The team added that this was evidence of the problems with the unregulated sale and use of spyware for surveillance purposes. These tools should be governed by “the most rigorous control” to prevent abuse, and that there should be a “moratorium” on selling and transferring the technology.

Saudi Arabia has called the WhatsApp hack claim “absurd” and has previously rejected assertions that it has campaigns to hack, intimidate and assassinate critics. It insisted that Khashoggi’s murder was a “rogue operation” despite a CIA investigation implicating the Crown Prince’s involvement.

The UN can’t force a US investigation into the case. However, this does increase pressure on authorities to look into the allegations and treat this as more than just a typical data breach. It also puts Saudi Arabia under closer scrutiny. While the UN isn’t definitively blaming Saudi Arabia, it is acknowledging that the kingdom has a mounting reputation for using digital ‘warfare’ in a bid to silence opposing views.

The breach was apparently carried out in early May 2018, when Bezos received an unsolicited message from the crown prince — or an entity in control of his WhatsApp account. That message allegedly contained a video file that forensic analysis later concluded was highly likely to contain malware that allowed “large amounts of data” to be surreptitiously removed from the Amazon founder’s phone. For now, though, most of the case’s finer details remain unknown.

For example, The Guardian has not identified the party that carried out that forensic analysis. While today’s report suggests a significant amount of personal data was ferried off of Bezos’ phone as a result of the hack, there is no clear sense of what kind of data was ultimately collected. It’s also unclear at this point what role — if any — the crown prince himself played in the dissemination of malware. The Guardian report specifically notes that the malicious file originated from a number used by Mohammed bin Salman but stops short of directly implicating the 34-year-old Saudi royal.

If true, the attack represents a particularly brazen attempt on the part of the Saudi government to gain leverage over the world’s richest man. It also raises serious questions about what that data might have been used for immediately after the attack took place. Five months after that message was sent from MBS’s WhatsApp account, Jamal Khashoggi, a Washington Post columnist and vocal critic of the Saudi government, was murdered in Istanbul. And just months after that, text messages and images Bezos sent to his mistress, former television anchor Lauren Sanchez, were published by the National Enquirer.

The Guardian report notes that Bezos and the crown prince had been enjoying an apparently innocuous WhatsApp conversation prior to the file being sent, which comes as little surprise since the royal figure has long cultivated relationships with the Silicon Valley elite. Beyond that, Bezos had a vested interest in maintaining a friendly relationship with the Saudi government. As recently as early 2019, Amazon planned to expand its e-commerce reach into Saudi Arabia and the UAE, and the company considered opening AWS data centers in the Crown kingdom. Even now, Amazon has 22 open job listings in Saudi Arabia, most in the capital city of Riyadh.

However, Khashoggi’s assassination and the Bezos data leak quickly caused whatever relationship existed between Amazon and the Saudi government to deteriorate. And while today’s report shines more light on the mechanics of Saudi cyber-operations, Amazon — and Bezos — had long suspected the kingdom’s involvement in a data breach. In March 2019, following the public airing of Bezos’s extramarital affair, Amazon head of security Gavin de Becker wrote in a piece published by the Daily Beast that “our investigators and several experts concluded with high confidence that the Saudis had access to Bezos’ phone, and gained private information.”

A third man charged at the same time, Ahmed Almutairi, is also facing spying charges but didn’t work at Twitter. Instead, he allegedly served as a go-between for the Saudi government and the Twitter staffers.

According to both clues in the indictment and a Washington Post source, the trio supposedly partnered with Bader Al Asaker, a Saudi official who runs a charity belonging to Crown Prince Mohammad bin Salman. The Justice Department claimed that Asaker started grooming the Twitter employees in 2014 in a bid to obtain info. Asaker paid Abouammo a minimum of $300,000 (plus a $20,000 Hublot watch) for his espionage work, while Alzabarah reportedly became the director of bin Salman’s private office.

Twitter said in a statement that sensitive info was limited to a group of “trained and vetted employees,” and that there were “tools in place” to protect both users’ privacy and their ability to do “vital work.”

Of the group, only Abouammo is present in the US to face the claims — Alzabarah and Almutairi are in Saudi Arabia, which has no extradition treaty with the US. The charges are still significant by themselves, though. This is the first time federal prosecutors have accused Saudi Arabia of spying within the US. It’s also a unique case in the technology industry. Governments have used Twitter and other social networks as political battlefields, but this is far more audacious if true — it’d represent an attempt to corrupt the social network themselves in the name of silencing dissent.