Revealed: the Saudi heir and the alleged plot to undermine Jeff Bezos

Jeff Bezos, the billionaire owner of the Washington Post, had no reason to be suspicious when he received a WhatsApp message from the account of the crown prince of Saudi Arabia in May 2018.

Bezos and Mohammed bin Salman had attended a dinner together in Hollywood a few weeks earlier hosted by Brian Grazer, the Oscar-winning producer, and Ari Emanuel, the powerful talent agent, as part of the young crown prince’s tour of America, which was hailed by some observers as an effort to rebrand the kingdom and set it on a new course.

The then 32-year-old Saudi heir, known all over the world as “MBS”, had been greeted with open arms from Los Angeles to New York – with stops at the White House, MIT and Harvard. He had rubbed shoulders with celebrities ranging from Oprah to Dwayne “The Rock” Johnson.

It appeared to be a PR coup for the crown prince, who had previously been criticised by human rights campaigners about his decision to wage a bloody war in Yemen – and also the alleged imprisonment and torture of rich Saudis at the Ritz-Carlton in Riyadh.

Amazon had even been in talks about the possibility of opening data centres in Saudi Arabia.

The dinner engagement could have been the start of a promising relationship between two of the world’s most powerful men. But it would swiftly turn sour – and in spectacular fashion.

According to sources who have spoken to the Guardian, the message sent to Bezos on that Tuesday 1 May from the personal account of the crown prince contained a video file – of what, it is not clear.

But a forensic technical analysis of the file has found that it is “highly probable” it contained malware that penetrated Bezos’s mobile phone and exfiltrated a large amount of data within hours.

Bezos, it seems, had been hacked.

The Guardian has no knowledge about the precise nature of the material that was allegedly taken or what was done with it.

But this apparent targeting of Bezos’s phone appears to fit into a broader pattern of behaviour by Saudi Arabia.

The crown prince and his inner circle have been criticised for attempting to undermine real and perceived critics of his regime all over the world.

Was Bezos, the owner of the Washington Post, the paper that employed the eloquent Saudi dissident Jamal Khashoggi, considered one of them?

Certainly, among all of the perceived enemies of the crown prince, Khashoggi was considered one of the most dangerous. His knowledge of the royal court – he had once worked within it – and the platform then afforded him by such a respected newspaper, gave his articles real weight.

And this was causing great agitation inside the royal court.

According to a New York Times report in 2019, MBS was growing “increasingly alarmed” by Khashoggi’s criticisms during this period.

In September 2017, just as Khashoggi wrote that Saudi Arabia was becoming “unbearable” because of its repression, the young prince privately told an aide that he would use a “bullet” on Khashoggi, according to current and former US and foreign officials cited by the New York Times.

At nearly the same time, the crown prince was developing a relationship with a different American publisher who would print a far more flattering portrait of the Saudi heir.

According to the New York Times, in September 2017, MBS met David Pecker, the chief executive of American Media Inc (AMI), the owner of the National Enquirer supermarket tabloid, in Saudi Arabia.

Pecker is an important player in Washington. Two months earlier he had had a private dinner with Donald Trump in the White House. Among the other guests was Kacy Grine, a financier who reportedly served as an advisor to Saudi royals.

Pecker and Trump were longtime allies. A Department of Justice investigation would later reveal that Pecker had played a critical role in helping the Trump campaign to “kill” negative stories about the then-candidate’s extramarital affairs and pay hush money to women who were interested in telling their stories.

When MBS flew to the US for his maiden trip as crown prince in March of the following year, it was Pecker’s company that published a glossy magazine hailing him as a great leader who would transform the world.

Pecker, Grine, and MBS met for a second time during the crown prince’s stay in New York.

A few weeks after the alleged Bezos hack, another suspected cyber attack was launched. The target was an influential Saudi dissident who was living in Canada and was a close friend of Khashoggi.

According to an analysis by the independent research group Citizen Lab, Omar Abdulaziz received a fake infected link about a delivery he was expecting in late June 2018 that contained malware that infiltrated his phone.

The Guardian understands Khashoggi and Abdulaziz traded “hundreds” of messages in the months that followed.

Abdulaziz has claimed in a lawsuit that his communications were probably intercepted by Saudi Arabia – an allegation the kingdom has denied. But Abdulaziz fears his messages to Khashoggi could have given insights to the people who would later kill him.

He was not alone. Two other dissidents, the London-based satirist Ghanem Almasarir, and Yahya Assiri, a dissident who was in frequent contact with Khashoggi, were also alleged by experts to have been targeted by Saudi cyber threats in that period.

‘Certain powerful people will wrongly conclude I am their enemy’

Two months after the killing on 2 October 2018, another story emerged. It was seemingly unrelated to the murder of Jamal Khashoggi and was far more salacious.

On 10 January 2019, the National Enquirer published a special edition that exposed Bezos had had an affair.

More than a dozen other articles followed across various AMI publications, in what seemed to be a campaign against the CEO.

The story of the extramarital relationship included intimate details – including the text messages he had sent to his girlfriend months earlier, text messages that were sent just days after Bezos’s mobile phone had been sent the WhatsApp message with the malicious file.

Trump, an ardent critic of Bezos, the Washington Post, and Amazon, who was alleged in a media report to be “obsessed” with Amazon, appeared to revel in the news.

“So sorry to hear the news about Jeff Bozo being taken down by a competitor whose reporting, I understand, is far more accurate than the reporting in his lobbyist newspaper, the Amazon Washington Post,” he tweeted. “Hopefully the paper will soon be placed in better & more responsible hands!”

The story did not end there. A few weeks later, on 7 February, Bezos published an extraordinary blogpost titled: “No thank you, Mr. Pecker” in which he described an elaborate “extortion” attempt by the owner of the National Enquirer, which had threatened in emails to publish intimate photographs of Bezos and of his girlfriend if the CEO did not agree to stop an investigation into how the National Enquirer had obtained its information.

AMI insisted that it had not been “instigated, dictated or influenced in any manner by external forces, political or otherwise”.

Bezos rejected the offer and published the email correspondence between them – which included a series of embarrassing descriptions of the photographs AMI alleged it possessed.

“It’s unavoidable that certain powerful people who experience Washington Post news coverage will wrongly conclude I am their enemy,” Bezos wrote. “President Trump is one of those people, obvious by his many tweets. Also, the Post’s essential and unrelenting coverage of the murder of its columnist Jamal Khashoggi is undoubtedly unpopular in certain circles.”

Other experts also weighed in. John Brennan, the former CIA director and CIA station chief in Riyadh, commented on MSNBC: “I have no doubt, given the Post’s relentless and appropriate condemnation of MBS for the killing of Khashoggi, that he would try to discredit, embarrass and hurt Bezos financially if he could.”

A few weeks later, Bezos’s head of security, Gavin de Becker, published his own editorial in the Daily Beast, claiming that his investigation into the National Enquirer leaks had concluded that Saudi Arabia had accessed Bezos’s phone. He declined to publish any further details, but said he had given information about his investigation into the National Enquirer leaks to law enforcement officials. Both Saudi Arabia and Pecker’s AMI flatly denied the allegation and any suggestion that Saudi Arabia was involved in the matter.

Bruce Riedel, a former CIA analyst and Saudi expert, said the potential “hack” of Bezos’s phone reflected the possibility of Saudi’s premeditation.

“We can connect the dots now,” he said. “They actually weaponised this hack into Bezos’s phone to publicly air some very intimate parts of his life story, I assume in an attempt to slander and smear him….[thinking] they might need dirt on him later on.”

It ultimately reflected a lack of understanding of how the US works, Riedel said, and how the Washington Post owner would react to such a threat. He also said the episode raised questions about what US intelligence agents may have known about the hack. It was another example, he said, of how the Trump administration had failed to hold MBS and the Saudis accountable for their alleged abuses.

Last October, Bezos stood in front of the Saudi consulate in Istanbul and paid tribute to Khashoggi at a vigil to commemorate the one-year anniversary of his murder.

“No one should ever have to endure what you did,” he said to Hatice Cengiz, Khashoggi’s fiancee. “You paced that street for hours, pacing and waiting. And he never came out. It’s unimaginable. And you need to know that you are in our hearts. We are here and you’re not alone.”

Both Saudi Arabia and AMI have denied that the kingdom was involved in the publication of the Bezos story.

A lawyer for Bezos who was contacted by the Guardian said: “I have no comment on this except to say that Mr Bezos is cooperating with investigations.”

The Guardian asked the Saudi embassy in Washington about the claims. It did not immediately return a request for comment.

Have you got new information about this story? You can message Guardian investigations using Signal or WhatsApp: +447584640566. For the most secure communications, use SecureDrop. You can also email: stephanie.kirchgaessner@theguardian.com.