Should be pretty easy if US was involved in setting up the Saudi government's infosec

It’s pay walled, but the text I can see gives no indication that the cia could read the text. Just that at least 11 messages were sent. Sounds like traffic analysis.

11 messages with a few hours before /after? makes sense, and let the Saudis think that we know the what the messages say. If he sent e message every 3 days normally and then sent 11 the day of the killing...

These are messages between MBS and the guy organizing the killing, not MBS messages generally which would be rather circumstantial.

https://github.com/iamadamdev/bypass-paywalls-firefox - for firefox https://github.com/iamadamdev/bypass-paywalls-chrome - for chrome

Why do you think that?

A head of state such as SA, known to buy latest tech and hacking tools, to use un-encrypted messages? I'm wondering if CIA has a way in encrypted chats and only uses that info in rare instances--and even then without confirming anything. But MBS knows what he used...

These guys are not exactly masters of tradecraft; look at the wet work team's ham-handed attempt to impersonate Khashoggi leaving the embassy. Or for that matter, pretty much any aspect of that whole operation. Smooth operators they are not.

Also, the KSA is basically a one-man dictatorship at this point. I'm gonna go out on a limb and say that the Saudi COMSEC guy is not giving MBS a stern talking-to every time he does impulsive 31-year-old dictator stuff like, for example, using unsecure messaging services to communicate with his goons while they're murdering a dissident overseas.

yeah, we often overestimate the general OPSEC awareness and measures these guys take. I mean doing this in a foreign embassy, in Turkey of all places, in the foyer? When I worked overseas our security people told us to assume everything is bugged ... they swept the SCIF everyday, and before any meeting where sensitive information is discussed. Basically, anything not in the SCIF is capable of being monitored/hacked by intelligence services.

... or it could be simple arrogance. The certainty that there would be no comebacks or consequences ...

after reading https://motherboard.vice.com/en_us/article/kzjmze/saud-al-qa... I think they are screwed, too much money and no in house INFOSEC.

Whoever they hire, is likely to be in touch with foreign secret services before they do the job. The fact that they have a common fixer posting on forums to buy zero days is very amateurish and shows their sorry state. USA, Russia, China, UK etc all have homegrown expert with security clearances doing that stuff.

Maybe MBS is too dumb to use open source apps like Signal, who knows?

Or, they murder people with such frequency and lack of consequence that, why bother encrypting? Why would anyone pay attention this time?

yeah sad, but true.

Hillary Clinton, the secretary of state for arguably the most technically advanced country in the world used a private server to send classified information.

Assumptions like these are dangerous.

Note - do not turn this into a "but her emails" discussion.

A non technical person who has access to droves of intelligence gleaned from spying may be unaware that they have nothing but a very superficial comprehension as to what is actually going on.

I would venture to say that a great number of leaders in the west, east, developed and developing countries could not describe how a computer works. Don’t bother asking them about encryption.

There was a bank in Russia that hired a dude better known under a moniker "Pchela" to enforce use of pgp, and infosec in general.

He devised a plan under which staff is trained, tested, and punished for incompliance.

Once the whole of banks ~1200 people staff got certified, they set a deadline for enforcement after which anybody caught will be fired on spot.

The day after the deadline they spotted ~60 people in the bank sending plaintext, or replying to an unsigned email. And among them, one director level employee.

They had to fire them all, including a directress who went on trying to suing them for years.

I wanted to say here that powerful and smart people are not immune at all to doing stupid things if they have no discipline.

This sounds interesting, but I can't seem to find the story. Any other information to help track it down?

That's an account I got first hand. The bank in question is Asia Pacific Bank. A small regional bank in Russian far east.

>known to buy latest tech and hacking tools, to use un-encrypted messages?

Google “nokia2mon”, the saudis are definitely not masters of tradecraft.

He was very active on a US based hacking forum for years, and everyone knew he worked for KSA.

If anyone's curious, it took me a minute to find: https://motherboard.vice.com/en_us/article/kzjmze/saud-al-qa...

Or they used any of a number of more traditional methods to surveil him. Hidden cameras, spies, etc

probably a rootkit on the device to catch the message before transit. Though I wonder if tools like TEMPEST work for mobile phone screens.

Putting a root kit on a head of state's phone would be a great way to have your penetration discovered, so it's probably not the route they took, and TEMPEST wouldn't work on phone screens as it was a 1980's technique targeting the RF emissions of CRT displays common then (and which were fundamentally different in nature from modern solid state displays).

It’s paywalled, so I can’t see what what kind of messages they were, e.g. sms, whatsapp etc. Even though it seems stupid for someone in his position to send ordinary texts, he may not know that. Think of trump using his own phone to tweet.

Given that the target was going to the embassy to get a marriage license, I believe that MBS deliberately wanted to spread fear by disappearing a journalist.

I think MBS very much expected to be found out, but likely assumed that it would not be such a public spectacle in US media with actual implementation details.

Trump played along with it as much as he could.