Kenyan arrested in Qatar first targeted by phishing attack
A Kenyan security guard now facing charges in Qatar after writing compelling accounts of being a low-paid worker there found himself targeted by a phishing attack just before his arrest
Your support helps us to tell the story
From reproductive rights to climate change to Big Tech, The Independent is on the ground when the story is developing. Whether it's investigating the financials of Elon Musk's pro-Trump PAC or producing our latest documentary, 'The A Word', which shines a light on the American women fighting for reproductive rights, we know how important it is to parse out the facts from the messaging.
At such a critical moment in US history, we need reporters on the ground. Your donation allows us to keep sending journalists to speak to both sides of the story.
The Independent is trusted by Americans across the entire political spectrum. And unlike many other quality news outlets, we choose not to lock Americans out of our reporting and analysis with paywalls. We believe quality journalism should be available to everyone, paid for by those who can afford it.
Your support makes all the difference.A Kenyan security guard now facing charges in Qatar after writing compelling accounts of being a low-paid worker there found himself targeted by a phishing attack just before his arrest, analysts say.
While analysts from Amnesty International and Citizen Lab said they were unable to say who targeted Malcolm Bidali, the phishing attack mirrored others previously carried out by Gulf Arab sheikhdoms targeting dissidents and political opposition. It also would require access to confidential information stored by telecommunication companies typically only released to government or security force officials to be able to be useful as well.
Ooredoo and Vodafone Qatar, the two major internet providers in Qatar, did not respond to requests for comment. Qatar as well did not respond to questions about the phishing attack targeting Bidali.
The weekslong detention of Bidali, 28, in an undisclosed location comes ahead of Qatar hosting the 2022 FIFA World Cup and has again raised questions about freedom of expression in this small, energy-rich nation before the tournament.
“There is no evidence that he is being detained for anything other than his legitimate human rights work — for exercising his freedom of expression, and for shining a spotlight on Qatar’s treatment of migrant workers,” multiple human rights organizations campaigning for Bidali's release recently wrote.
Late on Saturday night, Qatar said in a statement that Bidali had been “formally charged with offenses related to payments received by a foreign agent for the creation and distribution of disinformation within the state of Qatar.” The statement did not elaborate or offer evidence to support the allegation.
If convicted under Article 120 of Qatar's penal code, which uses similar language as the Qatari statement, Bidali could face up to 10 years in prison and a 15,000 Qatari riyal ($4,000) fine. Early last year, Qatar also amended its penal code to allow for prison sentences of up to five years and a fine of 100,000 Qatari riyals ($27,500) for anyone publishing “rumors or statements or false or malicious news or sensational propaganda,” according to Human Rights Watch.
Bidali worked 12-hour days as a security guard. In his spare time, he wrote under the pen name “Noah” about his experiences as a guard, including trying to improve his worker accommodations and the challenges of life. His essays even offered plaudits for Qatar at times as a “trendsetter in many areas.”
The reason for Bidali’s detention remains unclear. Days earlier, he spoke and briefly appeared in a videoconference with civil society and trade union groups describing his experiences. The Kenyan Embassy in Qatar did not respond to a request for comment.
Around the time of his talk, Bidali clicked on a link sent to him by a Twitter user that appeared to initially be a video from Human Rights Watch. But instead, it sent him to a decoy, look-alike YouTube page that “might have allowed the attackers to obtain his IP address, which could have been used to identify and locate him,” Amnesty said. An IP address is a numeric designation that identifies its location on the internet.
“In like 10 minutes, almost any techie can set a website to capture the IP address of someone who clicks,” said Bill Marczak, a senior researcher at Citizen Lab who also came to the same conclusion as Amnesty. “The hard part is converting the IP address into a real name and address.”
That typically requires access to private information kept by internet service providers that typically only they or governments can access.
Twitter later suspended the account that targeted Bidali with the phishing attack. The San Francisco-based social media company did not respond to questions about the suspension.
Qatar is home to the state-funded Al Jazeera satellite news network. However, expression in the country remains tightly controlled.
___
Follow Jon Gambrell on Twitter at www.twitter.com/jongambrellAP.