Saudi crown prince sent Jeff Bezos a video file. Bezos’ phone was soon gushing data

Forensic experts hired by Jeff Bezos have concluded with “medium to high confidence� that a WhatsApp account used by Saudi Crown Prince Mohammed bin Salman was directly involved in a 2018 hack of the Amazon founder’s phone.

A report on the hack, which has been seen by the Financial Times, says Bezos’ phone started surreptitiously sharing vast amounts of data immediately after receiving an apparently innocuous but encrypted video file from the prince’s WhatsApp account in May 2018. The file was sent weeks after the pair exchanged numbers at a dinner in Los Angeles during a trip to the U.S. by the prince. While on the trip Mohammed had met a string of top executives and sought to attract investment to the kingdom.

However, the relationship between Bezos and the prince soured after the gruesome murder of Jamal Khashoggi, a veteran Saudi journalist who used a regular column in the Bezos-owned Washington Post to criticize Mohammed’s autocratic leadership. After the newspaper reported on how a Saudi hit squad had killed Khashoggi in the kingdom’s consulate in Istanbul, Turkey, in October 2018 and dismembered his body, Bezos and the Post were targeted by a Saudi Twitter campaign.

Bezos’ associates last year said they had high confidence that Saudi Arabia had access to his phone and had gained private information after details of an extramarital affair appeared in a tabloid. But the recent forensic analysis is the first to directly implicate a WhatsApp account used by Mohammed and is likely to deepen the acrimony between one of the world’s most powerful leaders and its richest man.

The allegations will heighten scrutiny of Mohammed’s leadership and methods. The young royal has courted the heads of global tech companies; Riyadh also has ventures with groups such as Japan’s SoftBank as the prince seeks international backing for his ambitious plans to overhaul the oil-dependent economy. But his reputation has been tarnished by the Khashoggi killing and sweeping crackdowns against dissent.

The forensic analysis, led by Anthony J. Ferrante, a cyber expert at business advisory firm FTI Consulting, said that within hours of the video file being sent via WhatsApp to Bezos, “a massive and unauthorized exfiltration of data from Bezos’s phone began, continuing and escalating for months.�

The amount of data hacked from the phone was in the dozens of gigabytes, compared with the few hundred kilobytes daily average in the months before the video file was sent, the analysis found.

The report does not claim to have conclusive evidence and its findings could not be independently confirmed by the Financial Times.

A spokesman for Bezos declined to comment but said he was “cooperating with the authorities.�

Saudi Arabia denied the allegations. “Saudi Arabia does not conduct illicit activities of this nature, nor does it condone them,� an official said. “We request the presentation of any supposed evidence and the disclosure of any company that examined any forensic evidence so that we can show it is demonstrably false.�

A spokesman for FTI Consulting said all “client work is confidential. We do not comment on, confirm or deny client engagements or potential engagements.�

Saudi authorities have previously been accused of hacking the phones of critics and activists, while also using an army of social media trolls to intimidate and harass dissenting voices. Around the same time as Bezos’s phone allegedly received the video file from Mohammed’s WhatsApp account, privacy advocates also tracked attempts to hack the phone of Omar Abdulaziz, a friend of Khashoggi and a prominent Saudi dissident living in Canada; and two other overseas critics of the Saudi leadership, according to lawsuits filed in Israel and Cyprus and research by the Citizen Lab at the University of Toronto.

The forensic report commissioned by Bezos said Mohammed contacted the Amazon founder unexpectedly via WhatsApp on two occasions after the video file had been sent in a way that suggested that the prince had prior knowledge of the businessman’s private discussions.

Bezos had already ceased all communications with Mohammed in the wake of the Khashoggi killing. But in February 2019, two days after the billionaire was briefed — via his phone — about the extent of the Saudi online campaign against him, he received another message from the WhatsApp account used by the prince. It said: “All what you hear or told to it’s not true and it’s matter of time will tell [sic] you know the truth, there is nothing against you or Amazon from me or Saudi Arabia.�

The forensic analysis of Bezos’ phone could not ascertain what alleged spyware was used. However, the report said, “It is believed that the compromise was likely facilitated by malicious tools procured by [Saud] al-Qahtani.�

Human rights activists have accused Qahtani, a former advisor to Mohammed and the prince’s enforcer, of directing aggressive social media campaigns against critics.

Qahtani was dismissed from the royal court after being implicated by the Saudi state prosecutor in Khashoggi’s killing and sanctioned by the U.S. Last month Saudi authorities said he had not been charged because of a lack of evidence.

Qahtani was also in charge of a more covert operation — the procurement of hacking software from European and Israeli companies, according to four people who spoke to the Financial Times on condition of anonymity. Leaked emails from an Italian firm, Hacking Team, which sells covert surveillance software designed to penetrate phones remotely, show him using his Saudi government credentials to purchase their services as early as 2015. Qahtani did not immediately respond to a request for comment.

In March, Gavin de Becker, Bezos’ security consultant, alleged that “our investigators� had concluded “with high confidence that the Saudis had access to Bezos’s phone, and gained private information.� His claims came after the National Enquirer published details about Bezos’ affair with Lauren Sanchez.

Bezos later revealed that the tabloid had sought to intimidate him by threatening to release more intimate photographs, unless he agreed to publicly exonerate them of any political motivations in violating his privacy. American Media Inc., the tabloid’s owner, denied the reports and said its source was Sanchez’s brother, Michael. Saudi officials also denied the kingdom was involved.

© The Financial Times Ltd. 2020. All rights reserved. FT and Financial Times are trademarks of the Financial Times Ltd. Not to be redistributed, copied or modified in any way.