A princess raced to escape Dubais powerful ruler Then her phone appeared on the list
The princess had been careful, so she left her phone in the cafeâs bathroom. Sheâd seen what her father could do to women who tried to escape.
She hid in the trunk of a black Audi Q7, then jumped into a Jeep Wrangler as her getaway crew raced that morning from the glittering skyscrapers of Dubai to the rough waves of the Arabian Sea. They launched a dinghy from a beach in neighboring Oman, then, 16 miles out, switched to water scooters. By sunset theyâd reached their idling yacht, the Nostromo, and began sailing toward the Sri Lankan coast.
Princess Latifa bint Mohammed al-Maktoum, the 32-year-old daughter of Dubaiâs fearsome ruler, believed she was closer than ever to political asylum â" and, for the first time, real freedom in the United States, members of her escape team said in interviews.
But there was one threat she hadnât planned for: The spyware tool Pegasus, which her fatherâs government was known to have used to secretly hack and track peopleâs phones. Leaked data shows that by the time armed commandos stormed the yacht, eight days into her escape, operatives had entered the numbers of her closest friends and allies into a system that had also been used for selecting Pegasus surveillance targets.
âShoot me here. Donât take me back,â sheâd screamed as soldiers dragged her off the boat, roughly 30 miles from the shore, according to a fact-finding judgment by the United Kingdomâs High Court of Justice. Then she disappeared.
Latifaâs failed 2018 escape from her father â" Sheikh Mohammed bin Rashid al-Maktoum, the United Arab Emiratesâ prime minister, vice president and minister of defense â" sparked outrage and gave life to a troubling mystery: How, given all her precautions, had the princess been found?
An investigation by The Washington Post and an international consortium of news organizations may offer critical new insight: Their numbers appear on a list that includes phones targeted for surveillance with Pegasus, the hacking tool from the Israeli spyware giant NSO Group, amid the sprint to track her down.
Numbers for Latifa and her friends were added to the list in the hours and days after she went missing in February 2018, the investigation shows. The UAE was believed to have been an NSO client at the time, according to evidence discovered by the research group Citizen Lab.
It is unknown what role, if any, the phone-hacking software ultimately played in the princessâs capture. Their phones were not available for forensic examination, and the list does not identify who put the numbers on it or how many were targeted or compromised. In multiple statements, NSO has denied that the list was purely for surveillance purposes.
âIt is not a list of targets or potential targets of NSOâs customers, and your repeated reliance on this list and association of the people on this list as potential surveillance targets is false and misleading,â NSO said in a letter Tuesday.
But when Amnesty Internationalâs Security Lab examined data from 67 phones whose numbers were on the list to search for forensic evidence of Pegasus spyware, 37 phones showed traces, including 23 phones that had been successfully infected and 14 others that showed signs of attempted targeting.
The forensic analyses of the 37 smartphones also showed that many displayed a tight correlation between time stamps on the list and the beginning of surveillance â" sometimes as little as a few seconds.
In the year after Latifa's chase, operatives appear to have entered numbers onto the list for another Dubai princess: one of the sheikhâs six wives, Haya bint Hussein, who had voiced concerns about Latifaâs confinement before fleeing with her two young children to London.
Princess Haya, her half sister, her assistants, her horse trainer, and members of her legal and security teams all had their phones entered onto the list in early 2019, both in the days before and in the weeks after she, too, fled Dubai, the investigation shows. Around that time, Haya later told a British court, sheâd faced threats of exile to a desert prison and twice discovered a gun in her bed.
An NSO attorney said the company âdoes not have insight into the specific intelligence activities of its customersâ and that the list of numbers could have been used for âmany legitimate and entirely properâ purposes âhaving nothing to do with surveillance.â
But a person familiar with the operations of NSO who spoke to The Post on the condition of anonymity to discuss internal operations says the company terminated its contract with Dubai within the last year after it learned of the princessesâ surveillance and other human-rights concerns.
NSOâs co-founder and chief executive, Shalev Hulio, on Sunday said he was disturbed by reports of journalists and others being hacked with his companyâs software, and he promised investigations. He said the company had terminated two contracts in the past 12 months because of human rights concerns.
NSO said in a âTransparency and Responsibility Reportâ last month that the company had disconnected five clients from Pegasus since 2016 following investigations of misuse, including one unnamed client that a company probe last year revealed had used the system to âtarget a protectedâ individual.
Latifaâs hunters had many options for pursuit and interception, and some of the princessâs supporters have suggested that the Nostromoâs crew members made tactical errors, including sending online messages during the chase that could have given their location away.
But the records show that the phones were added to the list at critical moments in the search, underscoring how a surveillance tool that NSO says is deployed to âhelp governments protect innocents from terror and crimeâ can be abused. The Pegasus software allows operatives to track a hacked phoneâs location, read its messages, and turn its cameras and microphones into live-streaming spy devices.
How Pegasus worksTarget: Someone sends whatâs known as a trap link to a smartphone that persuades the victim to tap and activate â" or activates itself without any input, as in the most sophisticated âzero-clickâ hacks.
Infect: The spyware captures and copies the phoneâs most basic functions, NSO marketing materials show, recording from the cameras and microphone and collecting location data, call logs and contacts.
Track: The implant secretly reports that information to an operative who can use it to map out sensitive details of the victimâs life.
.article-body mark { background-color: white !important; font-family: Franklin,Arial,Helvetica,sans-serif; font-size: var(--font-size-xs); color: inherit; } @media only screen and (min-width:768px) { .article-body h4 { font-family: Franklin,Arial,Helvetica,sans-serif; font-size: var(--font-size-medium); } } @media only screen and (max-width:767px) { .article-body h4 { font-family: Franklin,Arial,Helvetica,sans-serif; font-size: var(--font-size-small); } }Forbidden Stories, a Paris-based journalism nonprofit, oversaw the investigation, called the Pegasus Project, and the news organizations worked collaboratively to conduct further analysis and reporting. Journalists from the British newspaper the Guardian and the German newspaper Süddeutsche Zeitung contributed reporting for this article.
Officials with Dubai and the UAE, a close ally of the United States, did not respond to requests for comment but have previously declined, saying the episodes are family matters. The sheikh has argued that the assault on the Nostromo rescued his daughter from a high-ransom kidnapping, though Latifa had prerecorded a video explaining that sheâd chosen to run because of years of oppression and abuse.
The sheikhâs personal attorneys in the U.K. and Germany sent letters this month denying his involvement in any attempted hacks. Officials with the sheikhâs Dubai Rulerâs Court have previously said in statements that they are âdeeply saddened by the continued media speculationâ and that Latifa is âsafe and in the loving care of her family.â
From the outside, Latifa seemed to enjoy a life of unimaginable affluence. The Emirati princess lived in a palace compound in the Emiratesâ biggest city and appeared free to enjoy wild extravagances, including riding champion racehorses and leaping out of planes.
Her father, one of the Persian Gulfâs most powerful autocrats, had presided over Dubaiâs transformation into a capitalist playground for the ultrarich, famous for showpieces such as the worldâs tallest tower, the Burj Khalifa, and palm-shaped islands visible from space.
When not commanding his empire, the sheikh had become a star in the world of thoroughbred horse racing, owning one of its most prestigious breeding operations, and spent heavily to portray himself as a progressive crusader for womenâs rights and a family man to his 25 children, three of whom are named Latifa. He also wrote books, such as âReflections on Happiness and Positivity,â and poetry, which he posted to his 5.7 million-follower Instagram account.
To Latifa, her fatherâs public persona was all a lie, she would say in the video. Her life had been rigorously scheduled and restricted. She could not drive or travel, and her every movement was tracked by her fatherâs office. Her siblings, she said, lived similar lives of mistreatment or neglect.
âThere is no justice here. They donât care. Especially if youâre a female, your life is so disposable,â she said. âAll my father cares about is his reputation. He will kill people to protect it. ⦠Heâs even burned down houses to hide the evidence.â
In the summer of 2000, Latifaâs older sister Shamsa, then a mother figure to her, ran away from the sheikhâs stables during a family holiday in the U.K. For weeks, she lived as a fugitive, sleeping in a London hostel and staving off loneliness by calling friends back home, according to Latifaâs video and the High Court judgment released last year.
Soon after, Shamsa was abducted off the street in Cambridge, flown via helicopter to France and shuffled onto a private jet back to Dubai, the judgment found. Latifa said in the video that one of Shamsaâs friendâs phones had been bugged, allowing her father to learn where she was.
In a letter Shamsa sent to an immigration lawyer and cited by the British court, Shamsa said sheâd been imprisoned and forcibly tranquilized. âThey have all the money, they have all the power, they think they can do anything,â she wrote. She has not been seen since.
Two years after Shamsa went missing, a distraught Latifa, then 16, attempted her own vanishing act. Sheâd naively believed, she said in the video, that she could just cross the border to Oman to find help or, at worst, get locked up with Shamsa, who would at least then know âshe has somebody with her.â
When the border guards caught her, Latifa said, she was returned to her fatherâs compound, confined alone in a windowless room and subjected to âconstant torture.â âYour father told us to beat you until we kill you,â she recalled her captors telling her. âI didnât know when one day ended and the next began.â
After three years and four months, she was freed. The High Court judge wrote later that she marveled then at the âstrangeness of ordinary thingsâ: car rides as fast as a âroller coaster,â the bliss of a bath. She appeared to live a quiet life, spending her days at the horse stables and training in the dance-fighting style of capoeira with Tiina Jauhiainen, a Finnish instructor who became her friend.
But Latifa never stopped dreaming of escape. By 2017, Jauhiainen said in interviews with a Guardian reporter in April, she and the princess had begun drawing up a daring plan, recruiting Christian Elombo, Jauhiainenâs friend and fellow trainer, and Herve Jaubert, a French businessman whoâd fled Dubai after an embezzlement conviction and had moved to Florida, where he built submarines.
Latifa committed her entire life savings of more than $300,000 toward the plan, Jauhiainen said in interviews. And as a last resort, she recorded the 40-minute video in Jauhiainenâs apartment, scheduling it to post online if their bid collapsed.
âIf you are watching this,â Latifa said, âeither Iâm dead or Iâm in a very, very, very bad situation.â
By the time the leaked records show Latifaâs number was added to the list, she and Jauhiainen had already ditched their phones in the bathroom of La Serre, a Parisian cafe in downtown Dubai, and begun their doomed voyage across the Arabian Sea.
Someone then added numbers for Juan Mayer, an aerial photographer who often recorded Latifaâs skydives; Lynda Bouchikhi, an event manager who had served as Latifaâs officially sanctioned chaperone; and Sioned Taylor, another friend and chaperone whose LinkedIn profile says she worked then as a âpersonal assistantâ for a âmember of the Ruling Family.â Taylor, through an attorney, declined to comment. Mayer and Bouchikhi did not respond to requests for comment.
Aboard the Nostromo, a two-masted, U.S.-flagged sailing yacht chartered for luxury cruises around Southeast Asia, the escape team was growing anxious, Jauhiainen said. Theyâd planned to cross the Indian Ocean, disembark in Sri Lanka with prearranged visas and hop a flight to the United States. To pass the time, they watched bad movies and sent messages using a satellite Internet connection that Jaubert had pledged was secure.
But when they lost contact with Elombo â" who unbeknown to them had, after piloting the dinghy back to shore, been arrested in Oman â" the team abruptly steered toward a backup dock on Indiaâs coast for fear theyâd been compromised, Jauhiainen said. Soon, an Indian coast guard boat and low-flying plane began shadowing them.
Then one night, as they prepared for bed, the team heard heavy boots on the upper deck, Jauhiainen said. Their cabins suddenly filled with smoke. An Indian special forces unit â" backed by helicopters, military boats and a squad of UAE soldiers â" had blitzed the Nostromo, shouting Latifaâs name. Locking herself in a bathroom, the princess sent Radha Stirling, head of the London advocacy group Detained in Dubai, a distress call over WhatsApp: âPlease help ⦠thereâs men outside.â
As the team watched, Jauhiainen said, the commandos tied Latifaâs hands behind her back and dragged her off the yacht, their gunsâ laser sights shimmering through the darkness.
In the week afterward, Latifaâs supporters posted her âlast videoâ online and filed missing-person reports with international law enforcement agencies, including the FBI. Jaubert, Jauhiainen and Elombo were questioned for days in Dubai and then released, with no idea where Latifa was being held. And all the while, the leaked data shows, operatives continued to add the princessâs allies to the list.
In the years since, the escape team has struggled to piece together what went wrong. Jauhiainen has questioned the yachtâs satellite uplink and, in a report this month, USA Today cited unnamed people knowledgeable about the operation who said the FBI had assisted with what they believed was a kidnapping investigation by pulling location data from the satellite Internet provider, Rhode Island-based KVH Industries. The FBI and KVH declined to comment.
But the yacht also carried two âburnerâ phones, according to Jauhiainen, which Jaubert has argued were bugged. Latifa had used them to send emails, seek help on Instagram and exchange messages through WhatsApp, the Facebook-owned messaging firm that sued NSO in 2019, alleging the company helped spy on its users.
She had also communicated, Jauhiainen said, with Taylor, whose phone, the leaked data show, had been added to the list before the assault.
âExposedâPrincess Haya had for months gone along with her husbandâs assertion that Latifa was the mentally unstable victim of a criminal plot. But as Latifaâs video gained attention, she began to openly question the official line.
In late 2018, Haya arranged for a doctor and psychiatrist to see Latifa at her guarded villa. When they found nothing wrong, she visited Latifa herself. Latifa, Haya would tell the High Court, appeared pale and forlorn, caged in a bedroom âakin to a prison,â sobbing that she would do anything to âtake it all back.â
Haya, the daughter of Jordanâs late King Hussein, had for years boosted the sheikhâs image in elite social circles by defying the expectations of feminine royalty: The Oxford graduate had become the first woman in Jordan licensed to drive heavy trucks and, in 2000, the first Arab woman to jump horses in the Summer Olympics.
But their marriage was unraveling behind closed doors: They hadnât âenjoyed an intimate relationshipâ together for some time, the court filings say, and Haya had recently pursued a romance with one of her bodyguards.
Hayaâs involvement in Latifaâs case, including asking a former United Nations commissioner to check on her, had pushed their bond to a breaking point. The sheikh ordered her to stay out of it, she told the court.
Then she learned that her husbandâs agents were arranging for their 11-year-old daughter to marry the then-33-year-old crown prince of Saudi Arabia, Mohammed bin Salman. She found notes warning âyour daughter is oursâ and a pistol in her bed. One of the sheikhâs helicopter pilots landed outside her home with orders to fly her to a desert prison, according to the British court judgment; the sheikh, she said later, laughed it off as a mistake. The sheikh had also, she learned later, secretly divorced her on the 20th anniversary of her fatherâs death â" a date, she told the court, heâd chosen to maximize the insult.
One year after Latifaâs failed breakout, Haya staged her own. She flew with her daughter and 9-year-old son to London, where sheâd secured a post in the Jordanian Embassy on the belief its diplomatic immunity could keep her safe, she told the court.
But operatives had already begun attempting to trail her, the leaked data suggests. The phones of top officials at Quest, a British private-security firm that had advised the princess for years, had been added to the list: Martin Smith, the companyâs chief executive, and Ross Smith, its director of investigations and intelligence. So, too, had numbers for Hayaâs personal assistant, the executive assistant of her Dubai household, and John Gosden, a horse trainer who had worked with Hayaâs colts.
As the sheikhâs lawyers pushed the High Court to order his children returned to Dubai, the leaked records show that numbers were added for Haya; her half sister, Princess Aisha bint Hussein; a member of Hayaâs legal team advising her on the custody dispute; and Shimon Cohen, founder of a public relations firm that had worked with Hayaâs private-security firm. Haya, her legal team, the Quest officials, Cohen and Gosden declined to comment. Princess Aisha did not respond to requests for comment.
In a possible episode of internal paranoia, the data shows, someone also added to the list a number for Stuart Page, a private investigator who had long worked on the sheikhâs behalf. Page confirmed the number was his but declined to comment.
Around that time, the sheikh published a poem, âYou Lived, You Died,â that Haya read as a veiled threat: âI exposed you and your games. ⦠I have the evidence that convicts you of what you have done.â
But the custody battle had also exposed unanswered questions about the missing princesses. In a statement to the British court, the sheikh said that Latifa was safe after her ârescueâ and that Shamsa had been âstill a childâ when she fled at age 19. The sheikh and Shamsaâs mother had âjointly decided to organize a searchâ for her, he wrote, and âwhen she was found, I remember our feeling of overwhelming relief.â Both women, the sheikh told the court, declined to be interviewed.
Last year, shortly after former president Donald Trumpâs daughter Ivanka posed for photos with the sheikh during a Dubai womenâs-equality conference, the court ruled that the sheikh had orchestrated the intimidation campaign against Haya and the abductions of Shamsa and Latifa.
The judge, Andrew McFarlane, said virtually all of Hayaâs allegations were substantiated, save for the âhearsayâ regarding the Saudi crown prince. (Saudi authorities did not respond to requests for comment.) As for Latifa, McFarlane wrote, she had been âplainly desperate to extricate herself from her family and prepared to undertake a dangerous missionâ to do so.
For the princessesâ supporters, the judgment was only a symbolic victory. Though Haya and her children remain in London, the custody battle is ongoing, and the ruling changed little about Shamsa and Latifaâs precarious state in Dubai.
Latifaâs friends earlier this year gave the BBC several videos that she had secretly recorded on a contraband phone, in which she said she was being held âhostageâ in a villa by guards who had told her she âwould never see the sun again.â âEvery day I am worried about my safety and my life,â she said. Her videos and messages stopped abruptly last year. In April, two months after the BBC report, U.N. officials demanded that the UAE provide evidence that she was alive and well.
Then suddenly in May, after months of silence, Latifa reappeared. In three photos posted to Instagram over a four-day span, Latifa was spotted having a âlovely eveningâ in a Dubai mall, eating âlovely foodâ near the Burj Khalifa and âenjoying dinnerâ with a Dubai friend.
Two of the photos had been posted by Sioned Taylor, and one also showed Lynda Bouchikhi. Numbers for both women had been added to the list before the raid on the Nostromo, the data shows. Latifa posted no photos of her own. Taylor declined to comment.
The law firm Taylor Wessing, which says it represents Latifa, also began sending letters demanding that Latifaâs friends and members of the advocacy campaign Free Latifa stop talking about her in the media, saying their comments had caused the princess distress.
In a statement attributed to Latifa, the firm reported that she said she can âtravel where I want,â adding, âI hope now that I can live my life in peace.â
A lawyer at the firm said Latifa had declined a request from The Post to be interviewed by phone or video, either on or off the record. The lawyer said Latifa had read a Post reporterâs questions but did not want to talk about her past and sought only to move on with a quiet life. The lawyer declined to provide any details of their legal retainer, citing client confidentiality.
Last month, Taylor posted a photo from an airport terminal. Latifa held what appeared to be boarding documents. Taylor gripped an iPhone.
âGreat European holiday with Latifa,â said the caption, with a smiley face. âWeâre having fun exploring!â
No other photos of Latifa have emerged since.
correctionA previous photo showed Princess Latifaâs cousin, who is also named Latifa, in a show jumping championship.
The Pegasus Project is a collaborative investigation that involves more than 80 journalists from 17 news organizations coordinated by Forbidden Stories with the technical support of Amnesty Internationalâs Security Lab. Read more about this project.
.hl_yellow{ font-family: 'Franklin'; background-color: transparent !important; }
0 Response to "A princess raced to escape Dubais powerful ruler Then her phone appeared on the list"
Post a Comment