Saudis behind spyware attack on Jamal Khashoggi's family

Forensic analysis revealed that the phones of those close to the dissident journalist were targeted before and after he was murdered.

A joint investigation by the Guardian and other media organisations, based on leaked data and forensic analysis of phones, has uncovered new evidence that the company's spyware was used to try and monitor people close to Khashoggi both before and after his death.

In one case, a person in Khashoggi's inner circle was hacked four days after his murder, according to peer-reviewed forensic analysis of her device.

The investigation points to an apparent attempt by Saudi Arabia and its close ally the United Arab Emirates (UAE) to leverage the NSO's spy technology after Khashoggi's death to monitor his associates and the Turkish murder investigation, even going so far as to select the phone of Istanbul's chief prosecutor for potential surveillance, the Guardian report said.

Khashoggi was killed and dismembered at the Saudi consulate in Istanbul in October 2018.

While the investigation mostly points to Khashoggi's close associates being targeted in the months after the murder, it also identified evidence suggesting that an NSO client targeted the phone of his former wife, Hanan Elatr, several months before his death, between November 2017 and April 2018.

The report said a forensic examination of Elatr's Android phone found that she was sent four text messages that contained malicious links connected to Pegasus. The analysis indicated the targeting came from the UAE.

However, the examination did not confirm whether the device had been successfully infected.

US intelligence agencies have already concluded that the Saudi Crown Prince, Mohammed bin Salman, was responsible for ordering the murder of Khashoggi, a former Saudi government insider whose criticism of the kingdom's regime in the pages of the Washington Post was seen as a threat to the Saudi heir.

A team of Saudi agents killed Khashoggi inside the Saudi consulate in Istanbul during his visit there to pick up documents he needed to get married to his fiancee, Hatice Cengiz, who later became an outspoken advocate for accountability over his murder.

The report said a close friend of Khashoggi, Wadah Khanfar, the former director general of the Al Jazeera television network, was also hacked using Pegasus, with analysis showing that his phone was infected as recently July 2021.

The phone analysis discoveries and leaked phone records suggest that Saudi Arabia and its allies used NSO's spyware in the aftermath of the murder to monitor the campaign for justice led by friends and associates of Khashoggi, while also showing an intent to spy on the official Turkish inquiry into his murder.

The phone number of Irfan Fidan, the Istanbul chief prosecutor who later formally charged 20 Saudi nationals over the killing, also appeared in the list of numbers of possible candidates for surveillance by NSO Group clients.