In the days before commandos dragged Princess Latifa from her getaway yacht in the Indian Ocean, her number was added to a list that included targets of a powerful spyware, a new investigation shows
Drew Harwell, The Washington Post
July 21, 2021
The princess had been careful, so she left her phone in the cafe’s bathroom. She’d seen what her father could do to women who tried to escape.
She hid in the trunk of a black Audi Q7, then jumped into a Jeep Wrangler as her getaway crew raced that morning from the glittering skyscrapers of Dubai to the rough waves of the Arabian Sea. They launched a dinghy from a beach in neighboring Oman, then, 16 miles out, switched to water scooters. By sunset they’d reached their idling yacht, the Nostromo, and began sailing toward the Sri Lankan coast.
Princess Latifa bint Mohammed al-Maktoum, the 32-year-old daughter of Dubai’s fearsome ruler, believed she was closer than ever to political asylum — and, for the first time, real freedom in the United States, members of her escape team said in interviews.
But there was one threat she hadn’t planned for: The spyware tool Pegasus, which her father’s government was known to have used to secretly hack and track people’s phones. Leaked data shows that by the time armed commandos stormed the yacht, eight days into her escape, operatives had entered the numbers of her closest friends and allies into a system that had also been used for selecting Pegasus surveillance targets.
“Shoot me here. Don’t take me back,” she’d screamed as soldiers dragged her off the boat, roughly 30 miles from the shore, according to a fact-finding judgment by the United Kingdom’s High Court of Justice. Then she disappeared.
Latifa’s failed 2018 escape from her father — Sheikh Mohammed bin Rashid al-Maktoum, the United Arab Emirates’ prime minister, vice president and minister of defense — sparked outrage and gave life to a troubling mystery: How, given all her precautions, had the princess been found?
An investigation by The Washington Post and an international consortium of news organizations may offer critical new insight: Latifa’s number and those of her friends appear on a list that includes phones targeted for surveillance with Pegasus, the hacking tool from the Israeli spyware giant NSO Group, amid the sprint to track her down.
Read key takeaways from The Pegasus Project
Numbers for Latifa and her friends were added to the list in the hours and days after she went missing in February 2018, the investigation shows. The UAE was believed to have been an NSO client at the time, according to evidence discovered by the research group Citizen Lab.
It is unknown what role, if any, the phone-hacking software ultimately played in the princess’s capture. Their phones were not available for forensic examination, and the list does not identify who put the numbers on it or how many were targeted or compromised. In multiple statements, NSO has denied that the list was purely for surveillance purposes.
“It is not a list of targets or potential targets of NSO’s customers, and your repeated reliance on this list and association of the people on this list as potential surveillance targets is false and misleading,” NSO said in a letter Tuesday.
But when Amnesty International’s Security Lab examined data from 67 phones whose numbers were on the list to search for forensic evidence of Pegasus spyware, 37 phones showed traces, including 23 phones that had been successfully infected and 14 others that showed signs of attempted targeting.
The forensic analyses of the 37 smartphones also showed that many displayed a tight correlation between time stamps on the list and the beginning of surveillance — sometimes as little as a few seconds.
In the year after Latifa’s chase, operatives appear to have entered numbers onto the list for another Dubai princess: one of the sheikh’s six wives, Haya bint Hussein, who had voiced concerns about Latifa’s confinement before fleeing with her two young children to London.
Princess Haya, her half sister, her assistants, her horse trainer, and members of her legal and security teams all had their phones entered onto the list in early 2019, both in the days before and in the weeks after she, too, fled Dubai, the investigation shows. Around that time, Haya later told a British court, she’d faced threats of exile to a desert prison and twice discovered a gun in her bed.
An NSO attorney said the company “does not have insight into the specific intelligence activities of its customers” and that the list of numbers could have been used for “many legitimate and entirely proper” purposes “having nothing to do with surveillance.”
But a person familiar with the operations of NSO who spoke to The Post on the condition of anonymity to discuss internal operations says the company terminated its contract with Dubai within the last year after it learned of the princesses’ surveillance and other human-rights concerns.
NSO’s co-founder and chief executive, Shalev Hulio, on Sunday said he was disturbed by reports of journalists and others being hacked with his company’s software, and he promised investigations. He said the company had terminated two contracts in the past 12 months because of human rights concerns.
NSO said in a “Transparency and Responsibility Report” last month that the company had disconnected five clients from Pegasus since 2016 following investigations of misuse, including one unnamed client that a company probe last year revealed had used the system to “target a protected” individual.
Latifa’s hunters had many options for pursuit and interception, and some of the princess’s supporters have suggested that the Nostromo’s crew members made tactical errors, including sending online messages during the chase that could have given their location away.
But the records show that the phones were added to the list at critical moments in the search, underscoring how a surveillance tool that NSO says is deployed to “help governments protect innocents from terror and crime” can be abused. The Pegasus software allows operatives to track a hacked phone’s location, read its messages, and turn its cameras and microphones into live-streaming spy devices.
How Pegasus works
Target: Someone sends what’s known as a trap link to a smartphone that persuades the victim to tap and activate — or activates itself without any input, as in the most sophisticated “zero-click” hacks.
Infect: The spyware captures and copies the phone’s most basic functions, NSO marketing materials show, recording from the cameras and microphone and collecting location data, call logs and contacts.
Track: The implant secretly reports that information to an operative who can use it to map out sensitive details of the victim’s life.
Read more about why it’s hard to protect yourself from hacks.
Forbidden Stories, a Paris-based journalism nonprofit, oversaw the investigation, called the Pegasus Project, and the news organizations worked collaboratively to conduct further analysis and reporting. Journalists from the British newspaper the Guardian and the German newspaper Süddeutsche Zeitung contributed reporting for this article.
Officials with Dubai and the UAE, a close ally of the United States, did not respond to requests for comment but have previously declined, saying the episodes are family matters. The sheikh has argued that the assault on the Nostromo rescued his daughter from a high-ransom kidnapping, though Latifa had prerecorded a video explaining that she’d chosen to run because of years of oppression and abuse.
The sheikh’s personal attorneys in the U.K. and Germany sent letters this month denying his involvement in any attempted hacks. Officials with the sheikh’s Dubai Ruler’s Court have previously said in statements that they are “deeply saddened by the continued media speculation” and that Latifa is “safe and in the loving care of her family.”
Escape
From the outside, Latifa seemed to enjoy a life of unimaginable affluence. The Emirati princess lived in a palace compound in the Emirates’ biggest city and appeared free to enjoy wild extravagances, including riding champion racehorses and leaping out of planes.
Her father, one of the Persian Gulf’s most powerful autocrats, had presided over Dubai’s transformation into a capitalist playground for the ultrarich, famous for showpieces such as the world’s tallest tower, the Burj Khalifa, and palm-shaped islands visible from space.
When not commanding his empire, the sheikh had become a star in the world of thoroughbred horse racing, owning one of its most prestigious breeding operations, and spent heavily to portray himself as a progressive crusader for women’s rights and a family man to his 25 children, three of whom are named Latifa. He also wrote books, such as “Reflections on Happiness and Positivity,” and poetry, which he posted to his 5.7 million-follower Instagram account.
To Latifa, her father’s public persona was all a lie, she would say in the video. Her life had been rigorously scheduled and restricted. She could not drive or travel, and her every movement was tracked by her father’s office. Her siblings, she said, lived similar lives of mistreatment or neglect.
“There is no justice here. They don’t care. Especially if you’re a female, your life is so disposable,” she said. “All my father cares about is his reputation. He will kill people to protect it. … He’s even burned down houses to hide the evidence.”
In the summer of 2000, Latifa’s older sister Shamsa, then a mother figure to her, ran away from the sheikh’s stables during a family holiday in the U.K. For weeks, she lived as a fugitive, sleeping in a London hostel and staving off loneliness by calling friends back home, according to Latifa’s video and the High Court judgment released last year.
Soon after, Shamsa was abducted off the street in Cambridge, flown via helicopter to France and shuffled onto a private jet back to Dubai, the judgment found. Latifa said in the video that one of Shamsa’s friend’s phones had been bugged, allowing her father to learn where she was.
In a letter Shamsa sent to an immigration lawyer and cited by the British court, Shamsa said she’d been imprisoned and forcibly tranquilized. “They have all the money, they have all the power, they think they can do anything,” she wrote. She has not been seen since.
Two years after Shamsa went missing, a distraught Latifa, then 16, attempted her own vanishing act. She’d naively believed, she said in the video, that she could just cross the border to Oman to find help or, at worst, get locked up with Shamsa, who would at least then know “she has somebody with her.”
When the border guards caught her, Latifa said, she was returned to her father’s compound, confined alone in a windowless room and subjected to “constant torture.” “Your father told us to beat you until we kill you,” she recalled her captors telling her. “I didn’t know when one day ended and the next began.”
After three years and four months, she was freed. The High Court judge wrote later that she marveled then at the “strangeness of ordinary things”: car rides as fast as a “roller coaster,” the bliss of a bath. She appeared to live a quiet life, spending her days at the horse stables and training in the dance-fighting style of capoeira with Tiina Jauhiainen, a Finnish instructor who became her friend.
But Latifa never stopped dreaming of escape. By 2017, Jauhiainen said in interviews with a Guardian reporter in April, she and the princess had begun drawing up a daring plan, recruiting Christian Elombo, Jauhiainen’s friend and fellow trainer, and Herve Jaubert, a French businessman who’d fled Dubai after an embezzlement conviction and had moved to Florida, where he built submarines.
Latifa committed her entire life savings of more than $300,000 toward the plan, Jauhiainen said in interviews. And as a last resort, she recorded the 40-minute video in Jauhiainen’s apartment, scheduling it to post online if their bid collapsed.
“If you are watching this,” Latifa said, “either I’m dead or I’m in a very, very, very bad situation.”
Assault
By the time the leaked records show Latifa’s number was added to the list, she and Jauhiainen had already ditched their phones in the bathroom of La Serre, a Parisian cafe in downtown Dubai, and begun their doomed voyage across the Arabian Sea.
Someone then added numbers for Juan Mayer, an aerial photographer who often recorded Latifa’s skydives; Lynda Bouchikhi, an event manager who had served as Latifa’s officially sanctioned chaperone; and Sioned Taylor, another friend and chaperone whose LinkedIn profile says she worked then as a “personal assistant” for a “member of the Ruling Family.” Taylor, through an attorney, declined to comment. Mayer and Bouchikhi did not respond to requests for comment.
Aboard the Nostromo, a two-masted, U.S.-flagged sailing yacht chartered for luxury cruises around Southeast Asia, the escape team was growing anxious, Jauhiainen said. They’d planned to cross the Indian Ocean, disembark in Sri Lanka with prearranged visas and hop a flight to the United States. To pass the time, they watched bad movies and sent messages using a satellite Internet connection that Jaubert had pledged was secure.
But when they lost contact with Elombo — who unbeknown to them had, after piloting the dinghy back to shore, been arrested in Oman — the team abruptly steered toward a backup dock on India’s coast for fear they’d been compromised, Jauhiainen said. Soon, an Indian coast guard boat and low-flying plane began shadowing them.
Then one night, as they prepared for bed, the team heard heavy boots on the upper deck, Jauhiainen said. Their cabins suddenly filled with smoke. An Indian special forces unit — backed by helicopters, military boats and a squad of UAE soldiers — had blitzed the Nostromo, shouting Latifa’s name. Locking herself in a bathroom, the princess sent Radha Stirling, head of the London advocacy group Detained in Dubai, a distress call over WhatsApp: “Please help … there’s men outside.”
As the team watched, Jauhiainen said, the commandos tied Latifa’s hands behind her back and dragged her off the yacht, their guns’ laser sights shimmering through the darkness.
In the week afterward, Latifa’s supporters posted her “last video” online and filed missing-person reports with international law enforcement agencies, including the FBI. Jaubert, Jauhiainen and Elombo were questioned for days in Dubai and then released, with no idea where Latifa was being held. And all the while, the leaked data shows, operatives continued to add the princess’s allies to the list.
In the years since, the escape team has struggled to piece together what went wrong. Jauhiainen has questioned the yacht’s satellite uplink and, in a report this month, USA Today cited unnamed people knowledgeable about the operation who said the FBI had assisted with what they believed was a kidnapping investigation by pulling location data from the satellite Internet provider, Rhode Island-based KVH Industries. The FBI and KVH declined to comment.
But the yacht also carried two “burner” phones, according to Jauhiainen, which Jaubert has argued were bugged. Latifa had used them to send emails, seek help on Instagram and exchange messages through WhatsApp, the Facebook-owned messaging firm that sued NSO in 2019, alleging the company helped spy on its users.
She had also communicated, Jauhiainen said, with Taylor, whose phone, the leaked data show, had been added to the list before the assault.
‘Exposed’
Princess Haya had for months gone along with her husband’s assertion that Latifa was the mentally unstable victim of a criminal plot. But as Latifa’s video gained attention, she began to openly question the official line.
In late 2018, Haya arranged for a doctor and psychiatrist to see Latifa at her guarded villa. When they found nothing wrong, she visited Latifa herself. Latifa, Haya would tell the High Court, appeared pale and forlorn, caged in a bedroom “akin to a prison,” sobbing that she would do anything to “take it all back.”
Haya, the daughter of Jordan’s late King Hussein,had for years boosted the sheikh’s image in elite social circles by defying the expectations of feminine royalty: The Oxford graduate had become the first woman in Jordan licensed to drive heavy trucks and, in 2000, the first Arab woman to jump horses in the Summer Olympics.
But their marriage was unraveling behind closed doors: They hadn’t “enjoyed an intimate relationship” together for some time, the court filings say, and Haya had recently pursued a romance with one of her bodyguards.
Haya’s involvement in Latifa’s case, including asking a former United Nations commissioner to check on her, had pushed their bond to a breaking point. The sheikh ordered her to stay out of it, she told the court.
Then she learned that her husband’s agents were arranging for their 11-year-old daughter to marry the then-33-year-old crown prince of Saudi Arabia, Mohammed bin Salman. She found notes warning “your daughter is ours” and a pistol in her bed. One of the sheikh’s helicopter pilots landed outside her home with orders to fly her to a desert prison, according to the British court judgment; the sheikh, she said later, laughed it off as a mistake. The sheikh had also, she learned later, secretly divorced her on the 20th anniversary of her father’s death — a date, she told the court, he’d chosen to maximize the insult.
One year after Latifa’s failed breakout, Haya staged her own. She flew with her daughter and 9-year-old son to London, where she’d secured a post in the Jordanian Embassy on the belief its diplomatic immunity could keep her safe, she told the court.
But operatives had already begun attempting to trail her, the leaked data suggests. The phones of top officials at Quest, a British private-security firm that had advised the princess for years, had been added to the list: Martin Smith, the company’s chief executive, and Ross Smith, its director of investigations and intelligence. So, too, had numbers for Haya’s personal assistant, the executive assistant of her Dubai household, and John Gosden, a horse trainer who had worked with Haya’s colts.
As the sheikh’s lawyers pushed the High Court to order his children returned to Dubai, the leaked records show that numbers were added for Haya; her half sister, Princess Aisha bint Hussein;a member of Haya’s legal team advising her on the custody dispute; and Shimon Cohen, founder of a public relations firm that had worked with Haya’s private-security firm. Haya, her legal team, the Quest officials, Cohen and Gosden declined to comment. Princess Aisha did not respond to requests for comment.
In a possible episode of internal paranoia, the data shows, someone also added to the lista number for Stuart Page, a private investigator who had long worked on the sheikh’s behalf.Page confirmed the number was his but declined to comment.
Around that time, the sheikh published a poem, “You Lived, You Died,” that Haya read as a veiled threat: “I exposed you and your games. … I have the evidence that convicts you of what you have done.”
But the custody battle had also exposed unanswered questions about the missing princesses. In a statement to the British court, the sheikh said that Latifa was safe after her “rescue” and that Shamsa had been “still a child” when she fled at age 19. The sheikh and Shamsa’s mother had “jointly decided to organize a search” for her, he wrote, and “when she was found, I remember our feeling of overwhelming relief.” Both women, the sheikh told the court, declined to be interviewed.
Last year, shortly after former president Donald Trump’s daughter Ivanka posed for photos with the sheikh during a Dubai women’s-equality conference, the court ruled that the sheikh had orchestrated the intimidation campaign against Haya and the abductions of Shamsa and Latifa.
The judge, Andrew McFarlane, said virtually all of Haya’s allegations were substantiated, save for the “hearsay” regarding the Saudi crown prince. (Saudi authorities did not respond to requests for comment.) As for Latifa, McFarlane wrote, she had been “plainly desperate to extricate herself from her family and prepared to undertake a dangerous mission” to do so.
For the princesses’ supporters, the judgment was only a symbolic victory. Though Haya and her children remain in London, the custody battle is ongoing, and the ruling changed little about Shamsa and Latifa’s precarious state in Dubai.
Latifa’s friends earlier this year gave the BBC several videos that she had secretly recorded on a contraband phone, in which she said she was being held “hostage” in a villa by guards who had told her she “would never see the sun again.” “Every day I am worried about my safety and my life,” she said. Her videos and messages stopped abruptly last year. In April, two months after the BBC report, U.N. officials demanded that the UAE provide evidence that she was alive and well.
Then suddenly in May, after months of silence, Latifa reappeared. In three photos posted to Instagram over a four-day span, Latifa was spotted having a “lovely evening” in a Dubai mall, eating “lovely food” near the Burj Khalifa and “enjoying dinner” with a Dubai friend.
Two of the photos had been posted by Sioned Taylor, and one also showed Lynda Bouchikhi. Numbers for both women had been added to the list before the raid on the Nostromo, the data shows. Latifa posted no photos of her own. Taylor declined to comment.
The law firm Taylor Wessing, which says it represents Latifa, also began sending letters demanding that Latifa’s friends and members of the advocacy campaign Free Latifa stop talking about her in the media, saying their comments had caused the princess distress.
In a statement attributed to Latifa, the firm reported that she said she can “travel where I want,” adding, “I hope now that I can live my life in peace.”
A lawyer at the firm said Latifa had declined a request from The Post to be interviewed by phone or video, either on or off the record. The lawyer said Latifa had read a Post reporter’s questions but did not want to talk about her past and sought only to move on with a quiet life. The lawyer declined to provide any details of their legal retainer, citing client confidentiality.
Last month, Taylor posted a photo from an airport terminal. Latifa held what appeared to be boarding documents. Taylor gripped an iPhone.
“Great European holiday with Latifa,” said the caption, with a smiley face. “We’re having fun exploring!”
No other photos of Latifa have emerged since.
The Pegasus Project is a collaborative investigation that involves more than 80 journalists from 17 news organizations coordinated by Forbidden Stories with the technical support of Amnesty International’s Security Lab. Read more about this project.