New Delhi: In the months before he died and at least a year after his gruesome murder in a Saudi consulate, people associated with Saudi dissident and journalist Jamal Khashoggi, including the two women closest to him, were selected for potential surveillance by clients of the Israeli company NSO Group, a leaked database and analysis of infected phones show.
A joint investigation of over a dozen media groups across the world probed an unprecedented leaked list of 50,000 mobile phone numbers of individuals mostly living in client countries of the NSO Group.
Termed the Pegasus Project, the collaboration of 16 media groups, including The Wire, was led by French journalism non-profit Forbidden Stories, which had accessed the data. The list was then subjected to further examination by media partners, with forensic analysis of phones conducted by Amnesty International’s Security Lab.
The phones of Hatice Cengiz and Hanan Elatr – who were engaged to and married to Khashoggi, respectively – were forensically examined, with a successful infection confirmed on one of them. Another close associate of Khashoggi’s was also compromised through his mobile phone. Phone numbers of two top Turkish officials who were directly linked to the investigation into Khashoggi’s murder have also appeared on the leaked list, a portion of which was found through forensic analysis to have tell-tale signs of Pegasus spyware.
On October 2, 2018, at around 1:14 pm local time, Khashoggi entered the gate of the Saudi Consulate in Istanbul. While the Turkish authorities were immediately convinced that Khashoggi wasn’t alive, it took Saudi Arabia 18 days to admit that Khashoggi had died in the consulate premises. His body has still not been found.
The list accessed by Amnesty and Forbidden Stories does not name the clients.
In a statement, NSO asserted that its product was not used against Khashoggi or his associates.
“As NSO has previously stated, our technology was not associated in any way with the heinous murder of Jamal Khashoggi. This includes listening, monitoring, tracking, or collecting information. We previously investigated this claim, immediately after the heinous murder, which again, is being made without validation,” said the NSO statement.
The ‘Pegasus’ spyware helps clients to infect the phones of targets by sending them specially customised exploit links. If the phone is infected, all the information in the phone – call records, photos, emails, chats – can be accessed. Besides, the phone’s microphone and camera can also be switched on to surveil these targets.
Based on analysis of phones, it was found that Khashoggi’s wife, Hanan Elatr, an Egyptian flight attendant, was targeted with NSO’s spyware, Pegasus, before his murder. There were text messages containing malicious links that were disguised as coming from her sister. These were sent in November 2017 and then again in April 2018.
However, as she was using an Android phone, researchers at Amnesty’s technology lab were unable to conclusively determine whether the phone was successfully infected as the nature of the software is such that it doesn’t lend itself very well to forensics examination.
But Elatr does not remember having clicked on the links.
While they had met first in 2009, Elatr became romantically involved with Khashoggi only in March 2018 and got married in an Islamic ceremony four months later in northern Virginia, where Khashoggi was living in self-exile.
The link with Pegasus had previously been reported when University of Toronto’s Citizen Lab had confirmed that Canadian permanent resident and Khashoggi’s friend Omar Abdulaziz’s phone was infected in June 2018 with NSO’s Pegasus spyware, with Saudi Arabia being the likely client.
Also read: Old RTI Response Enough To Deny Govt-Pegasus Link, Media Didn’t Do Due Diligence: MeitY
The leaked list and phone analysis have now revealed that targeting of Khashoggi’s circle was far more widespread than previously understood.
Two months before Khashoggi got married to Elatr, the 59-year-old Saudi columnist was introduced to a doctorate student, Hatice Cengiz, in Turkey. In early September, Khashoggi got permission from Cengiz’s father to marry her. But, under Turkish law, he required certification to show that he was divorced.
Khashoggi first went to the Saudi consulate in Istanbul on September 28 to procure the certificate without an appointment and was told to come back later to collect it. He returned on October 2. Grainy CCTV footage showed Khashoggi, wearing a white shirt and a suit jacket, entering the portals of the consulate.
Cengiz waited for him outside. He left his phone and a number for emergency contact with his fiancé. In case he didn’t come outside, she was to call Yasin Aktay, the chief aide of Turkish President Recep Teyyip Erdogan and deputy chairman of the ruling AK Party. Khashoggi never returned.
Before the end of the day, Khashoggi’s disappearance had become a geopolitical crisis, with Turkey squarely accusing the Saudi government of being the mastermind. The two countries were already in opposing camps in West Asia, where Turkey was aligned with Iran and Qatar and Saudi Arabia joining hands with the UAE, Egypt and Bahrain.
Israel and the Gulf kingdoms of Saudi Arabia and the UAE had become close partners, despite not having diplomatic ties. All of them found common cause in their antagonism against Iran, the region’s only openly declared nuclear state.
On October 6, the Saudi consul general invited reporters to his office to show that there were no signs of Khashoggi there.
On the same day, Cengiz’s phone was infected successfully, according to forensic analysis. In the following days, there were five more attempts.
Cengiz had handed over Khashoggi’s phone to the Turkish authorities, who have declined to say whether it had been hacked, citing the ongoing homicide investigation.
Hatice Cengiz, Turkish fiancee of slain Saudi journalist Jamal Khashoggi, speaks during a news conference to present a book on Khashoggi, in Istanbul, Turkey February 8, 2019. Photo: Reuters/Murad Sezer
On October 20, the Saudi government admitted that Khashoggi had died inside the consulate. The narrative was that he had died in a scuffle and his body was handed over to a “local collaborator”.
Also read: FAQ: On the Pegasus Project’s Digital Forensics
Meanwhile, Turkish authorities were leaking a steady stream of audio and visual evidence to prove that a team of 15 Saudi nationals had been dispatched to kill Khashoggi and dispose of his remains.
The selection of Khashoggi’s friends for spyware targeting spread over the following months. It included Wadah Khanfar, former director general of Al Jazeera television network, whose phone was analysed by Amnesty International.
“I felt my phone or Hatice’s phone might have been hacked because some of the conversations we had about Jamal’s disappearance came out [in public] during the first days,” Khanfar told a Pegasus Project journalist.
Turkish journalist Turan Kislakci, who had first introduced Khashoggi and Cengiz, was also selected as a target. A Saudi human rights activist exiled in the UK was also in the leaked database, but did not want to be identified, fearing for his safety.
In an interview to a Pegasus Project media partner, Yasin Aktay, one of Erdogan’s key aides said that shortly after Khashoggi’s death, he was informed by Turkish intelligence officials that his phone had been compromised and urged him to get a new one.
“They didn’t say who tried to hack my phone. However, they said that there were many such attempts. They also said that the simplest precaution I should take in this regard would be to change my phone device. So I changed my phone device. But I always saw the possibility of such a leak,” he said.
Aktay, who was Khashoggi’s emergency contact, is convinced that his vocal criticism of the Saudi government after the murder had brought him to Riyadh’s attention.
“They are trying to kill even the ghost of Jamal Khashoggi,” he said, referring to the Saudi government.
An Appeal: Support Investigative Journalism That Brings You The Truth. Support The Wire.
Irfan Fidan, then Istanbul’s chief prosecutor in charge of investigations into Khashoggi’s murder, was also targeted for a period in 2019. He was also one of the Turkish officials who met UN special rapporteur on extrajudicial, summary or arbitrary executions, Agnes Callamard, during her visit to Turkey for her own investigations. However, Fidan refused an interview request. The two Turkish officials also declined to have their phones analysed.
The Saudis had also opened their own trial for 11 men, including charges of death penalty against five, in January 2019. The official account was that this was a rogue operation gone wrong by a “negotiations” team. Eight were eventually found guilty, but their sentences were commuted and Khashoggi’s son also “forgave” them in May 2020.
Midway through the Saudi trial, Callamard released her report that bluntly stated that Khashoggi’s murder was “premeditated” and “overseen, planned and endorsed by high-level officials”. “Mr. Khashoggi’s killing constituted an extrajudicial killing for which the State of the Kingdom of Saudi Arabia is responsible,” she wrote in her report released on June 19, 2019.
She also stated that there was “credible evidence, warranting further investigation of high-level Saudi Officials’ individual liability, including the Crown Prince”.
Callamard left the United Nations at the end of her term in March 2021 and joined Amnesty International, one of the partners in the Pegasus Project.
She stated that the new revelations about targets related to Khashoggi indicated an attempt by Saudi Arabia and others to gather intelligence on the blowback from the murder. “The targeting indicates a clear intention to know what the prosecutor and a few other high political actors are doing… They saw Turkey as the heart of what they needed to control.”
Also read: Read: NSO Group’s Response to the Pegasus Project and Our Take
In the aftermath of Khashoggi’s murder, Aktay, one of Erdogan’s key advisors, was given a bodyguard, who recently drove him and two journalists to Ankara airport.
As the car sped at over 120 miles per hour down the highway, Aktay claimed that it was a security move. “It’s the best way. It’s very hard to assassinate, to have an assassination plan, when you go fast,” he said.
Khashoggi’s Turkish fiancé has also been provided with a bodyguard and car by the interior ministry, after she received threats on social media.
When told about the results of the forensic analysis, Cengiz was not surprised. “I was expecting that, but I am upset. I want to be a normal person, as anyone. All these things make me sad and scared. My phone could be attacked again in the future, and I feel I don’t have any way to protect myself from this.”
A scholar on West Asia, Cengiz’s life has become constrained as she faced the pressures of being linked with Khashoggi.
“Before I met him, I was living a really rich life,” she told a Pegasus Project journalist. “I had many things to do every day. I became a working person.” It has also impacted her career as an expert on the region. “Now I cannot travel to any Arab country. Can you imagine that? I’m paying a price, but for what?” she asked.
Till Khashoggi’s death, Cengiz and Elatr had not been aware of each other’s existence.
Now both their lives have been disrupted as they live in hiding for their own safety.
A month after she began her relationship with Khashoggi in March 2018, Elatr was stopped at an airport in the UAE, where she was detained and interrogated several times. She was also placed under house arrest for weeks. Many of her relatives were also interrogated by UAE and Egyptian authorities. “I just want them to leave me in peace, please leave me in peace,” she said.
She is now in the United States, where she has applied for political asylum.
Elatr recalled that Khashoggi had taught her to use various apps because he thought that it will be easier to circumvent any surveillance.
When he spoke to other colleagues living abroad, her phone was usually on the tea table in their living room in Virginia.
“Jamal warned me before that this might happen. It makes me believe they are aware of everything that happened to Jamal through me,” she said.
Read The Wire’s coverage as part of the Pegasus Project here.