yeah, we often overestimate the general OPSEC awareness and measures these guys take. I mean doing this in a foreign embassy, in Turkey of all places, in the foyer? When I worked overseas our security people told us to assume everything is bugged ... they swept the SCIF everyday, and before any meeting where sensitive information is discussed. Basically, anything not in the SCIF is capable of being monitored/hacked by intelligence services.

... or it could be simple arrogance. The certainty that there would be no comebacks or consequences ...

after reading https://motherboard.vice.com/en_us/article/kzjmze/saud-al-qa... I think they are screwed, too much money and no in house INFOSEC.

Whoever they hire, is likely to be in touch with foreign secret services before they do the job. The fact that they have a common fixer posting on forums to buy zero days is very amateurish and shows their sorry state. USA, Russia, China, UK etc all have homegrown expert with security clearances doing that stuff.

Maybe MBS is too dumb to use open source apps like Signal, who knows?