USA v. Abouammo et al Document 1: Complaint

California Northern District Court
Case No. 3:19-mj-71824-MRGD-1
Filed November 5, 2019

COMPLAINT as to Ahmad Abouammo (1), Ahmed Almutairi (2), Ali Alzabarah (3). (lskS, COURT STAFF) (Filed on 11/5/2019) (jlgS, COURT STAFF).

BackBack to USA v. Abouammo et al

Tags No tags have been applied so far. Sign in to add some.

  Formatted Text Tab Overlap Raw Text Right End
Page 1 AQ 91 (Rev. 11/11) Criminal Complaint
UNITED STATES DISTRICT
for the

Northern District of California





United States of America )
Vv. )
AHMAD ABOUAMMO; ) Case No.
AHMED ALMUTAIRI, a/k/a AHMED ALJBREEN; i Chen rl and ALI ALZABARAH, nt? 1894 MOpr hu
) 8 LOHGLOR’ Hogs
) Tr
Defendant(s) 4 S$ |
CRIMINAL COMPLAINT
I, the complainant in this case, state that the following is true to the best of my knowledge and belief.
On or about the date(s) of 11/20/2014 to 10/20/2018 in the county of San Francisco in the
Northern District of California , the defendant(s) violated:
Code Section Offense Description
18 U.S.C. § 951; Acting as Agent of Foreign Government Without Notice to Attorney General;
and and
18 U.S.C. § 1519 Destruction, Alteration, or Falsification of Records in Federal Investigations
This criminal complaint is based on these facts:
See attached affidavit *
@ Continued on the attached sheet.

Complainant ¥ signature
Letitia Wu, Special Agent, FBI
Printed name and title

Sworn to before me and signed in my presence.
om le he Jur LY
Judge ’s signature
\

City and state: San Francisco, California Hon. Thomas S. Hixson, U.S. Magistrate Judge \
Printed name and title per )
\

A
f
ie
Page 2 1]



I, Letitia L. Wu, a Special Agent with the Federal Bureau of Investigation (“FBI”) in Palo Alto,
California, being first duly sworn, hereby depose and state the following:
I. PURPOSE OF AFFIDAVIT AND CRIMINAL CHARGES
1. I submit this affidavit in support of a Criminal Complaint that charges defendants Ali
ALZABARAH, Ahmed ALMUTAIRI, also known as Ahmed Aljbreen, and Ahmad ABOUAMMO
with violations of 18 U.S.C. § 951 and ABOUAMMO with a violation of 18 U.S.C. § 1519.
2. Specifically, from at least in or about November 20, 2014, up to and including in or about
May 24, 2015, in the Northern District of California and elsewhere, ALMUTAIRI, the defendant, did
knowingly act in the United States as an agent of a foreign government, specifically, ALMUTAIRI
acted within the United States under the direction and control of the Kingdom of Saudi Arabia and
foreign officials working on behalf of the Kingdom of Saudi Arabia, without prior notification to the
Attorney General, as required by law, in violation of 18 U.S.C. § 951.
3. Beginning no later than December 12, 2014, until at least March 12, 2015, in the
Northern District of California and elsewhere, ABOUAMMO, the defendant, did knowingly act in the
United States as an agent of a foreign government, specifically, ABOUAMMO acted within the United
States under the direction and control of the Kingdom of Saudi Arabia and foreign officials working on
behalf of the Kingdom of Saudi Arabia, without prior notification to the Attorney General, as required
by law, in violation of 18 U.S.C. § 951.
4. Further, beginning at least in or about May 21, 2015, up to and including in or about
December 2015, in the Northern District of California and elsewhere, ALZABARAH, the defendant, did
knowingly act in the United States as an agent of a foreign government, specifically, ALZABARAH
acted within the United States under the direction and control of the Kingdom of Saudi Arabia and
foreign officials working on behalf of the Kingdom of Saudi Arabia, without prior notification to the
Attorney General, as required by law, in violation of 18 U.S.C. § 951.
5. On October 20, 2018, in the Northern District of California and elsewhere,
ABOUAMMO, the defendant, unlawfully, intentionally, and knowingly did alter, destroy, mutilate,
conceal, and falsify a record or document, namely creating and providing by email to the Federal Bureau
of Investigation a fabricated, false, and backdated invoice for $100,000 for consulting services to
AFFIDAVIT OF FBI SA LETITIA WU |
Page 3



Foreign Official-1, from CYRCL, LLC, defendant’s sole proprietorship, with the intent to impede,
obstruct and influence an actual or contemplated investigation of a matter within the jurisdiction of a
department or agency of the United States, namely the Federal Bureau of Investigation, in violation of
Title 18, United States Code, Section 1519.
IL. AGENT QUALIFICATIONS
6. Iam a Special Agent with the FBI, and have been since July 2015. I am currently
assigned to the Counterintelligence Division within the San Francisco Field Office of the FBI. In my
capacity as a Special Agent, my duties and the training that I have received include the investigation of
violations of federal criminal law, including counterintelligence related offenses and cybercrimes (such
as acting as an agent of a foreign government without notification to the Attorney General, economic
espionage, theft of trade secrets, and computer fraud and abuse violations).
7. The facts in this Affidavit come from my personal observations, my training and
experience, and information obtained from other agents, law enforcement personnel, and witnesses.
8. Unless otherwise noted, wherever in this Affidavit I recount a statement, including
written statements made by another person, that statement is recounted in substance and in relevant part.
Statements in quotation marks, if any, are based on preliminary translations or transcriptions, and review
of or interpretations of communications, all of which may be subject to revision.
9. Unless otherwise stated, all times listed in this Affidavit are Pacific Time and are
approximate times.
10. This affidavit is intended to show merely that there is sufficient probable cause for the
requested warrant and does not set forth all of my knowledge about this matter.
IW. BACKGROUND
11. Twitter, Inc. (“Twitter”) is a company headquartered in San Francisco, California, and
owns and operates a free-access social-networking website of the same name that can be accessed at
http://www.twitter.com. Users of Twitter, including private individuals, journalists, and public figures,
create user accounts that can be used to communicate and share information instantly through “Tweets”
(i.e., 140-character messages prior to 2017) to the public at large, “tweets” to a subset of Twitter users
AFFIDAVIT OF FBI SA LETITIA WU 2
Page 4



(e.g., to the public or to certain users that “follow” a user), “retweets” by one user of another user, or
direct messages that are typically visible only to the sender and recipient.
12. Twitter operates its service in many languages, including English and Arabic. Many
Twitter users live in Saudi Arabia and some users of Saudi nationality or descent live outside of Saudi
Arabia, including in the United States. Twitter has access to and maintains data about each of its users,
and Twitter’s privacy policy outlines the circumstances in which the data maintained by Twitter about
its users may be disclosed, sold, or transferred. Twitter considers its user data to be valuable, and uses it
for tailoring revenue-generating advertisements to its users, as well as supplying engaging content and
other purposes.
13. Title 18, United States Code, Section 2702, provides that service providers of electronic
communications and remote computing services, such as Twitter, may voluntarily disclose user data to a
governmental entity, if the service provider, in good faith, believes than an emergency involving danger
of death or serious physical injury to any person requires disclosure without delay of data relating to the
emergency.
14. The Kingdom of Saudi Arabia (“KSA”) is a monarchy governed by the Saudi King and
his Royal Court, which is akin to a cabinet or executive office. Members of the King’s Royal F amily
hold most of the country’s important posts.
15, From at least in or about June 2, 2014, up to and including in or about December 3, 2015,
a foreign official of the Kingdom of Saudi Arabia who is not identified by name (“Foreign Official-1”)
was the secretary general of a charitable organization (“Organization No. 1”) of a member of the Saudi
Arabian Royal Court (“Royal Family Member-1”). Beginning May 3, 2015, Foreign Official-1 listed
his employer on his U.S. visa application as the “Royal Court.”
16. Ali Hamad ALZABARAH is a citizen of Saudi Arabia and resided in San Bruno,
California from at least 2014 until December 3, 2015. Funded by a Saudi Arabian scholarship,
ALZABARAH entered the United States in 2005 and studied and obtained degrees in computer science
from various universities in the United States. From in or about August 2013 to in or around December
2015, ALZABARAH worked as a site reliability engineer at Twitter in San Francisco, California.
AFFIDAVIT OF FBISA LETITIA WU 3
Page 5 i



17. Ahmad ABOUAMMO is a United States citizen and resided in the Northern District of
California from at least November 2013 until May 22, 2015, and thereafter resided in Seattle,
Washington. ABOUAMMO was an employee of Twitter, Inc. from on or about November 3, 2013 to
May 22, 2015. ABOUAMMO was a Media Partnerships Manager responsible for the Middle East and
North Africa (“MENA”) region at Twitter. ABOUAMMO was involved in assisting notable accounts of
public interest, brands, journalists, and celebrities for the MENA region with content, Twitter strategy,
and sharing best practices.
18. Ahmed ALMUTAIRI, also known as Ahmed ALJBREEN, is a Saudi citizen.
ALMUTAIRI was present in the United States of America between approximately August 21, until approximately May 24, 2015. From at least May 2014 to the present, ALMUTAIRI has controlled
a Saudi social media marketing company that does work for Organization No. | and members of the
Saudi Royal Family, including Royal Family Member-1. ALMUTAIRI traveled to the United States on
a student visa in August 2014 for the purpose of studying English in the San Francisco Bay Area.
19. .ABOUAMMO and ALZABARAH had access to proprietary and confidential Twitter
information, including information about Twitter users, including the user-provided email addresses,
birthdates, phone number, and internet protocol (“IP”) addresses.
20. Twitter employees, including ABOUAMMO and ALZABARAH, agree to abide by the
Twitter “Playbook” which outlines the policies Twitter employees must obey as part of their
employment. Twitter’s 2013 employment contracts with ABOUAMMO and ALZABARAH, prohibited
them from engaging in outside employment or consulting “or any other business activity that would
create a conflict of interest with the Company.” Twitter’s 2013 Employee Invention Assignment and
Confidentiality Agreements with ABOUAMMO and ALZABARAH affirmed “a relationship of
confidence and trust” between Twitter and each employee “with respect to any information of a
confidential or secret nature that may be disclosed to me by the Company or a third party that relates to
the business of the Company” and defined “Proprietary Information” to include “customer lists and
data.” The Employee Invention Assignment and Confidentiality Agreement further required
ABOUAMMO and ALZABARAH to “keep and hold all such Proprietary Information in strict
confidence and trust. I will not use or disclose any Proprietary Information without the prior written
AFFIDAVIT OF FBI SA LETITIA WU 4
Page 6



consent of the Company” and required them during their employment not to “use[] any Company
information for any other business or employment.”
21. Twitter’s “Playbook Acknowledgement,” which ABOUAMMO and ALZABARAH each
signed during 2013, stated that each would read, understand, and abide by Twitter’s policies, including
the Security Handbook, which defined user data as confidential data and prohibited sharing confidential
data with third parties without approval.
22. Twitter’s “Gift Policy” during ABOUAMMO and ALZABARAH’s employment stated:
“flor gifts exceeding $100 in value, bring the gift to the attention of both your manager and VP of HR
before returning to sender.”
23. Neither ABOUAMMO nor ALZABARAH’s job duties included a need to access a
Twitter user’s private information, and doing so was a reportable violation of the Twitter Playbook
policies regarding protecting user data. Since December 2015, Twitter has enhanced its controls and
permissions to restrict access to user information only to those whose duties require access.
24. As of November 1, 2019, ALZABARAH, ALMUTAIRI, and ABOUAMMO have not
provided notification to the Attorney General that they were acting as an agent of a foreign government.
IV. SAUDI ARABIA’S USE OF ABOUAMMO AND ALZABARAH TO OBTAIN PRIVATE
TWITTER USER DATA ON BEHALF OF THE KINGDOM OF SAUDI ARABIA
A. ABOUAMMO’s Contact With AHMED ALMUTAIRI and Foreign Official-1 Starting in
June 2014 and Meeting With Foreign Official-1 in the United States and the United
Kingdom
25. Foreign Official-1, on behalf of KSA, began cultivating employees of Twitter in an effort
to obtain private user information that it could not obtain elsewhere.
26. In April 2014, according to emails from Twitter, a public relations firm representing the
Embassy of the Kingdom of Saudi Arabia contacted Twitter and asked for assistance in verifying the
Twitter account of a Saudi Arabian news personality. Twitter assigned the task to ABOUAMMO. In an
email, ABOUAMMO explained to the public relations firm that he was heading the media partnerships
for the MENA region, and part of his job was to work with media partners to share best practices and
work on Twitter strategy. ABOUAMMO also asked the public relations firm to let him know if they
have any other requests regarding the Saudi government.
AFFIDAVIT OF FBI SA LETITIA WU 5
Page 7 oO SDN
\o




27. On or about May 16, 2014, a representative from the U.S.-Saudi Arabian Business
Council in Vienna, VA, emailed ABOUAMMO and asked him to arrange a tour of Twitter’s San
Francisco office for a group of Saudi “entrepreneurs.” ABOUAMMO agreed and coordinated with
others at ‘I'witter to schedule the tour for June 13, 2014. A follow-up email informed ABOUAMMO
that the attendees would include Foreign Official-1, who subsequently (in early 2015) became the head
of Royal Family Member-1’s private office. On the day of the tour, June 13, 2014, ABOUAMMO
emailed his telephone number to Foreign Official-1. The email subject stated “contact for ahmad” and
the body of the message contained only ABOUAMMO’s ten-digit personal phone number and his
signature block.
28. Also on the day of the tour, Foreign Official-1 emailed ABOUAMMO about verifying
the Twitter account of Royal Family Member-1, indicating that Foreign Official-1 was working for and
at the direction of Royal Family Member-1 with respect to his online presence on the Twitter platform.
29. On June 14, 2014, Foreign Official-1 emailed ABOUAMMO and asked for
ABOUAMMO’s contact information, ABOUAMMO responded by email with his Twitter email
address and his personal Skype account, and again provided his personal telephone number. On that
date, at approximately 3:36 p.m. Pacific, toll records show Foreign Official-1 contacting ABOUAMMO
in a telephone call that lasted approximately 1 minute, 47 seconds. Subsequently, on June 15 and 17,
2014, Foreign Official-1 emailed ABOUAMMO two photographs — one of Foreign Official-1 with
ABOUAMMO, and another of Foreign Official-1, ABOUAMMO, and the group of visitors to Twitter
on June 13, 2014.
30. Inor around late November 2014, Foreign Official-1 and ABOUAMMO communicated
by telephone and email to coordinate an in-person meeting in London, United Kingdom, in early
December 2014. For example, on November 20, 2014, ABOUAMMO emailed Foreign Official-through ABOUAMMO’s Twitter account and asked if Foreign Official-1 had finalized his trip to
London and informed Foreign Official-1 that he would be in London between December 1, 2014 and
December 5, 2014. ABOUAMMO traveled to London, United Kingdom on November 29, 2014 to
attend a Twitter global media summit.
AFFIDAVIT OF FBI SA LETITIA WU 6
Page 8



31, Around this same time, ABOUAMMO also met with Ahmed ALMUTAIRI, whose
company does work for Foreign Official-1’s charitable organization. On November 15, 2014,
ALMUTAIRI sent an email to ABOUAMMO requesting an “urgent meeting” in San Francisco to
discuss their “mutual interest.” ALMUTAIRI explained he was the advisor for a “VVIP 1* Degree
Member of the Saudi Royal Family.” On November 20, 2014, ALMUTAIRI met with ABOUAMMO
in front of the Twitter office in San Francisco, California, and posted a photograph of himself with
ABOUAMMO on ALMUTAIRI’s Twitter account. On December 1, 2014, prior to ABOUAMMO’s
meeting with Foreign Official-1 in London, ALMUTAIRI emailed ABOUAMMO at his Twitter account
and stated, “I’m quite confident that by both of us cooperating and working together, we’ll achieve the
goals of Twitter in the region.”
32. Foreign Official-1 emailed ABOUAMMO on December 4, 2014, and stated “I’m in Paris
I will come to london tomorrow for one day to meet you on Friday. When IJ arrive | will call you.” The
next day, December 5, 2014, Foreign Official-1 contacted ABOUAMMO by telephone in a call that
lasted approximately four seconds, and Foreign Official-1 and ABOUAMMO met in person in London,
United Kingdom. On December 6, 2014, ABOUAMMO returned to San Francisco.
33. As discussed below, I met with ABOUAMMO on October 20, 2018, and ABOUAMMO
told me at that time that, while in London, Foreign Official-1 gave him a watch. Records obtained by
the FBI show that, on or about December 27, 2014, ABOUAMMO contacted an online consignment
store for luxury watches about a Hublot Unico Big Bang King Gold Ceramic watch. The consignment
store offered to sell the watch for $20,000. In January 2015, ABOUAMMO responded to
advertisements of potential buyers looking for luxury watches on Craigslist.org, claiming his watch,
which he stated he purchased in London, U.K., was worth $35,000 and that he would accept an offer of
no less than $25,000. At the request of the FBI, a United Kingdom law enforcement official visited the
store where ABOUAMMO had claimed in his online communications to have purchased the watch,
however, the store informed the law enforcement official that it did not carry or sell the Hublot Unico
Big Bang King Gold Ceramic watch.
//
AFFIDAVIT OF FBI SA LETITIA WU 7
Page 9 “ao nn D
oO




B. ABOUAMMO’s Unauthorized Access of Private Twitter User Data and Continued
Contact With Foreign Official-
34, Within one week of ABOUAMMO’s meeting in London with Foreign Official-1,
ABOUAMMO began accessing private Twitter user information of interest to Foreign Official-1 and the
Saudi Royal Family.
35. On December 12, 2014, ABOUAMMO accessed Twitter User-1’s email address through
Twitter’s computer systems. Based on the FBI’s review of Twitter User-1’s public postings, Twitter
User-1 was a prominent critic of the Kingdom of Saudi Arabia and the Royal Family with over
1,000,000 Twitter followers. ABOUAMMO accessed Twitter User-1’s email address again on January
5, 2015, January 27, 2015, February 4, 2015, February 7, 2015, February 18, 2015, and February 24,
2015.
36. | Onor about January 17, 2015, Foreign Official-1 began communicating with
ABOUAMMO on ABOUAMMC?’s personal email in addition to his Twitter email account. On January
17, 2015, Foreign Official-1 emailed ABOUAMMO at ABOUAMMO’s personal email and stated only
“as we discussed in london...” Foreign Official-1 attached to the email a document that discussed how
‘twitter User-1 had violated both Twitter policy and Saudi laws. On January 20, 2015, Foreign Official-
1 called ABOUAMMO twice (the calls lasting 19 seconds and 51 seconds, respectively). On January
22, 2015, Foreign Official-1 called ABOUAMMO seven times (no answer, 6 seconds, 5 seconds, seconds, 4 minutes 37 seconds, 3 minutes 36 seconds, and 39 seconds, respectively). ABOUAMMO
also accessed the email address provided by user @KingSalman the same day. The handle
@KingSalman was the Twitter Account for Saudi King Salman bin Abdulaziz Al Saud. Foreign
Official-1 called ABOUAMMO on January 23, 24, and twice on January 25, 2015 (1 minute 57 seconds,
no answer, 1 minute 57 seconds, and 6 seconds, respectively). On January 27, 2015, ABOUAMMO
accessed Twitter User-1’s user email address again. The next day, Foreign Official-1 called
ABOUAMM6O three times (11 seconds, 5 seconds, and no answer).
37, On February 3, 2015, Foreign Official-1 forwarded ABOUAMMO an email from Twitter
Support revealing that Foreign Official-1 filed a complaint with Twitter against Twitter User-2, who was
impersonating a member of the Saudi Royal Family. The email indicated Foreign Official-1 filed a
AFFIDAVIT OF FBI SA LETITIA WU 8
Page 10 oo N DN MN bo
\o




report with Twitter advising he was the representative of the individual being impersonated by Twitter
User-2. Based on the FBI’s review of the Twitter User-2’s public postings, Twitter User-2 appeared to
be a critic of the Kingdom of Saudi Arabia and the Royal Family. ‘Twitter Support requested Foreign
Official-1 provide proof that he is authorized to represent the individual. On that same day,
ABOUAMM0O’s close relative residing in Beirut, Lebanon, opened a Lebanese bank account at the
Beshara El-Khoury branch of Bank Audi in Beirut (“Bank Audi Account”) and the account later
received payments that were later disbursed to ABOUAMMO's account in the United States, discussed
below. On February 4, 2015, ABOUAMMO accessed Twitter User-1’s user information again and was
able to view account information, including the email address and telephone number associated with
Twitter User-1’s account. According to a Twitter Security Engineer that FBI interviewed, the amount of
information a Twitter employee can view through Twitter computer systems depended on both the user-
provided information and the level of access of the Twitter employee.
38. On February 5, 2015, Foreign Official-1 emailed ABOUAMMO at his Twitter account
and attached a document written in Arabic and translated with the banner, “Urgent Report - Secret and
private” that discussed tweets by Twitter User-2. On February 7, 2015, ABOUAMMO accessed Twitter
User-1’s email address and phone number as well as Twitter User-2’s email address.
39. On February 9, 2015, ABOUAMMO registered the website for CYRCL, LLC at
http://cyrcl.co, As discussed below, ABOUAMMO used this limited liability company to receive
$100,000 USD from Foreign Official-1 in 2016. On February 12 and 13, 2015, Foreign Official-1 called
ABOUAMM6O five times (7 minutes 28 seconds, 1 minute 24 seconds, 2 minutes 10 seconds on
February 12, 2015, and 15 and 17 seconds on February 13, 2015). On February 13, 2015, Foreign
Official-1 sent a $100,000 wire transfer to ABOUAMMO’s close relative in Beirut, Lebanon.
40. On February 16, 2015, Foreign Official-1 called ABOUAMMO three times. Two days
later, ABOUAMMO accessed Twitter Uscr-1’s email address and phone number. On February 19,
2015, ABOUAMMO created an online user ID and password to access the Bank Audi Account his close
relative opened in Lebanon on February 3, 2015, On February 24, 2015, ABOUAMMO accessed
Twitter User-1’s email address and phone number. On the same day, a $9,963 wire transfer was sent
AFFIDAVIT OF FBI SA LETITIA WU 9
Page 11 oO Oo NN DH




from the Lebanon Bank Audi Account to ABOUAMMO’s Bank of America account ending in (“Bank of America Account”).
Al. On March 5, 2015, Foreign Official-1 called AROUAMMO 11 times. Foreign Official-also called ABOUAMMO three times on March 6, 2015. On March 8, 2015, ABOUAMMO sent
Foreign Official-1 a Twitter direct message stating “proactive and reactively we will delcte evil my
brother.” On March 12, 2015, a $9,911 wire transfer was sent from the Lebanon Bank Audi Account to
ABOUAMMO’s Bank of America Account.
42. On May 22, 2015, ABOUAMMO resigned from his position at Twitter. In sum,
ABOUAMM0O accessed Twitter User-1’s email address and phone number between January 5, 2015,
and February 24, 2015 and accessed Twitter User-2’s email address on February 7, 2015. Based on
information provided by Twitter and ABOUAMMO’s former supervisor at Twitter, ABOUAMMO had
no legitimate business use as a Media Partnerships Manager for accessing users’ account information,
and doing so would have been a violation of the company’s policies.
C. ABOUAMMO Ouits Twitter and Moves to Seattle but Continues Contact With and
Accepts Money from Foreign Official-1 Through a Relative’s Foreign Account
43. Even after ABOUAMMO left Twitter, Foreign Official-1 paid him for services rendered
and for continuing to contact Twitter employees on behalf of KSA officials.
44. In late May 2015, ABOUAMMO moved from the San Francisco Bay Area to Seattle,
Washington for a new job. After ABOUAMMO started his new job, Foreign Official-1 continued to
contact him with requests for Twitter to take action on certain user accounts, including requests to shut
down certain accounts for violating Twitter’s terms of service and to verify certain official users at
Twitter. ABOUAMMO attempted to facilitate Foreign Official-1’s requests by contacting his former
colleagues at Twitter.
45, While facilitating requests from Foreign Official-1, ABOUAMMO continued to transfer
money from the Bank Audi Account to the Bank of America Account. On June 15, 2015, a $10,wire transfer was sent from the Bank Audi Account to the Bank of America Account which was then
used as part of ABOUAMMO’s down payment for his new residence. A July 7, 2015, a $30,000 wire
AFFIDAVIT OF FBI SA LETITIA WU 10
Page 12 SND
ow
il



transfer was sent from the Bank Audi Account to the Bank of America Account with a notation that it
was part of a “down payment of an appartment [sic] in USA.”
46. Two days later, on July 9, 2015, Foreign Official-1 sent ABOUAMMO a wire transfer
receipt through Twitter direct message showing he had wired $100,000 from the National Commercial
Bank in Saudi Arabia to the Bank Audi Account. Along with the wire transfer receipt, Foreign Official-
1 apologized for the late response. ABOUAMMO then responded asking whether Foreign Official-needed anything from Twitter. On July 13, 2015, ABOUAMMO emailed Twitter Support and requested
verification (a form of authentication by Twitter that an account actually belongs to a notable individual,
organization, or company) of the Twitter account @majedhogail, which is used by the Minister of
Housing of the Kingdom of Saudi Arabia. On July 30, 2015, ABOUAMMO submitted a cashier’s
check for $56,495.30 toward down payment for a residence in Seattle.
47. On August 23, 2015, Foreign Official-1 called ABOUAMMO (3 minutes and seconds). Then on September 8, 2015, Foreign Official-1 emailed ABOUAMMO at ABOUAMMO’S
personal email and attached two documents — one discussing the Saudi penaltics for hacking,
unauthorized access of information, violation of privacy and defamation of other; the other document
discussing the Saudi penal law on dissemination and disclosure of classified information and documents.
On September 17, 2015, ABOUAMMO teceived an email from Twitter Support confirming he had
requested verification of the Twitter account @infographic_ksa, which based on the FBI’s review of
public postings, appears to feature Saudi government information. Ten days later, Foreign Official-called ABOUAMMO (4 seconds).
48. On December 11, 2015, Foreign Official-1 emailed ABOUAMMO and stated, “Hello,
Call me. Please as soon as possible. Thank you.” Foreign Official-1 also called ABOUAMMO but
records show the call never connected. On the same day, ABOUAMMO emailed a Director in Twitter’s
Dubai office asking for help with the verification of the Twitter account @aleissaahmed, the Saudi
Minister of Education. ABOUAMMO explained that he was asking on behalf of “King Salman’s team”
and it would be great if she could escalate it.
49, On December 31, 2015, ABOUAMM6O created a limited liability company, CYRCL,
LLC and registered it with the State of Washington. On the same day, ABOUAMMO received an
AFFIDAVIT OF FBI SA LETITIA WU 11
Page 13 1]



employer identification number from IRS for CYRCL, LLC. On January 12, 2016, ABOUAMMO
opened a business checking account at Chase Bank. On January 25, 2016, Foreign Official-1 wired
$100,000 from the National Commercial Bank in Saudi Arabia to ABOUAMMO?’s newly opened Chase
Bank account.
50. On February 5, 2016, ABOUAMMO forwarded a verification request to Twitter Support
for the Twitter account @saudiarabia and stated that it will be used by “the King’s team.”
ABOUAMM6O then received two calls from Foreign Official-1 on February 16, 2016 (42 seconds and seconds). Then on March 1, 2016, ABOUAMMO received an email from Twitter Support confirming
he had requested verification of the another Twitter account, which was used by the Saudi Ambassador
to Iraq. ABOUAMMO followed-up with an email to someone in Twitter Support stating that the
request was on behalf of his “old partners in the Saudi Government.” Five days later, Foreign Official-
called ABOUAMMO (2 minutes and 29 seconds).
D. FBI Interview of ABOUAMMO, and ABOUAMMO’s False Statements and Documents
Emailed to FBI
51. On October 20, 2018, I traveled to Seattle, Washington to interview ABOUAMMO at his
residence about his receipt of the watch and his communications with Foreign Official-1 and others. I
identified myself as an agent of the FBI in Palo Alto, California and that I was conducting an
investigation there.
52. During the course of that interview, as set forth in detail herein, ABOUAMMO
communicated, in substance and in part, the following information:
a. ABOUAMM6O stated that he looked at the details of the User-1 account after
receiving an email from Foreign Official-1 about that account;
b. ABOUAMM6O stated that he met with Foreign Official-1 in London and
received a watch from Foreign Official-1, but described it as “plasticky” and
“junky” and valued it at $500;
c. ABOUAMM6O stated that he only received a $100,000 USD wire from Foreign
Official-1, which ABOUAMMO stated was payment for consulting and media
strategy work; and
d. ABOUAMMO showed me communications with Foreign Official-1 conducted
over Twitter direct messages; one of the messages contained an embedded
AFFIDAVIT OF FBI SA LETITIA WU 12
Page 14



photograph of a wire transfer receipt for $100,000 USD from Foreign Official-to ABOUAMM(O’s relative in Lebanon on July 9, 2015. Immediately after
showing FBI the wire transfer receipt, I observed ABOUAMMO delete the direct
message from his phone.
53. Based on the information above, I believe that ABOUAMMO made false statements to
the FBI about the type and value of the watch he received from Foreign Official-l. ABOUAMMO
stated that the watch was worth $500 and was a “Halo” watch, when in reality the watch was a Hublot
watch that ABOUAMMO had tried to sell for at least $20,000. ABOUAMMO further stated that he had
received $100,000 from Foreign Official-1, when in reality he had received at least $300,000 from him.
54. On October 20, 2018, during and following the interview, ABOUAMMO produced
several documents to the FBI, one of which was created or altered by ABOUAMMO during the
interview in order to corroborate his statements after the interview had begun. ABOUAMMO claimed
that he created a consulting company, identified as CYRCL, LLC, and that he consulted for Foreign
Official-1 in 2015 after he left Twitter. ABOUAMMO stated that he received a payment of $100,for one year of consultancy. During the interview, ABOUAMMO offered to obtain a copy of the
consulting contract from a desktop computer that he claimed was in his bedroom, and requested that the
Agents not follow him to the bedroom. A few minutes later, ABOUAMMO emailed an undated invoice
to the email address of a Palo Alto, California based FBI Special Agent.
55. I believe that ABOUAMMO created the invoice in his residence on a computer while
Agents were waiting for ABOUAMMO to provide them with the invoice that was discussed. The
address on the invoice for services ABOUAMMO said were rendered in 2015 and 2016 was
ABOUAMM6O’s current address, however, public records show that the property was built in 2017 and
ABOUAMM6O did not purchase it until August 2017, and the metadata properties associated with the
file emailed to the FBI indicates that the file was created on the date of the interview (i.e., October 20,
2018). Another invoice ABOUAMMO voluntarily provided the FBI to corroborate the existence of his
business showed a file creation date several months prior to the interview.
H
AFFIDAVIT OF FBI SA LETITIA WU 13
Page 15



E. ALZABARAHR’s Contact With ALMUTAIRI Starting F rom February 2015 Through
May
56. ALMUTAIRI acted as an intermediary between ALZABARAH and Foreign Official-1.
57. Onor around February 16, 2015, while he was employed by Twitter, ALZABARAH
received a telephone call from ALMUTAIRI. ALZABARAH and ALMUTAIRI spoke for
approximately 15 minutes. Approximately three days later, on or about February 19, 2015,
ALZABARAH sent his curriculum vitae to ALMUTAIRI via email. ALMUTAIRI acknowledged
receipt the next day, on or about February 20, 2015. Also on or about February 20, 2015, ALMUTAIRI
posted a photograph of himself and ALZABARAH on ALMUTAIRI’s Twitter account. Accompanying
the posted photograph, ALMUTAIRI commented about being honored to have had dinner with his
friend ALZABARAH the previous day. ALMUTAIRI also commented that ALZABARAH was the
only Saudi Arabian who worked at Twitter. As further examples of ALZABARAH’s contact with
ALMUTAIRL, in or about March 2015, ALMUTAIRI asked ALZABARAH about the process of
Twitter verifying user accounts as authentic.
58. Onor about May 12, 2015, Foreign Official-1 traveled from Saudi Arabia to Washington,
D.C., as part of an official delegation from the Kingdom of Saudi Arabia.
59, On or around May 13, 2015, the day after Foreign Official-1 arrived in the United States,
ALZABARAH made plans to travel to meet Foreign Official-1 in Washington, D.C. Among other
things, in Apple iMessages found on ALZABARAH’s Twitter-owned laptop, ALZABARAH explained
the purpose of his trip to his wife:
Okay, there is an important subject I would like to talk to you about. Iam
traveling to Washington at the request of the office of [Royal Family
Member-1]. At ten o’clock tonight and I return tomorrow at ten o’clock at
night.
ALZABARAH also explained:
[ALMUTAIRI] called me. He said he was in Washington and told them
about me and everything about me and they said ‘we would like to meet
with him wherever he is right now,” and that is the Director of the private
office of [Royal Family Member-1].
AFFIDAVIT OF FBISA LETITIA WU. 14
Page 16 “sD
il



60. By May 2015, Foreign Official-1 was an employee of the Saudi Arabian Royal Court.
He was the Director of the private office of Royal Family Member-1 and the Secretary General for two
charitable organizations for Royal Family Member-1. That same day, ALZABARAH purchased an
airline ticket to the Washington, D.C., area. Based on airline records and other evidence obtained
through legal process, ALZABARAH planned to stay, and did in fact stay, in the Washington, D.C.,
area for less than 12 hours on May 14, 2015.
61. Evidence obtained by the FBI indicates that ALZABARAH communicated with
representatives of the KSA during his visit to Washington, DC. Specifically, evidence obtained by the
FBI shows the following (all times Eastern):
a, Shortly after landing at Dulles Airport in the Washington, D.C.-area,
ALZABARAH made contact with ALMUTAIRI. Specifically, ALZABARAH
called ALMUTAIRI at approximately 8:53 a.m. (11 seconds), and ALMUTAIRI
called ALZABARAH at approximately 9:06 a.m. (58 seconds).
b. From the airport, ALZABARAH took a cab to a residence in Fairfax, Virginia,
arriving at approximately 9:31 a.m. Open source databases and Department of
State visa records indicate the residence was leased by an employee of the Saudi
Ministry of Interior at the Embassy of the Kingdom of Saudi Arabia in
Washington, D.C. (the “Fairfax Address”)
C. Upon arriving at the Fairfax Address, ALMUTAIRI called ALZABARAH at
approximately 9:32 a.m. (28 seconds) and at approximately 9:34 a.m. (no
answer).
d. Several hours later, ALMUTAIRI called ALZABARAH at approximately 1:p.m. (26 seconds) and again at approximately 2:22 p.m. (10 seconds).
e. At approximately 4:40 p.m., ALMUTAIRI scheduled a trip with a ride hailing
service that terminated at the intersection adjacent to the Fairfax Residence,
arriving at approximately 4:42 p.m.
f. At approximately 4:42 p.m., ALZABARAH scheduled a trip with the same ride
hailing service and with the same named driver used by ALMUTAIRI.
ALZABARAH travelled from the Fairfax Address to Dulles Airport.
g. At approximately 7:59 p.m., ALZABARAH boarded a flight at Dulles Airport
and returned to San Francisco that evening.
AFFIDAVIT OF FBISA LETITIA WU 15
Page 17



62. During ALZABARAHN’s trip to Washington, D.C., ALMUTAIRI, who had travelled
from San Francisco to Washington, D.C. on May 12, was staying at rental lodging adjacent to a hotel in
Washington, D.C., which Foreign Official-1 specified as his intended lodging. Additionally, on or about
May 13, 2015, the day before ALZABARAH travelled to Washington, D.C., ALMUTAIRI posted a
photograph of himself with Royal Family Member-1, for whom Foreign Official-1 worked. In the
caption for the posting, ALMUTAIRI wrote that it was an honor for him to meet with Royal Family
Member-1 in Washington. Based on non-content phone records, from on or about May 6, 2015, through
on or about May 24, 2015, ALMUTAIRI exchanged at least 10 telephone contacts with Foreign
Official-1.
F, ALZABARAH’s Unauthorized Access of Private Twitter User Data and Continued
Contact with ALMUTAIRI and Foreign Official-
63. Within one week of returning to San Francisco, ALZABARAH began to access without
authorization private data of Twitter users en masse. Specifically, although ALZABARAH had not
accesscd the private user data of any Twitter Accounts since February 24, 2015, starting on May 21,
2015, through November 18, 2015, ALZABARAH accessed without authorization through Twitter’s
computer systems the Twitter user data of over 6,000 Twitter users, including at least 33 usernames for
which Saudi Arabian law enforcement had submitted emergency disclosure requests to Twitter. A
Twitter Security Engineer informed the FBI that, although ALZABARAH may have had grandfathered
access to view user information through an internal Twitter tool called “Profile Viewer,” ALZABARAH
had no legitimate business purpose as a Site Reliability Engineer to access user accounts.
ALZABARAHW’s job was to help keep the site up and running, which did not involve accessing
individual user accounts.
64. OnMay 21, 2015, ALZABARAH first accessed through Twitter’s computer systems the
Twitter user data of Twitter User-1 at approximately 3:17 p.m. On May 21, 2015, Twitter User-1 shared
a public Twitter relating to the Royal Family. That same day, Foreign Official-1 asserted publicly
through Twitter that Twitter User-1’s posting was false, and ALMUTAIRI and ALZABARAH
exchanged 3 telephone contacts, including one call lasting approximately 21 minutes at approximately
7:30 p.m., which was approximately four hours after ALZABARAH accessed Twitter User-1’s data.
AFFIDAVIT OF FBI SA LETITIA WU 16
Page 18



ALZABARAH accessed Twitter User-1’s account and was able to view his email address, phone
number, and IP address. Twitter User-1°s account was the only Twitter account that ALZABARAH
accessed through Twitter’s computer systems on that day. In total, from May 21 through October 2015,
ALZABARAH accessed through Twitter’s computer systems Twitter User-1’s account on at least nine
separate days. During that time, the Kingdom of Saudi Arabia made no emergency disclosure requests
to Twitter regarding Twitter User-1’s account.
65. After his 12-hour visit to Washington, D.C., on May 14, 2015, ALZABARAH’s phone
records, which were obtained by the FBI through legal process, also show that he began having direct
contact with Foreign Official-1. ALZABARAH accessed private Twitter user data on May 21, 2015, the
same day that ALZABARAH had telephone contact with ALMUTAIRI. ALZABARAH next accessed
private Twitter user data on May 29, 2015, close in time with his telephone exchanges with Foreign
Official-1. Specifically, the investigation has identified the following activities on May 29, 2015:
Sppronimaly | _Foreign Official-l _ALZABARAM’s Acces of Private User Data of
_ Time ‘Communications With
(Pacific) | | ALZABARAH ‘Twitter Accounts”

Twitter User- 3 (email and IP address). This account 1S
8-34 am now closed, but the FBI Google search for that
“aes account show that it is in Arabic and had posted
pictures of an improvised explosive device.



8-38 am ALZABARAH called
‘ _ Foreign Official-1 (2:37).
9:17 am ALZABARAH called
oe” Foreign Official-1 (2:48).
9:18 am. Twitter User-3 (email and IP address).

9:26 a.m Foreign Official-1 called
: ~~ ALZABARAH (3:38).

Twitter User-4 (email and IP address). The account is
7:27 am. now deactivated (1.e., closed).





Later the same day, the Kingdom of Saudi Arabia submitted emergency disclosure requests for
information regarding both Twitter User-3 and Twitter User-4, which Twitter granted.
66. Through a court-approved search of ALZABARAH’s Apple ID account, the FBI found
an Apple Note that had been last modified on June 7, 2015 (initially created on May 12, 2015). That
AFFIDAVIT OF FBI SA LETITIA WU 17
Page 19



note stated in Arabic, “[an honorific term for Foreign Official-1,] 1 would like to ask your advice and
opinion regarding an issue. I just saw the announcement the ministry made regarding rewards. Do you
think it applies to us? What do you advise? Should we ask them?” In this statement, I believe that
ALZABARAH wanted to inquire about potentially receiving some of the announced reward money in
exchange for the information that he had accessed for and provided to Foreign Official-1. Several days
earlier, on June 3, 2015, a U.S. based news outlet reported that Saudi Arabia offered a $1.9 million
reward (5 million Saudi Riyals) for information that would avert future terrorist attacks.
67. |ALZABARAH had access to information that was more detailed than the information
Twitter did or would have disclosed to KSA in response to emergency disclosure requests. For example,
ALZABARAH also had access to all recent IP address information, device used, user-provided
biographical information, logs that contained the user’s browser information, and a log of all of a
particular user’s actions on the Twitter platform at any given time.
68. ALZABARAH continued this conduct into the subsequent months. During June 2015,
ALZABARAH accessed without authorization through Twitter’s computer systems the Twitter user data
of approximately 5,726 Twitter users, including Twitter User-1’s account.
69. On June 6, 2015, between approximately 12:20 p.m. and 12:50 p.m. Pacific [7:20 p.m.
and 7:50 p.m. UTC], ALZABARAH accessed without authorization through Twitter’s computer
systems the Twitter user data (email and IP address) of four specific accounts: Twitter User-5, Twitter
User-6, Twitter User-7, and Twitter User-8.
70. Acourt-authorized search of Foreign Official-1’s email account revealed that on the same
day, June 6, 2015, at approximately 5:33 p.m. Pacific [12:33 a.m. UTC on June 7], Foreign Official-saved a note in his email account with information about these same four Twitter users. Specifically, the
note in Arabic stated:
[Twitter User-5:]
[a]s far as I can tell his name is [redacted], he’s about 22, and the IP is [redacted]. Last
logged in on 06/06/2015 at 16:57 UTC. Using an iPhone.
[Twitter User-6:]
Is not in Saudi Arabia; he goes back and forth between Turkey and Iraq.
AFFIDAVIT OF FBI SA LETITIA WU 18
Page 20 1]



[Twitter User-7:]
He is in Turkey and has a friend, or something, and they use the same Michigan State
University account.
| Twitter User-8:]
This one is a professional. He’s a Saudi that uses encryption by a British named
Volter/Folter [phonetic spelling]. He signed up for the service but he does his own
encryption. We tracked him and found that 12 days ago he signed in once without
encryption from IP [redacted] at 18:40 UTC on 05/25/2015. This one does not use a cell
phone at all, just a browser. He’s online right using Firefox form a windows machine.
71. The FBI obtained records from Twitter relating to any emergency disclosure requests
submitted by Saudi Arabian law enforcement for the four accounts listed above. Twitter records
showed:
a. Twitter User-5: Saudi Arabian law enforcement submitted an emergency
disclosure request on June 4, 2015, and Twitter granted the request on the same
day. This was two days before ALZABARAH accessed information on Twitter
User-5 and Foreign Official-1 updated his notes with information on Twitter
User-5.
b. Twitter User-6: There are no records of any emergency disclosure requests
between at least May 1, 2015 through February 16, 2016.
c, Twitter User-7: There are no records of any emergency disclosure requests
between at least May 1, 2015 through February 16, 2016.
d. Twitter User-8: Saudi Arabian law enforcement submitted an emergency
disclosure request on May 30, 2015 and Twitter granted the request on the same
day.
72. Based on a review of the evidence, the information found in Foreign Official-1’s email
account related to the “last access” by Twitter User-5 (1.e., June 6, 2015 at 4:57 p.m. UTC) was not
provided by Twitter through the emergency disclosure request response sent on June 5, 2015 at
approximately 12:41 a.m. UTC. The “last access” date and time of Twitter User-5 post-dates Twitter’s
response to the emergency disclosure request. Likewise, the information found in Foreign Official-1’s
email account related to Twitter User-6 and Twitter User-7 was not provided by Twitter through an
emergency disclosure request because no such request was granted.
73. Twitter’s standard data production for emergency disclosure requests includes the
account file, the creation IP file, device file, and 48 hours of session IPs, which are further described as:
AFFIDAVIT OF FBISA LETITIA WU 19
Page 21 I A Wn B&
Co




e Account File: account ID number, date and time of account creation, last modified
date, user’s email address, application used to create the account, user name and time
zone (if specified by user);
e Creation IP File: contains the IP and timestamp associated with the account creation;
e Device File: date/time device is registered, date/time device is modified, type of
device, phone carrier, and verified phone number;
e IP Audit: account ID number, date/time of login, and IP address for login.
74. On June 14, 2015, Foreign Official-1 called ALZABARAH at approximately 12:57 p.m.
Pacific (unanswered), at approximately 1:17 p.m. (unanswered), and at approximately 1:58 p.m. (minutes 16 seconds). That same day, between approximately 11:51 a.m. and 11:25 p.m. Pacific,
ALZABARAH accessed without authorization the private user data of approximately 5,502 Twitter
users, including possibly using bulk searches in Twitter’s internal databases.
75. On June 18, 2015, at approximately 5:00 p.m., Foreign Official-1 called ALZABARAH
(25 seconds).
76. Twitter User-9 is a well-known and influential critic of the government and Royal Family
of Saudi Arabia with asylum in Canada. On June 19, 2015, and July 5, 2015, ALZABARAH accessed
Twitter User-9’s account and was able to view the user’s account information.
77. Based on Customs and Border Protection records, ALZABARAH flew from the United
States to Saudi Arabia on July 11, 2015, and returned on August 14, 2015. ALZABARAH reported this
absence to Twitter, and Twitter approved ALZABARAH’s personal leave from July 13 to August 11,
2015.
78. During ALZABARAH’s personal leave and concurrent with his travel to Saudi Arabia,
he continued to access the private user data of numerous Twitter users, including Twitter User-1 and
Twitter User-5. On July 18, 2015, one day after Twitter granted emergency disclosure requests made by
Saudi Arabian law enforcement for Twitter User-10, Twitter User-11, and Twitter User-12,
ALZABARAH accessed user information for those three accounts.
79. Additionally, on July 18, 2015, while on personal leave in Saudi Arabia, ALZABARAH
created and modified another Apple Note, which contains further notes of ALZABARAH contemplating
AFFIDAVIT OF FBI SA LETITIA WU 20
Page 22



rewards and credit in exchange for the information that he had accessed for and provided to Foreign
Official-1. Specifically, ALZABARAH’s Apple Note, which the FBI found in the search of
ALZABARAH’s Apple ID account, stated the following bullet points in Arabic:
e My situation there, where am I, and how is this going to affect me?
e Huge mistake today, I feel that we were not included. I need to know who they are
and why they are in charge of us. If something happens to him...I don’t know
anyone. I want to communicate directly. I feel that they are showing off. What is this?
e We served them and they didn’t give us any credit at all. They took credit for the
subject. As happened 11 years ago. Those sitting we give it to them [sic] this is scary,
save us all from great things [sic]. Only you and I know this is grave injustice towards
me and him. The issue is not purely financial, the issue is moral, honorary [UI], and
credit.
e I would like to improve in the lacking areas via the [charitable organization run by
Foreign Official-1]. I would like to become a member in it by any means or take
training classes in leadership and business administration.
e father’s matter is trivial and I was expecting help at least for what we did for
them...Now they know the issue, a phone call to the man in charge and the problem
is solved.
e | want a permanent position... something that secures my future and my family’s,
strengthens my relationship with them, and [makes me] feel reassured.
e [needa phone, laptop, credit card, and 4G. How to connect as fast as possible [to the
Internet] should I need to? To whom can I speak?
e A weekly meeting or bi-weekly to check-in and such.
[...]
e The subject of taxes and how J had problems with it.
80. Based on a review of the Security Set Identifiers (a sequence of characters that uniquely
names a wireless local area network) identified in a court-approved search of ALZABARAH’s Twitter-
issued computer, ALZABARAH used his Twitter laptop to connect to networks of ALMUTAIRI’s
company in Saudi Arabia on July 29 and 30, 2015, during this period of personal leave.
81. After returning to the United States, Foreign Official-1 continued to communicate with
ALZABARAH, and ALZABARAH continued to access Twitter User-1’s private account data. For
example, on August 20, 2015, Foreign Official-1 called ALZABARAH at approximately 12:06 p.m.
Pacific (3 seconds), and ALZABARAH returned Foreign Official-1’s call at approximately 12:12 p.m.
AFFIDAVIT OF FBI SA LETITIA WU 21
Page 23 sD
1]



(56 seconds). Later that day, ALZABARAH accessed without authorization through Twitter’s computer
systems the Twitter user data of Twitter User-1 from approximately 8:46 p.m. until 8:52 p.m. Pacific.
ALZABARAH accessed eleven other Twitter users’ accounts on the same day, including the accounts of
a possible critic of Saudi Arabia, the King of Saudi Arabia, and ABOUAMMO.
82. Similarly, in September 2015, Foreign Official-1 called ALZABARAH on September 8,
2015, at approximately 8:01 p.m. Pacific (5 minutes). Later that same month, ALZABARAH accessed
without authorization through Twitter’s computer systems the Twitter user data of Twitter User-1 on
September 27 and 28, 2015, which was the day before and the day that Twitter User-1’s Twitter account
was reported “hacked,” which Twitter confirmed when Twitter User-1 filed a formal complaint. The
“hacking” was claimed in online postings, and Twitter responded to User-1’s complaint stating that the
account appeared to have been compromised.
83. The FBI’s search of ALZABARAH’s Apple ID account shows that, on November 5,
2015, between approximately 12:11 a.m. and 12:18 a.m. Pacific, ALZABARAH created another Apple
Note that stated in Arabic in relevant part, “Today, I became officially a member of the technical team at
Twitter. This is the fifth tier out of six for engineers in companies in the Silicon Valley... My happiness
is unimaginable and wanted to share with you the good news...[Foreign Official-1] thank you for
supporting me and for everything...As much as I am happy for the position, | am happier with and very
proud of my work with you. As per your previous advice, I will not announce the news via my Twitter
account unless you give me your permission. May God keep you safe!”
G. Twitter’s Confrontation of ALZABARAH, and ALZABARAH’s Flight to Saudi Arabia
84. Immediately after Twitter confronted ALZABARAH about his access of user data,
ALZABARAH contacted ALMUTAIRI and another individual, identified here as Associate-1, to assist
him in fleeing the United States by the next day.
85. Onor about December 2, 2015, Twitter confronted ALZABARAH regarding his
unauthorized access of private data of Twitter users. ALZABARAH admitted to accessing user account
information without authorization, but stated that he did so simply out of curiosity. ALZABARAH
expressed his concern about both his employment and the status of his work visa, which Twitter had
AFFIDAVIT OF FBISA LETITIA WU 22
Page 24



sponsored. Twitter placed ALZABARAH on administrative leave, seized his Twitter-owned laptop
computer, and escorted him from the building.
86. At approximately 4:29 p.m., ALZABARAH left the Twitter building. As he drove to his
apartment residence in San Bruno, California, ALZABARAH called ALMUTAIRI at approximately
4:30 p.m. Phone records indicate this call was unanswered. Shortly after arriving at his residence,
ALZABARAH also called (3 seconds) Associate-1 at approximately 5:17 p.m. While at his apartment
complex that day, ALZABARAH visited the leasing office and told an assistant manager there that he
was unsure of his visa status because he had been laid-off from Twitter. ALZABARAH stated he was
going to try to find another job, but he may get deported.
87. Next, based on the FBI’s contemporancous observations of ALZABARAH and the FBI’s
investigation afterwards, including obtaining phone records, the following occurred:




_ Approximate | __
‘Time (Pacific) | i ==. _
ALZABARAH met outside his residence Associate-1, who was driving
7:18 p.m. a white sport-utility vehicle. ALZABARAH entered Associate-1’s
vehicle, and Associate-] proceeded to drive around the area.
While Associate-1 drove with ALZABARAH around ALZABARAH’s
_ Events of December 2, 2015 __






7:20 p.m. residence, Associate-1’s cellular telephone called (8 seconds) Foreign
Official-1’s Saudi Arabian cellular telephone.
Associate-1’s cellular telephone called (unanswered) Foreign Official-
7:22 p.m. 1’s Saudi Arabian cellular telephone.
Associate-1’s cellular telephone called (unanswered) Foreign Official-
7:31 p.m. 1’s Saudi Arabian cellular telephone.
Associate-1 returned ALZABARAH to his residence, and Associate-7:48 p.m. departed the area in the vehicle.
Foreign Official-1°s Saudi Arabian cellular telephone called the Saudi
7:58 p.m. Arabian Consul General in Los Angeles (unanswered), and the Consul
General returned the call at 8:03 p.m. (unanswered).
8:03 p.m Foreign Official-1’s Saudi Arabian cellular telephone called (8 seconds)
Associate-1’s cellular telephone.
Foreign Official-1’s Saudi Arabian cellular telephone called (3 minutes
8:05 p.m. 48 seconds) the Saudi Arabian Consul General in Los Angeles.
Foreign Official-1’s Saudi Arabian cellular telephone called (5 seconds)






8:09 p.m. Associate-1’s cellular telephone.
ALZABARAH called (unanswered) the Saudi Arabian Consul General
8:30 p.m. in Los Angeles.
8:38 p.m Associate-1 called (3 minutes, 48 seconds) the Saudi Arabian Consul
General in Los Angeles.



AFFIDAVIT OF FBISA LETITIA WU 23
Page 25 il




ALZABARAITI called (unanswered) the Saudi Arabian Consul General
9:26 p.m. in Los Angeles from his Saudi cellular telephone.
12:21 a.m. The Saudi Arabian Consul General in Los Angeles called (3 minutes, (Dec. 3, 2015) | second) ALZABARAH on his Saudi cellular telephone.





88. The day after, on or about December 3, 2015, at approximately 7:00 a.m. Pacific,
ALZABARAH, his wife, and his daughter boarded a flight at the San Francisco International Airport
and flew (connecting through the Los Angeles International Airport) to Saudi Arabia. During the
connection at the Los Angeles International Airport (ALZABARAH arrived in Los Angeles at
approximately 8:32 a.m. and departed at approximately 3:00 p.m.), ALZABARAH and Associate-exchanged three telephone contacts — one text message at approximately 8:31 a.m., one call (1 minute, seconds) at approximately 9:00 a.m., and one call (15 seconds) at approximately 12:16 p.m. Also during
ALZABARAH’s layover in Los Angeles, ALZABARAH’s Saudi cellular telephone and the Saudi
Arabian Consul General in Los Angeles exchanged three telephonic contacts — one call from
ALZABARAH at approximately 9:56 a.m. (8 seconds), one call to ALZABARAH at approximately
10:40 a.m. (2 minutes) and one call to ALZABARAH at approximately 11:39 a.m. (1 minute seconds).
89. Between the time that ALZABARAH left the Twitter building on December 2, 2015, and
his departure from San Francisco at approximately 7:00 am on December 3, 2015, ALZABARAH’s
telephone records for his U.S. cellular phone indicate contact with only ALMUTAIRI, Associate-1, the
Saudi Arabian Consul General in Los Angeles, ALZABARAH’s wife, his Twitter supervisor, one other
Twitter employee, Wells Fargo Bank, U.S. Bank, and an Uber driver.
90. On December 3, 2015 at approximately 11:38 p.m. Pacific, Twitter received an email
from ALZABARAH stating that he was resigning from his employment at the company. Based on
flight records, this email was transmitted while ALZABARAH was in the air.
H. ALZABARAH’s Continued Work for Officials of The Kingdom of Saudi Arabia
91. | Within one month of arriving in Saudi Arabia, emails show that ALZABARAH began
using an email address at a charitable foundation where Foreign Official-1 is the Secretary General. In
particular, emails sent to and from ALZABARAH’s charitable foundation account show him working
with ALMUTAIRI and several others, on a team to monitor and manipulate social media under Foreign
AFFIDAVIT OF FBISA LETITIA WU 24
Page 26 “sD
o)




Official-1°s leadership and for the benefit of the Kingdom of Saudi Arabia. In March 2016,
ALZABARAH emailed the “team,” which included ALMUTAIRI and Foreign Official-1, and stated
that he had established a private website and virtual private network for them to use. ALZABARAH
was working in that capacity continuously through at least June 2016.
92. ALZABARAH has submitted several visa applications to return to the United States in
which he has disclosed, among other things, employment by the Royal Family and Organization No. and listing Foreign Official-1 as his point of contact.
93, As of May 9, 2019, ALZABARAH has a valid B1/B2 visa but has not yet returned to the
United States.
V. CONCLUSION
94. Based on the foregoing, there is probable cause to believe that Ahmad ABOUAMMO,
Ali ALZABARAH and Ahmed ALMUTAIRI acted in the United States as agents of the Kingdom of
Saudi Arabia without prior notification to the Attorney General, as required by law, in violation of U.S.C. § 951. There is further probable cause that Anmad ABOUAMMO knowingly falsified and
transmitted to agents of the FBI a falsified invoice in order to obstruct a pending federal criminal
investigation, in violation of 18 U.S.C. § 1519.
95. Accordingly, I request the Court to issue the attached Criminal Complaint and Arrest
Warrants.
H
I
I/
I/
I
AFFIDAVIT OF FBISA LETITIA WU 25
Page 27 Ze



VI. SEALING REQUEST
96. Since this investigation is ongoing, disclosure of the complaint and this affidavit may
jeopardize the progress of the investigation, result in the destruction of evidence, intimidation or
collusion of witnesses, or the flight of a defendant. Accordingly, I request that the Court issue an order
that the complaint, this affidavit in support, and any attachments thereto, along with the order itself, be
filed under seal until further order of the Court.
I declare under penalty of perjury that the above is true and correct to the best of my knowledge
and belief.

Letitia L. Wu ial
Special Agent
Federal Bureau of Investigation
Sworn to and subscribed before me
this “+ day of November, 2019.
ja \
THE HONORABLE THOMAS S. H oR
UNITED STATES MAGISTRATE JU
AFFIDAVIT OF FBI SA LETITIA WU 26
Space
Issues Laws Cases Pro Articles Firms Entities
Issues Laws Cases Pro Articles Firms Entities
 
PlainSite
Sign Up
Need Password Help?