Experts who uncovered Khashoggi surveillance before journalist's murder 'targeted by international spies'

Undercover agents met with Citizen Lab employees to ask about research on Israeli spy software company, according to investigation

The researchers who reported that Israeli software was used to spy on Washington Post journalist Jamal Khashoggi‘s inner circle before his death are being targeted by international undercover operatives, an investigation by the Associated Press has revealed.

Twice in the past two months, men masquerading as socially conscious investors have lured members of the Citizen Lab internet watchdog group to meetings at luxury hotels to quiz them for hours about their work exposing Israeli surveillance and the details of their personal lives.

In both cases, the researchers believe they were secretly recorded. Citizen Lab director Ron Deibert described the stunts as a new low.

“We condemn these sinister, underhanded activities in the strongest possible terms,” he said in a statement on Friday. “Such a deceitful attack on an academic group like the Citizen Lab is an attack on academic freedom everywhere.”

Who these operatives are working for remains unknown, but their tactics recall those of private investigators who assume elaborate false identities to gather intelligence or compromising material on critics of powerful figures in government or business.

Citizen Lab, based out of the Munk School of Global Affairs at the University of Toronto, has for years played a leading role in exposing state-backed hackers operating in places as far afield as Tibet, Ethiopia and Syria.

Lately the group has drawn attention for its repeated exposes of an Israeli surveillance software vendor called the NSO Group, a firm whose wares have been used by governments to target journalists in Mexico, opposition figures in Panama and human rights activists in the Middle East.

In October, Citizen Lab reported that an iPhone belonging to one of Khashoggi’s confidantes had been infected by the NSO’s signature spy software only months before the journalist’s grisly murder.

The friend, Saudi dissident Omar Abdulaziz, would later claim that the hacking had exposed Khashoggi’s private criticisms of the Saudi royal family to the Arab kingdom’s spies and thus played a major role” in his death.

John Scott-Railton, a senior researcher at the Citizen Lab, an internet watchdog group, holds his cell phone which has its camera blocked by an adhesive sticker, as he poses for a photograph (AP)

In a statement, NSO denied having anything to do with the undercover operations targeting Citizen Lab, “either directly or indirectly” and said it had neither hired nor asked anyone to hire private investigators to pursue the Canadian organisation. “Any suggestion to the contrary is factually incorrect and nothing more than baseless speculation,” NSO said.

NSO has long denied its software was used to target Khashoggi, although it has refused to comment when asked whether it has sold its software to the Saudi government more generally.

The first message reached Bahr Abdul Razzak, a Syrian refugee who works as a Citizen Lab researcher, on 6 December, when a man calling himself Gary Bowman got in touch via LinkedIn. The man described himself as a South African financial technology executive based in Madrid.

“I came across your profile and think that the work you’ve done helping Syrian refugees and your extensive technical background could be a great fit for our new initiative,” Mr Bowman wrote.

Mr Abdul Razzak said he thought the proposal was a bit odd, but he eventually agreed to meet the man at Toronto’s Shangri-La Hotel on the morning of 18 December.

The conversation got “weird” very quickly, Mr Abdul Razzak said.

Mr Scott-Railton’s phone with its blocked camera (AP)

Instead of talking about refugees, Mr Abdul Razzak said, Mr Bowman grilled him about his work for Citizen Lab and its investigations into the use of NSO’s software. Mr Abdul Razzak said Mr Bowman appeared to be reading off cue cards, asking him if he was earning enough money and throwing out pointed questions about Israel, the war in Syria and Mr Abdul Razzak’s religiosity.

“Do you pray?” Mr Abdul Razzak recalled Mr Bowman asking. “Why do you write only about NSO?” “Do you write about it because it’s an Israeli company?” “Do you hate Israel?”

Mr Abdul Razzak said he emerged from the meeting feeling shaken. He alerted his Citizen Lab colleagues, who quickly determined the breakfast get-together had been a ruse.

Mr Bowman’s supposed Madrid-based company, FlameTech, had no web presence beyond a LinkedIn page, a handful of social media profiles and an entry in the business information platform Crunchbase. A reverse image search revealed the profile picture of the man listed as FlameTech’s chief executive, Mauricio Alonso, was a stock photograph.

“My immediate gut feeling was: ‘This is a fake,”’ said John Scott-Railton, one of Mr Abdul Razzak’s colleagues.

Mr Scott-Railton flagged the incident to the AP, which confirmed FlameTech was a digital facade.

Searches of the Orbis database of corporate records, which has data on some 300 million global companies, turned up no evidence of a Spanish firm called FlameTech or Flame Tech or any company anywhere in the world matching its description.

Similarly, the AP found no record of FlameTech in Madrid’s official registry or of a Gary Bowman in the city’s telephone listings. An Orbis search for Alonso, the supposed chief executive, also drew a blank. When an AP reporter visited Madrid’s Crystal Tower high-rise, where FlameTech claimed to have 250sqm of office space, he could find no trace of the firm and calls to the number listed on its website went unanswered.

The AP was about to publish a story about the curious company when, on 9 January, Mr Scott-Railton received an intriguing message of his own.

This time the contact came not from Mr Bowman of FlameTech but from someone who identified himself as Michel Lambert, a director at the Paris-based agricultural technology firm CPW-Consulting.

In his introductory email, he referred to Mr Scott-Railton’s early doctoral research on kite aerial photography – a mapping technique using kite-mounted cameras – and said he was quite impressed.

“We have a few projects and clients coming up that could significantly benefit from implementing Kite Aerial Photography,” he said.

Like FlameTech, CPW-Consulting was a fiction. Searches of Orbis and the French commercial court registry Infogreffe turned up no trace of the supposedly Paris-based company or indeed of any Paris-based company bearing the acronym CPW.

And when the AP visited CPW’s alleged office there was no evidence of the company; the address was home to a mainly residential apartment building. Residents and the building’s caretaker said they had never heard of the firm.

Whoever dreamed up CPW had taken steps to ensure the illusion survived a casual web search, but even those efforts didn’t bear much scrutiny. The company had issued a help wanted ad, for example, seeking a digital mapping specialist for their Paris office, but Mr Scott-Railton discovered the language had been lifted almost word-for-word from an ad from an unrelated company seeking a mapping specialist in London. A blogpost touted CPW as a major player in Africa, but an examination of the author’s profile suggested the article was the only one the blogger had ever written.

When Mr Lambert suggested an in-person meeting in New York during a 19 January phone call, Mr Scott-Railton felt certain Mr Lambert was trying to set him up but agreed to the meeting.

Mr Scott-Railton had spent the night before the meeting trying to hide a homemade camera in his tie, he later told AP, eventually settling for a GoPro action camera and several recording devices hidden about his person. On the table, Mr Lambert had placed a large pen in which Mr Scott-Railton said he spotted a tiny camera lens peeking out from an opening in the top.

At the beginning of the meal, a man sat behind Mr Lambert, holding up his phone as if to take pictures and then abruptly left the restaurant, having eaten nothing. Later, two or three men materialised at the bar and appeared to be monitoring proceedings.

A few tables away, two Associated Press journalists were making small talk as they waited for a signal from Mr Scott-Railton, who had invited the reporters to observe the lunch from nearby and then interview Mr Lambert near the end of the meal.

Like Mr Bowman, Mr Lambert appeared to be working off cue cards. At one point he repeated a racist French expression, insisting it wasn’t offensive. He also asked Mr Scott-Railton questions about the Holocaust, antisemitism and whether he grew up with any Jewish friends. At another point he asked whether there might not be a racist element to Citizen Lab’s interest in Israeli spyware.

After dessert arrived, the AP reporters approached Mr Lambert at his table and asked him why his company didn’t seem to exist.

“I know what I’m doing,” Mr Lambert said, as he put his files – and his pen – into a bag. Then he stood up, bumped into a chair and walked off, saying “Ciao” and waving his hand, before returning because he had neglected to pay the bill.

As he paced around the restaurant waiting for the check, Mr Lambert refused to answer questions about who he worked for or why no trace of his firm could be found.

“I don’t have to give you any explanation,” he said. He eventually retreated to a back room and closed the door.

Who Mr Lambert and Mr Bowman really are isn’t clear. Neither men returned emails, LinkedIn messages or phone calls. And despite their keen focus on NSO, the AP found no evidence of any link to the Israeli spyware merchant, which is adamant that it wasn’t involved.

The kind of aggressive investigative tactics used by the men who targeted Citizen Lab have come under fire in the wake of the Harvey Weinstein sexual abuse scandal. Black Cube, an Israeli private investigation firm, apologised after The New Yorker and other media outlets revealed that the company’s operatives had used subterfuge and dirty tricks to help the Hollywood mogul suppress allegations of rape and sexual assault.

Mr Scott-Railton and Mr Abdul Razzak said they didn’t want to speculate about who was involved. But both said they believed they were being steered toward making controversial comments that could be used to blacken Citizen Lab’s reputation.

“It could be they wanted me to say, ‘Yes, I hate Israel,’ or ‘Yes, Citizen Lab is against NSO because it’s Israeli,”’ Mr Abdul Razzak said.

Mr Scott-Railton said the elaborate, multinational operation was gratifying.

“People were paid to fly to a city to sit you down to an expensive meal and try to convince you to say bad things about your work, your colleagues and your employer,” he said. “That means that your work is important.”

AP