Loujain al-Hathloul, a prominent Saudi women’s rights activist, has sued three former US intelligence contractors, accusing them of assisting in the hacking of her phone prior to her arrest and detention in 2018.
On behalf of al-Hathloul, the Electronic Frontier Foundation filed a complaint in US federal court on Thursday against former US officials Marc Baier, Ryan Adams, and Daniel Gericke, as well as a cybersecurity firm named DarkMatter that has a contract with the United Arab Emirates (UAE).
“Companies that peddle their surveillance software and services to oppressive governments must be held accountable for the resulting human rights abuses,” EFF Civil Liberties Director David Greene said in a statement.
“The harm to Loujain al-Hathloul can never be undone. But this lawsuit is a step toward accountability.”
According to the lawsuit, al-Hathloul was apprehended by Emirati security forces as a result of the surveillance operation carried out by the three ex-contractors and DarkMatter. She was then transported to Saudi Arabia by private plane, where she was “detained, imprisoned, and tortured,” according to the report.
The codename “Purple Sword” was granted to her by DarkMatter, according to the lawsuit, which cites a 2019 investigation by the news agency, which first revealed al-hacking. Hathloul’s
Al-Hathloul, who campaigned to lift Saudi Arabia’s prohibition on women driving, was imprisoned in 2018 alongside many other Saudi women’s rights activists.
In a case that received international outrage, she was sentenced to over six years in prison on terrorism-related charges and imprisoned for 1001 days, with stints in pre-trial custody and solitary confinement, before being freed in February.
Some of the women, including al-Hathloul, were allegedly detained in solitary confinement for months and subjected to abuse including as electric shocks, whipping, and sexual assault, according to human rights organisations.
Some of the torture sessions, according to al-Hathloul family members, took place in the presence of Saud al-Qahtani, a close ally of Saudi Crown Prince Mohammed bin Salman, also known as MBS. Saudi officials have refuted charges of torture.
“No government or individual should tolerate the misuse of spy malware to deter human rights or endanger the voice of the human conscious,” al-Hathloul said in a statement as part of her lawsuit, which was shared by EFF.
“This is why I have chosen to stand up for our collective right to remain safe online and limit government-backed cyberabuses of power. I continue to realize my privilege to possibly act upon my beliefs,” she said.
“I hope this case inspires others to confront all sorts of cybercrimes while creating a safer space for all of us to grow, share, and learn from one another without the threat of power abuses.”
The case is part of a worldwide effort to hold firms and individuals involved in electronic spyware responsible for how their products are utilised.
Last month, US President Joe Biden’s administration put Israeli firm NSO Group on a no-fly list, accusing it of developing and distributing spyware to other governments “that exploited these technologies to deliberately” target a variety of actors, including journalists and activists.
After an investigation by international media outlets revealed that the firm’s Pegasus malware was deployed by security services and autocratic governments in multiple countries, NSO Group sparked outcry from rights groups earlier this year.
Apple Inc. and WhatsApp, a messaging app, have both sued NSO Group for spying. Recent criticism has been dismissed by the Israeli company, which emphasises that its devices are used to target criminals and “terrorists.”
The three former American contractors mentioned in al-lawsuit Hathloul’s admitted to providing sophisticated computer hacking technologies to the UAE in September, according to the lawsuit.
Baier, Adams, and Gericke were “hackers-for-hire” who supplied “zero-click” computer hacking services “that may breach a device without any activity by the target,” according to the US Justice Department at the time.
The trio agreed to pay $1.68 million in penalties as part of a “deferred prosecution agreement,” which permits them to avoid criminal charges in the United States as long as they follow the terms of the arrangement, according to the Department of Justice.
“Hackers-for-hire and those who otherwise support such activities in violation of US law should fully expect to be prosecuted for their criminal conduct,” Acting Assistant Attorney General Mark Lesko said in a September 14 statement. “Left unregulated, the proliferation of offensive cybercapabilities undermines privacy and security worldwide.”
The Saudi and Emirati embassies in Washington, DC, did not respond to a request for comment on al-lawsuit Hathloul’s on Thursday, according to Reuters. Representatives for Gericke, Baier, Adams, and DarkMatter did not immediately respond to requests for comment.
