00621-EMC Document 42 Filed 04/07/20 Page 18 of 21 1 40. On or about March 10, 2015, in the Northern District of California and elsewhere, 2 the defendant, 3 AHMAD ABOUAMMO, 4 did knowingly conduct a financial transaction affecting interstate and foreign commerce, to wit, 5 transporting, transmitting, and transferring monetary instruments and funds, that is, a total of 6 $9,911 in United States currency, transferred from a Bank Audi account in Beirut, Lebanon into 7 an account in the United States controlled by ABOUAMMO, such funds constituting the 8 proceeds of a specified unlawful activity, that is, wire fraud, honest services fraud, and 9 conspiracy, in violation of 18 U.S.C. §§ 1343 1346, and 1349, knowing that such transfer was 10 designed in whole or in part to conceal and disguise the nature, source, and ownership of the 11 proceeds of said specified unlawful activity and that while conducting such financial transaction 12 knew that the property involved in the financial transaction represented the proceeds of some 13 form of unlawful activity. 14 All in violation of Title 18, United States Code, Section 1956(a)(2)(B)(i). 15 COUNT TWENTY-ONE: (18 U.S.C. § 1956(a)(2)(B)(i) – Money Laundering) 16 41. Paragraphs 1 through 28, 36, and 38 are realleged as if fully set forth herein. 17 42. On or about June 11, 2015, in the Northern District of California and elsewhere, 18 the defendant, 19 AHMAD ABOUAMMO, 20 did knowingly conduct a financial transaction affecting interstate and foreign commerce, to wit, 21 transporting, transmitting, and transferring monetary instruments and funds, that is, a total of 22 $10,000 in United States currency, transferred from a Bank Audi account in Beirut, Lebanon into 23 an account in the United States controlled by ABOUAMMO, such funds constituting the 24 proceeds of a specified unlawful activity, that is, wire fraud, honest services fraud, and 25 conspiracy, in violation of 18 U.S.C. §§ 1343, 1346, and 1349, knowing that such transfer was 26 designed in whole or in part to conceal and disguise the nature, source, and ownership of the 27 proceeds of said specified unlawful activity and that while conducting such financial transaction 28 SUPERSEDING INFORM ATION, 19-CR-621 EMC 15 Case 3:19-cr-00621-EMC Document 42 Filed 04/07/20 Page 19 of 21 1 knew that the property involved in the financial transaction represented the proceeds of some 2 form of unlawful activity. 3 All in violation of Title 18, United States Code, Section 1956(a)(2)(B)(i). 4 COUNT TWENTY-TWO: (18 U.S.C. § 1956(a)(2)(B)(i) – Money Laundering) 5 43. Paragraphs 1 through 28, 36, and 38 are realleged as if fully set forth herein. 6 44. On or about July 2, 2015, in the Northern District of California and elsewhere, the 7 defendant, 8 AHMAD ABOUAMMO, 9 did knowingly conduct a financial transaction affecting interstate and foreign commerce, to wit, 10 transporting, transmitting, and transferring monetary instruments and funds, that is, a total of 11 $30,000 in United States currency, transferred from a Bank Audi account in Beirut, Lebanon into 12 an account in the United States controlled by ABOUAMMO, such funds constituting the 13 proceeds of a specified unlawful activity, that is, wire fraud, honest services fraud, and 14 conspiracy, in violation of 18 U.S.C. §§ 1343, 1346, and 1349, knowing that such transfer was 15 designed in whole or in part to conceal and disguise the nature, source, and ownership of the 16 proceeds of said specified unlawful activity and that while conducting such financial transaction 17 knew that the property involved in the financial transaction represented the proceeds of some 18 form of unlawful activity. 19 All in violation of Title 18, United States Code, Section 1956(a)(2)(B)(i). 20 COUNT TWENTY-THREE: (18 U.S.C. § 1519 – Falsification of Records to Obstruct 21 Investigation) 22 45. Paragraphs 1 through 28, 36, and 38 are realleged as if fully set forth herein. 23 46. On or about October 20, 2018, in the Northern District of California and 24 elsewhere, the defendant, 25 AHMAD ABOUAMMO, 26 unlawfully, intentionally, and knowingly did alter, destroy, mutilate, conceal, and falsify a record 27 or document, namely creating and providing by email to the Federal Bureau of Investigation a 28 SUPERSEDING INFORM ATION, 19-CR-621 EMC 16 Case 3:19-cr-00621-EMC Document 42 Filed 04/07/20 Page 20 of 21 1 fabricated, false, and backdated invoice for $100,000 for consulting services to Foreign Official2 1, from CYRCL, LLC, defendant’s sole proprietorship, with the intent to impede, obstruct and 3 influence an actual and contemplated investigation and the proper administration of a matter 4 within the jurisdiction of a department and agency of the United States, namely the Federal 5 Bureau of Investigation. 6 All in violation of Title 18, United States Code, Section 1519. 7 FORFEITURE ALLEGATION: (18 U.S.C. §§ 981(a)(1)(C), 982(a)(1); 28 U.S.C. § 2461(c)) 8 47. Paragraphs 1 through 46 are hereby realleged for the purpose of alleging 9 forfeiture to the United States of America pursuant to Title 18, United States Code, Section 10 981(a)(l)(C) and Title 28, United States Code, Section 2461(c). 11 48. Upon conviction of any of the offenses in violation of Title 18, United States 12 Code, Sections 1343, 1346, and 1349 set forth in Counts Four through Nineteen of this 13 Superseding Information, or any of them, the defendants, 14 AHMAD ABOUAMMO, ALI ALZABARAH, and AHMED ALMUTAIRI, 15 16 17 shall forfeit to the United States of America, pursuant to Title 18, United States Code, Section 18 981(a)(1)(C) and Title 28, United States Code, Section 2461(c), any property, real or personal, 19 which constitutes or is derived from proceeds traceable to the offenses, including the sum of 20 money equal to the total amount of proceeds defendants obtained or derived, directly or 21 indirectly, from the violations, and including a forfeiture money judgment. 22 49. Upon conviction of the offenses in violation of Title 18, United States Code, 23 Section 1956 alleged in Counts Twenty through Twenty-Two of this Superseding Information, 24 the defendant, 25 AHMAD ABOUAMMO, 26 shall forfeit to the United States, pursuant to Title 18, United States Code, Section 982(a)(1), all 27 property, real or personal, involved in said violation, or any property traceable to such property, 28 SUPERSEDING INFORM ATION, 19-CR-621 EMC 17 Case 3:19-cr-00621-EMC Document 42 Filed 04/07/20 Page 21 of 21 1 and including all proceeds of the offense, and including, but not limited to, a forfeiture money 2 judgment. 3 50. If any of the property described above, as a result of any act or omission of the 4 defendant: 5 a. cannot be located upon the exercise of due diligence; 6 b. has been transferred or sold to, or deposited with, a third party; 7 c. has been placed beyond the jurisdiction of the court; 8 d. has been substantially diminished in value; or 9 e. has been commingled with other property which cannot be divided without 10 difficulty; 11 the United States of America shall be entitled to forfeiture of substitute property pursuant to Title 12 21, United States Code, Section 853(p), as incorporated by Title 28, United States Code, Section 13 2461(c). 14 All pursuant to Title 18 United States Code, Sections 981(a)(1)(C), 982(a)(1), Title 28 15 United States Code, Section 2461(c), and Federal Rule of Criminal Procedure 32.2. 16 SENTENCING ALLEGATION: 17 47. With respect to Counts One and Four through Seven of the Superseding 18 Information, for the purposes of determining the maximum alternative fine, pursuant to Title 18, 19 United States Code, Section 3571(d), the defendant, 20 AHMAD ABOUAMMO, 21 derived gross gains of approximately $320,000. 22 DAVID L. ANDERSON United States Attorney 23 24 Dated: April 7, 2020. /s/ Colin Sampson COLIN SAMPSON Assistant United States Attorney 25 26 Approved as to Form: 27 /s/ Benjamin Hawk BENJAMIN HAWK 28 Trial Attorney, National Security Division SUPERSEDING INFORM ATION, 19-CR-621 EMC 18