Saudi Arabia implicated in phone spying campaign against citizens in US

The whistleblower leaked data to The Guardian that appears to show millions of secret tracking requests from Saudi Arabia over a four-month period starting in November last year.

The requests sought to find the US location of Saudi-registered phones, and appeared to originate from the kingdom's three largest mobile companies.

The whistleblower told The Guardian they were unable to find any reasonable excuse for the volume of requests.

"There is no other explanation, no other technical reason to do this. Saudi Arabia is weaponising mobile technologies," they said.

Telecommunications and security experts who were shown the leaked data also agreed that it constituted evidence of a surveillance campaign by the Saudi state.

The data shows requests for location data routed through the SS7 global messaging system, which allows mobile phone operators to connect users around the world.

For example, a mobile user from Saudi Arabia travelling in the US and seeking to make a call back to the kingdom is routed through the SS7 network.

The SS7 system enables the tracking of phones. In many cases, this is for a perfectly ordinary reason.

— The New Arab (@The_NewArab) January 29, 2020" style="color:#fff;" class="twitter-post-link" target="_blank">Twitter Post ‘The lack of official #US reaction yet again provides #Saudi Arabia with a sense that they can do pretty much anything‘ writes @DanDePetris https://t.co/mXQVzZWKCk — The New Arab (@The_NewArab) January 29, 2020

When a US carrier receives a Provide Subscriber Information SS7 message, or PSI, from a foreign mobile operator, such requests are normally used to help determine mobile roaming charges.

Excessive use of PSI messages is known to be a hallmark of suspect location tracking, however.

The data seen by The Guardian appears to show that Saudi Arabia's three largest mobile phone operators - Zain, Mobily and Saudi Telecom - sent one US operator a combined average of 2.3m location requests per month between Novermber 2019 and March this year.

It also appears to show that Saudi mobile phones were being tracked as often as two to 13 times per hour as their users travelled through the US.

One of the Saudi operators also apparently sent another type of location requests - Provide Subscriber Location, or PSL, requests - that were blocked by US operators.

John Scott-Railton, a senior researcher at the University of Toronto's Citizen Lab, said the data appeared to show foreign agents "flagrantly abusing" flaws in the US mobile network to track people moving around the country.

"In this moment of crisis, phone companies, regulators and the Department of Justice should step up to prevent foreign powers from tracking us through our phones," he said.

It has previously been widely reported that the Saudi government has used spyware to hack the phones of dissidents abroad.

Amazon chief Jeff Bezos' phone was hacked last year, allegedly after he was sent an image laden with spyware by Saudi Crown Prince Mohammad bin Salman.

[Click to enlarge]

Canada-based Saudi dissident Omar Abdulaziz launched a legal case against an Israeli tech company in 2018 for selling its Pegasus phone-hacking software to Saudi Arabia.