Jeff Bezos’s phone may have been hacked after receiving WhatsApp video from Saudi crown prince MBS, say UN experts

On 8 November 2018, amid the storm of accusations and recriminations over the killing of Washington Post columnist Jamal Khashoggi just five weeks earlier, Jeff Bezos, the owner of the newspaper, received a bizarre message on his personal phone.

It was a photograph sent via WhatsApp of a woman who resembled the TV journalist with whom Mr Bezos was having an illicit affair, months before the matter became public.

Even stranger was who had sent the photo, according to reports: Mohammed bin Salman, the crown prince of Saudi Arabia.

It was the first clue that the richest man in the world had had his most private communications hacked, very possibly by the de facto ruler of Saudi Arabia.

On Wednesday, a pair of United Nations experts called for an “immediate investigation” by the United States into information suggesting that Mr Bezos’s phone was hacked after he received a file sent months earlier by Prince Mohammed, or from his phone.

Agnes Callamard, the UN special rapporteur on enforced disappearances, and David Kaye, a UN envoy on freedom of expression issues, say information they have collected over the months suggested that Mr Bezos and others have been the targets of a sophisticated campaign of cyber-espionage by Saudi Arabia.

“The alleged hacking of Mr Bezos’s phone, and those of others, demands immediate investigation by the US and other relevant authorities, including investigation of the continuous, multi-year, direct and personal involvement of the crown prince in efforts to target perceived opponents,” said a statement by the two.

“The circumstances and timing of the hacking and surveillance of Bezos also strengthen support for further investigation by the US and other relevant authorities of the allegations that the crown prince ordered, incited, or, at a minimum, was aware of planning for but failed to stop the mission that fatally targeted Mr Khashoggi in Istanbul.”

In an interview, Ms Callamard urged US law enforcement to engage on a matter that she said breached the rights of a prominent US citizen and set a precedent in which anyone could be targeted by the powerful.

“The allegations demand on the part of American institutions that they investigate the breach of Bezos’s phone by a foreign power – it can be done by the FBI or the US congress,” she told The Independent.

“This should be a wake-up call – that one of the richest men on earth with a great deal of protection was hacked,” she said. “It should be wake-up call to the political elite. Their phones are not safe.”

It remains unclear whether Prince Mohammed himself was in on the scheme to hack Mr Bezos’s phone, obtaining information that was later used to blackmail him. But circumstantial evidence amassed by the UN investigators strongly suggests he or those around him had the means and motive to do so. Ms Callamard said that either Prince Mohammed or one of his deputies was behind the surveillance.

Mr Bezos and Prince Mohammed struck up a connection in the months before the Khashoggi killing, when Saudi Arabia was being celebrated as a bastion of change under the new crown prince and Amazon was considering an expansion to the kingdom.

But Khashoggi was also already penning a highly critical articles for The Washington Post at the time. According to the UN report, Mr Bezos received a video from Prince Salman’s personal account on 1 May 2018 via WhatsApp that was reportedly infected with Pegasus, a cyber-espionage tool developed by the Israeli firm NSO. Just two weeks earlier, Khashoggi had written a piece urging greater democracy in the kingdom.

Around the same, the phones of several other prominent Saudi dissidents close to Khashoggi were infected with Pegasus.

Once Khashoggi was murdered and the kingdom came under pressure to come clean, Saudi officials and Prince Mohammed’s army of online trolls vehemently attacked Mr Bezos and The Washington Post for its aggressive coverage of the kidnapping, torture, murder, dismemberment and disappearance of the dissident writer in the Saudi consulate in Istanbul.

That’s when the photo of the woman resembling Lauren Sanchez, Mr Bezos’s mistress, appeared.

The National Enquirer, a US gossip tabloid which appeared to have ties to the kingdom, threatened to expose the affair with Ms Sanchez unless he backed down on accusations that the magazine was doing the bidding of Saudi Arabia. (A spokesperson for the publisher of The National Enquirer claims it has no “editorial or financial ties” to Saudi Arabia.)

Mr Bezos instead went public, exposing the entire matter in February 2019, after hiring private investigators to find out how his communications were breached.

“If in my position I can’t stand up to this kind of extortion, how many people can?” Mr Bezos wrote.

An annex to Wednesday’s report cites a dozen or so “in-depth, forensic level tests” Mr Bezos’s phone underwent “by a team of digital forensic experts” to locate the source of the invasion.

“Experts advised that the most likely explanation for the anomalous data … was use of mobile spyware such as NSO Group’s Pegasus,” said the report.

Cybersecurity sleuths have repeatedly claimed NSO provided Pegasus to the kingdom. But others said it was possible that Prince Mohammed or someone else may have inadvertently passed along the malware.

“We don’t know for a fact whether or not anybody was conscious of sending any type of malware, and this malware been going around for quite a while,” said Theodore Karasik, of Gulf State Analytics, a research consultancy.

Ms Callamard and Mr Kaye have been pushing international powers for months to take up a more aggressive stance towards Prince Mohammed. But both the UN, which receives significant funding from the kingdom, and the US, where President Donald Trump remains chummy with the Saudi royal family, have resisted.

Allegations that the crown prince, or MBS, as he is often described in shorthand, may have personally taken part in the hacking of Mr Bezos’s phone stunned many.

“I was going to say this is f***ing insane,” wrote Karen Attiyah, Khashoggi’s editor at The Washington Post, on Twitter. “But it’s not. This is MBS being drunk and high on impunity. He’s never been held accountable for any single f***ing thing, ever.”

In a message posted on Twitter, the Saudi embassy in Washington said: ”Recent media reports that suggest the Kingdom is behind a hacking of Mr Jeff Bezos’s phone are absurd. We call for an investigation on these claims so that we can have all the facts out.”