The reported mastermind who oversaw the murder and dismemberment of Saudi Arabian journalist Jamal Khashoggi is Saud al-Qahtani, a high-level adviser to the crown prince of Saudi Arabia, Mohammed bin Salman (MBS). Before Khashoggi’s murder put al-Qahtani in the spotlight in the Western press, he was best known for being MBS’s chief propagandist and enforcer and for running social media and surveillance operations out of the royal court. Al-Qahtani’s efforts to suppress dissent and harass critics of the kingdom online earned him several sobriquets, including “Minister of Disinformation” and “Lord of the Flies” -- “electronic flies” being the term his targets use to describe his bots and trolls.

In October 2018, Motherboard reported that someone purporting to be al-Qahtani had attempted to buy surveillance tools from controversial Italian spyware vendor Hacking Team and may have moonlighted as a member of the cybercrime website Hack Forums. Using the email addresses in Motherboard’s report as a starting point, this investigation leveraged a wide variety of tools and techniques to build out an extensive footprint of al-Qahtani’s online activities. Among this investigation’s findings were several fake social media profiles linked to al-Qahtani as well as a previously unreported network of web infrastructure that he registered, some of which was used for malicious purposes. This case study underscores the extent to which even top officials responsible for a state’s most sensitive cyber efforts can be remarkably unsophisticated in concealing their online activities and demonstrate poor operational security and tradecraft.