In early May, officials with the C.I.A. reached out to Ali Soufan, a former F.B.I. agent who served as a lead investigator in the months before the September 11th attacks, to say they had learned that Al Qaeda militants were plotting against him. The officials asked Soufan not to disclose many details, but, he told me, “The information was specific enough that they felt that they had to inform me.”
Two weeks later, Soufan, who lives in the New York area, became the target of a virulent campaign on social media. The campaign, amplified by trolls and bots, featured menacing statements. “Mr. Ali,” one Twitter user wrote, “Make yourself dead, beginning of the end.” Soufan brought the material to F.B.I. officials, who opened an investigation. Cybersecurity experts hired by Soufan traced at least part of the campaign to an official in the Saudi government. The campaign appeared to have involved some of the same people who had targeted Jamal Khashoggi, the Saudi dissident, Washington Post columnist, and Virginia resident who was murdered by Saudi intelligence agents in October, 2018.
Soufan is not without enemies. He has been a longtime antagonist of Al Qaeda. As an F.B.I. agent, he pursued the militants who attacked the American Embassies in Kenya and Tanzania and the U.S.S. Cole, in Yemen. He also investigated the ring of plotters who ultimately attacked the World Trade Center and the Pentagon in 2001. His efforts earned him the F.B.I. Director’s Award for Excellence, given each year to the Bureau’s outstanding agents. Soufan’s pursuit of the 9/11 plotters is depicted in the Hulu television series “The Looming Tower.” “He’s a national hero,” Bruce Riedel, a former C.I.A. analyst who is now a scholar at the Brookings Institution, told me.
Soufan has also earned the ire of the Saudi government. After leaving the Bureau, in 2005, he started the Soufan Group, a security-advisory firm in New York. His company runs a training academy for police and intelligence forces in Qatar, a neighbor and bitter rival of Saudi Arabia. Last January, when the Vice-President, Mike Pence, tweeted a message that blamed Iran for the 9/11 attacks, Soufan responded by pointing out that fifteen of the nineteen hijackers were from Saudi Arabia. The Saudi state has repeatedly disclaimed any responsibility for the attacks, but it has a long history of complicity with Al Qaeda. The families of the victims of the September 11th attacks are suing the Riyadh government for allegedly aiding the hijackers.
Soufan also knew Khashoggi, a dissident who wrote a series of damning columns for the Post about the Saudi regime. In October, 2018, Khashoggi was murdered and dismembered inside the Saudi consulate in Istanbul. No trace of him has been found, but the C.I.A. has concluded, with “medium-to-high” confidence, that the assassination was ordered by Mohammed bin Salman, the Saudi crown prince. After Khashoggi’s death, Soufan helped hold a memorial for him on Capitol Hill, which was attended by several United States senators and members of Congress.
When the social-media campaign began, Soufan asked his firm’s cybersecurity team to investigate; he also hired outside experts to advise them. They determined that the effort was started by Hussain al-Ghawi, a self-proclaimed Saudi journalist. He claimed, among other things, that Soufan, when he was an F.B.I. agent, tortured a suspected Al Qaeda operative named Ali al-Marri. (Soufan denies this. He is noted for refusing to torture an Al Qaeda suspect, Abu Zubaydah, in 2002, and later testified before Congress about the ineffectiveness of the C.I.A.’s methods.)
In another Twitter post, al-Ghawi wrote that Soufan’s company had entered into an alliance with Qatar to malign Saudi Arabia, and that Soufan had been given Qatari citizenship. (Soufan works in Qatar but denies having citizenship.) “Its purpose,” al-Ghawi said of Soufan’s company, “is to absolve Qatar of supporting terrorism.” Those claims were retweeted thousands of times by a legion of bots and fake accounts, setting the stage for more vicious attacks. “His end will be in a garbage dumpster in Qatar,” one person wrote on Twitter. “God willing.”
The deeper Soufan and his team dug, the more disturbing the details appeared. Khashoggi had also been the target of a vitriolic social-media campaign—which al-Ghawi helped instigate. In the months before the killing, al-Ghawi posted a similar series of tweets about Khashoggi, many of which were retweeted by bots and unverified accounts. “There is no one bigger than the homeland, Jamal,” he wrote. As in Soufan’s case, a relatively tame critique invited more intense attacks. “Make yourself dead,” a man tweeted at Khashoggi, in December of 2017.
Last month, another case emerged: Omar Abdulaziz, a young Saudi activist living in Montreal, told the Guardian that Canadian police had warned him of a Saudi plot to target him. Abdulaziz, a prominent critic of the Saudi regime, was a friend and collaborator of Khashoggi.
The threats against Khashoggi, Soufan, and Abdulaziz bear striking similarities. The phrases “the beginning of the end,” “make yourself dead,” and “your end is in a garbage dumpster” appear in tweets about all three. These sorts of phrases are not uncommon in Twitter exchanges in the Arab world, nor are Khashoggi, Soufan, and Abdulaziz the only targets of pro-Saudi trolls. Still, Soufan is concerned that the over-all pattern suggests that he is a target. “Jamal was murdered by Saudi operatives,” he said. “The threat against Omar is confirmed by Canadian authorities to be directly linked to Saudi Arabia. It seems highly unlikely that the threat against me would not be connected as well.”
Who is al-Ghawi? The Twitter account in his name is verified, so he is most likely not a bot, but his account does not accept direct messages. (I was unable to contact him.) He runs a YouTube program called “Al Jamra,” or “The Hot Coal,” which broadcasts pro-Saudi propaganda.
Officials at the Saudi Embassy in Washington declined to address the specifics of Soufan’s case, but said, “Saudi Arabia rejects such baseless allegations, which are not supported by any evidence, and which are intended to serve the agendas of those propagating them.” The officials added that Saudi Arabia prosecutes violators of its cybercrimes laws and allows victims to file suit. But the Saudi government has apparently used online campaigns to further its interests. In December of 2019, Twitter announced that it had terminated fifty-nine hundred and twenty-nine accounts that were part of “a significant state-backed information operation on Twitter originating in Saudi Arabia.” Twitter said that the accounts, most of which were automated, violated the company’s “platform manipulation policies.” Records show that at least five of them had interacted with Khashoggi’s account before his murder. Soufan’s team also identified thirty-seven accounts that retweeted or liked postings critical of both Khashoggi and Soufan. “These are the classic signs of a state-supported campaign,” Zachary Schwitzky, one of the experts whom Soufan hired to examine the data, said.
At the same time, details of the Al Qaeda plot disclosed by the C.I.A. appeared to match those in the social-media campaign. Agency officials told Soufan that he could be targeted while he was in Qatar; tweets aimed at him said the same thing. The C.I.A. said that the plot appeared to be motivated by his time in the F.B.I. and his continuing work on counterterrorism issues; the tweets suggested the same. “The disinformation campaign used false narratives and dangerous imagery about me that directly aligned with elements of the threat,” Soufan said.
Perhaps the most compelling evidence is a video posted online, in May, which amplifies the claim that Soufan tortured Al Qaeda suspects. The video, which has been viewed more than a hundred thousand times, refers to an “American-Lebanese investigator responsible for the sept bombings investigations” who “tried with all he could to condemn Saudi Arabia for those events and failed, currently holds Qatari citizenship and work in Doha.” The video’s credits say that it was produced by Ali Dahgish, whose LinkedIn page identifies him as an employee of the Saudi Ministry of Education. Dahgish has also contributed to a Twitter campaign against two female Al Jazeera journalists who have criticized the Saudi government for Khashoggi’s killing. (Al Jazeera is owned by the government of Qatar.)
When Dahgish posted the video on Twitter, he suggested that Soufan was coöperating with the American 9/11 victims in their lawsuit against the Saudi government. “Every now and then Al Jazeera comes up with a source revealing leaked documents proving the involvement of Saudi officials in the events of September 11,” he wrote. Dahgish thanked al-Ghawi, of “The Hot Coal,” for unearthing the connection. (Soufan says that he is not helping the plaintiffs, which James Kreindler, one of their lead lawyers, confirms.)
The video is interesting for another reason: it was retweeted with approving comments by Hamad al-Mazrouei, an adviser to Mohammed bin Zayed—the de-facto leader of the United Arab Emirates and a close ally of M.B.S. Mazrouei also posted several tweets criticizing Khashoggi in the months before his death, including one that read, “May God not release him, a goatee that deserves the razor.”
Soufan acknowledges that the evidence is inconclusive. But the Saudi government, despite a deluge of negative publicity that followed Khashoggi’s murder, has apparently continued efforts to punish critics overseas. In May, the Washington Post columnist David Ignatius reported that Saudi authorities had detained a son and a daughter of Saad Aljabri, a former senior Saudi intelligence officer living in exile in Toronto, in an apparent attempt to force him to return home to face arrest.
Soufan, unlike Aljabri, is an American citizen and a decorated veteran of U.S. law enforcement. For the Saudis to attack him directly would be an unprecedented act of aggression. His concern is that, given the regime’s history with Al Qaeda, militants could attempt to kill him in Qatar—and the attack could be traced to the death threats planted on social media. “It wouldn’t be the first time a state actor uses militants or terrorists to do its dirty work,” he said.