Princess Haya: Dubai ruler had ex-wife’s phone hacked – UK court

The High Court has found that the ruler of Dubai, Sheikh Mohammed Al Maktoum, interfered with British justice by ordering the hacking of the phone of his ex-wife, Princess Haya of Jordan.

The phones of her solicitors, Baroness Fiona Shackleton QC and Nick Manners, were also targeted during their divorce custody case, according to the court.

Princess Haya said the discovery had made her feel “hunted and haunted”.

Sheikh Mohammed has denied any knowledge of the hacking.

The High Court’s judgments are a blow to the sheikh and a further revelation as to his treatment of female members of his family.

‘Serial breaches’

The judgments, which were published on Wednesday afternoon, referred to the hacking as “serial breaches of (UK) domestic criminal law”, “in violation of fundamental common law and ECHR rights”, “interference with the process of this court and the mother’s access to justice” and “abuse of power” by a head of government.

The president of the Family Division of the High Court found that “the mobile phones of the mother (Princess Haya), two of her solicitors, her personal assistant and two members of her security staff had been the subject of either successful or attempted infiltration by surveillance software. The software used is called Pegasus software and was that of an Israeli company, the NSO Group.”

The court concluded that the surveillance was carried out “by servants or agents of the father (Sheikh Mohammed), the Emirate of Dubai or the [United Arab Emirates] and that the surveillance occurred with the express or implied authority of the father”.

Difficult to detect

The extent of the hack is shocking in what data it gave the hackers access to.

NSO’s Pegasus software, often referred to as “spyware”, is able to track the location of the individual using the phone, read their SMS messages, emails and messages in other apps, as well as eavesdrop on their phone calls and access their contact list, passwords, calendar dates and photographs. In other words, it gives the hacker complete access to all the data they want to see in their target’s phone.

It also allows the hacker to activate the target’s phone without their knowledge, recording their activity and even taking photographs and screenshots.

Similar spyware is alleged to have been deployed by Saudi government agents, working on the orders of the Crown Prince Mohammed Bin Salman, against dissidents living abroad, including associates of the murdered Saudi journalist Jamal Khashoggi.

It is extremely difficult for a victim of such spyware to even detect that their phone has been infected with Pegasus.

‘Very substantial amount of data’

In the ongoing custody case between Sheikh Mohammed and Princess Haya at the Family Division of the High Court, her legal team said the hacking took place with his “express or implied authority”.

The president of the court concluded that “in relation to the mother (Princess Haya), it is clear that the [hacking] attempt succeeded with a very substantial amount of data (265MB) being covertly extracted from her phone”.

Sheikh Mohammed denied any knowledge of the hacking and said he did not instruct anyone to use NSO “or any software in this way”. His legal team said he was not prepared to enter into any debate in relation to what security systems the UAE might have.

• Dubai princesses’ phone numbers ‘on Pegasus list’
• Are we all becoming unknowing spies?
• Pegasus spyware seller: Blame our customers, not us

The allegations against Dubai’s ruler were supported by testimony given by an expert technology witness, Dr William Marczak, who is based in California and is a senior research fellow at the University of Toronto’s Citizen Lab, which researches digital surveillance.

He told the court he had no doubt the phones were hacked using NSO’s Pegasus software. He also concluded “with high confidence” that the phones were hacked by a single operator in a nation state. He concluded with medium confidence that it was most unlikely to be any state other than the UAE.

Alarm raised by Cherie Blair

Princess Haya’s legal team first became aware that they had been hacked after an urgent phone call made by Cherie Blair QC, the wife of former UK Prime Minister Tony Blair, to Baroness Shackleton. Mrs Blair acts as an adviser to NSO Group on business and human rights related issues.

A senior member of NSO’s management team called Mrs Blair from Israel on 5 August 2020 to inform her that “it had come to their attention that their software may have been misused to monitor the mobile phones of Baroness Shackleton and HRH Princess Haya”.

IMAGE SOURCE,REUTERS

Image caption,Two of Princess Haya’s solicitors, including Baroness Fiona Shackleton, were also targeted

The NSO staff member then told Mrs Blair that those phones could no longer be accessed using NSO software and they asked for her help in contacting Baroness Shackleton.

NSO, which has previously been accused by human rights groups of enabling autocratic states to carry out intrusive surveillance of dissidents and journalists, has insisted in public statements that it only supplied its spyware to enable governments to counter criminals and terrorists.

NSO is believed to have terminated its contract with the UAE.

‘Living in fear of her life’

The hack took place during a critical phase in Sheikh Mohammed and Princess Haya’s divorce custody case at the High Court in the summer of last year.

The guardian appointed for her children said it “impacts crucially on the mother and her wellbeing. It is a very pernicious experience if the mother has been subjected to surveillance of the type that she understands that she has been”.

Princess Haya’s legal team told the court that “the mother has been living in fear of her life frankly, and in fear of the children’s security since April of [2019]”.

The court also heard how Sheikh Mohammed had attempted to buy a property in Surrey, Parkwood Estate, so close to his ex-wife’s home at Castlewood, that “if anyone chose to use it, it is in prime position for direct or electronic surveillance”.

Her legal team said “there is a powerful objective case as to why the mother should be genuinely in fear if the father has access to a property overbearing her own”.

Referring to the proposed property purchase, Princess Haya told the court: “It feels as if I am being stalked, that there is literally nowhere for me to go to be safe from (the father), or those acting in his interests. It is hugely oppressive.”

Daughters ‘forcibly returned’

Sheikh Mohammed, a close ally of Britain’s and a billionaire racehorse owner, was found by the High Court in March 2020 to have threatened and intimidated Princess Haya.

The court also found proven allegations that he kidnapped and forcibly returned to Dubai two of his own daughters, Sheikha Latifa and Sheikha Shamsa.

This February, BBC Panorama obtained secretly filmed footage of Sheikha Latifa saying she was imprisoned by her father in a villa converted into a jail.

She recounted how she had attempted to escape her family by boat in 2018 but was recaptured by armed men off the coast of India, tranquilised and forcibly returned to Dubai.

The UN later demanded to see proof she was alive and well.

Photographs have since been posted on social media showing her accompanied by female friends in a Dubai mall, and holidaying in Madrid and Iceland.

Human rights campaigners remain suspicious that she is still not at liberty or able to speak freely.

A law firm saying it is acting on her behalf has asked the media to leave her alone.

During the recent hearings in the High Court, Princess Haya’s legal team said that previous abductions were made possible by hacking, which “enabled the identification of the whereabouts of Princess Latifa and she was then rendered back to Dubai”.

Hacked during ‘significant events’

Princess Haya, a daughter of the late King Hussein of Jordan and half-sister of King Abdullah II, fled Dubai in 2019 for Britain along with her two children after learning that her husband had ordered the abduction of Sheikha Latifa and Sheikha Shamsa.

She has since said she is living in fear of her life after receiving threatening messages from agents of her former husband.

Now her legal team is accusing agents of the Emirate of Dubai of acting on his behalf in hacking the phones of Princess Haya, her solicitors, Baroness Shackleton and Nick Manners, as well as her personal assistant and two members of her security staff.

The hacking took place in July and August 2020 “at a time of significant events” in the court proceedings when hearings were taking place over the welfare of the children.

The judgment concluded that “the allegations of hacking came before the court at a time when it had already made very serious findings against the father”.

‘Terrible life or death game’

During the long-running custody case at the High Court, Sheikh Mohammed has tried on several occasions through appeals to keep details of the allegations against him out of the public eye. But both in March 2020 and now, in October 2021, they have been made public, although he did not seek to appeal the most recent order permitting publication of these judgments.

Wednesday’s ruling that, despite his denials, a sovereign ruler has interfered in the course of British justice by ordering the hacking of UK phones, including of a member of the House of Lords is both shocking, embarrassing and damaging to Sheikh Mohammed’s international reputation.

Summing up the hacking allegations made by Princess Haya, her barrister Nicholas Cusworth QC told the court: “It is now clear, essentially, that the mother is engaged in a terrible game, a terrible life or death game of grandmother’s footsteps in the dark. While she seeks answers about property purchases, hackers apparently get to work interfering with her privileged communications.”

Embarrassing as this is for Sheikh Mohammed, there is little or no prospect of his ever having to face any police questioning.

As Dubai’s sovereign ruler, he remains a huge figure in the equestrian world, he owns extensive properties in the UK and has been photographed with the Queen at race meetings such as Ascot. The emirate of Dubai is home to around 100,000 British expatriates and both he and the wider UAE government are considered close allies of the UK.

The story is unlikely to get much coverage in the government-monitored media in the UAE, and here in London the UAE Embassy has declined to comment on the case, saying it is a private family matter.

The sheikh himself has sovereign immunity from any future potential prosecution.

……………………………………………………

Ethiopian Airlines was used to transport weapons during war in Tigray

Cargo documents and manifests seen by CNN, as well as eyewitness accounts and photographic evidence, confirm that arms were transported between Addis Ababa’s international airport and airports in the Eritrean cities of Asmara and Massawa on board multiple Ethiopian Airlines planes in November 2020 during the first few weeks of the Tigray conflict.

It’s the first time this weapons trade between the former foes has been documented during the war. Experts said the flights would constitute a violation of international aviation law, which forbids the smuggling of arms for military use on civil aircraft.

Atrocities committed during the conflict also appear to violate the terms of a trade program that provides lucrative access to the United States market and which Ethiopian Airlines has benefited greatly from.

Ethiopian Airlines is a state-owned economic powerhouse that generates billions of dollars a year carrying passengers to hubs across the African continent and all over the world, and it is also a member of the Star Alliance, a group of some of the world’s top aviation companies.

The airline previously issued two denials about transporting weapons.

Responding to CNN’s latest investigation, Ethiopian Airlines said it “strictly complies with all National, regional and International aviation related regulations” and that “to the best of its knowledge and its records, it has not transported any war armament in any of its routes by any of its Aircraft.”

The governments of Ethiopia and Eritrea did not respond to CNN’s requests for comment.

Military refills

Long-simmering tensions between Ethiopia’s government and the ruling party in the Tigray region exploded on November 4, when Ethiopia accused the Tigray People’s Liberation Front of attacking a federal army base.

Abiy Ahmed, Ethiopia’s Nobel Peace Prize-winning prime minister, ordered a military offensive to oust the TPLF from power. Government forces and regional militias poured into Tigray, joined on the front lines by troops from Eritrea.

Thousands of people are estimated to have died in the conflict, which by many accounts bears the hallmarks of genocide and ethnic cleansing. While all sides have been accused of committing grave human rights abuses during Tigray’s war, previous CNN investigations established that Eritrean soldiers have been behind some of the worst atrocities, including sexual violence and mass killings. Eritrea has denied wrongdoing by its soldiers and only admitted to having troops in Tigray this spring.

Documents obtained by CNN indicate that flights carrying weapons between Ethiopia and Eritrea began at least as early as a few days after the outset of the Tigray conflict.

Air waybill showing transportation of ‘RIFFLE & DFS’ — in reference to rifles and dry foodstuffs per airline sources — on an Ethiopian Airlines flight on November 12.

On at least six occasions — from November 9 to November 28 — Ethiopian Airlines billed Ethiopia’s ministry of defense tens of thousands of dollars for military items including guns and ammunition to be shipped to Eritrea, records seen by CNN show.

The documents, known as air waybills, detail the contents of each shipment. In one document, the “nature and quantity of goods” is listed as “Military refill” and “Dry food stuff.” Other entries included the description “Consolidated.” The records also had abbreviations and spelling mistakes such as “AM” for ammunition and “RIFFLES” for rifles, according to airline employees. They told CNN the spelling errors were introduced when the contents were manually entered by employees into the cargo database.

Ethiopian Airlines cargo manifest for the same flight carrying rifles on November 12.

Benno Baksteen, chairman of DEGAS, the Dutch Expert Group Aviation Safety, told CNN that these waybills were required for all commercial flights as the crew on board need to know the contents of the cargo to ensure they are transported safely.

On November 9, five days after Abiy ordered a military offensive in Tigray, records show an Ethiopian Airlines flight transported guns and ammunitions from Addis Ababa to Asmara, Eritrea’s capital.

An air waybill and a cargo manifest from that date show that Ethiopian Airlines charged Ethiopia $166,398.32 for about 2,643 pieces of “DFS & RIFFLE WITH AM (sic)” on that flight. DFS is a reference to “dry food stuff,” according to airline sources.

Air waybill showing ‘military refill’ being transported on an Ethiopian Airlines flight on November 13.

Another air waybill from a few days later, November 13, has the same shipper and consignee. The content of that shipment was “military refill and dry food stuff,” according to the document. The shipments came at a time of increased military activity; security sources in the region told CNN the Eritreans needed re-supply for the fight in Tigray.

As planes went back and forth between the two countries, massacres of Tigrayans in the city of Axum and the village of Dengelat by Eritrean troops took place on November 19 and November 30 respectively.

Cargo documents show that the series of flights between Ethiopia and Eritrea continued until at least November 28, 2020.

Some current and former Ethiopian Airlines employees, who spoke on condition of anonymity for fear of repercussions, said the flights continued past this date but that the majority of arms trips to Eritrea were in November.

Both cargo and passenger planes were used in the operation, though CNN has no evidence that commercial passengers were on any of the flights carrying weapons. Many of these flights do not appear on popular online flight tracking platforms such as Flightradar24. When they do, the destination in Eritrea is often not visible and the flight path vanishes once the plane crosses the border from Ethiopia.

The employees told CNN the staff could manually turn off the ADS-B signal on board to prevent the flights being publicly tracked.

The flights were often assigned the same flight numbers, primarily ET3312, ET3313 and ET3314, with ‘ET’ being the code for Ethiopian Airlines. All the planes mentioned in the cargo files seen by CNN are American-made Boeing aircraft. The airline has been in a long relationship with the US aviation giant.

A Boeing representative declined to comment.

Ethiopian Airlines workers described witnessing other airline employees loading and unloading arms and military vehicles on flights directed to Asmara. A few even claimed they helped load the weapons on the planes themselves. All spoke of being ethnically profiled for being Tigrayan.

CNN has seen the Ethiopian Airlines’ ID cards of these employees and confirmed their identities.

One former employee told CNN they were instructed at Addis Ababa’s Bole International Airport to load guns and four military vehicles onto an Ethiopian Airlines cargo plane that was due to fly to Belgium but was sent instead to Eritrea.

“The cars were Toyota pickups which have a stand for snipers,” the employee said. “I got a call from the managing director late at night informing me to handle the cargo. Soldiers came at 5 a.m. to start loading two big trucks loaded with weapons and the pickups.”

“I had to stop a flight to Brussels, a 777 cargo plane, which was loaded with flowers, then we unloaded half of the perishable goods to make space for the armaments.”

The former employee warned soldiers that the vehicles were carrying far more gas than was allowed under international air transport rules, but said they were overruled after a direct call from an army commander.

“He [the commander] said we are going to war and we need the fuel to be loaded,” the employee said. “Then I referred the issue to my manager and my manager took responsibility and allowed them to load it.”

The flight, loaded with both weapons and flowers, traveled to Eritrea, then returned to Addis before flying on to Brussels the following day, the employee said. CNN cross-referenced this testimony with Flightradar24 and found the record of an Ethiopian Airlines aircraft returning from the direction of Eritrea and flying to Brussels the next day, but could not independently verify it was the same flight referred to by the employee.

Days later, the employee said they were temporarily suspended from work. They believe they were suspended for being Tigrayan but also for the incident with the soldiers. The employee fled Ethiopia in March.

Ethiopian Airlines told CNN in its statement that no employees had been suspended or terminated due to their ethnic background.

New video of Ethiopia massacre shows soldiers passing phone around to document their executions of unarmed men

It appears to be not the only long-distance international flight with unplanned stops. A flight from Addis Ababa to Shanghai on November 9, 2020, took a long detour via Eritrea according to the ADS-B signal that tracks the route on Flightradar24.

Several employees at the Addis Ababa airport said they saw multiple weapons flights leave for Eritrea each day at the outset of the conflict. They also spoke about flights carrying weapons from Eritrea back to Ethiopia. It’s unclear why armaments were being transferred back to Ethiopia.

One said they saw tanks and heavy artillery loaded onto planes coming to Addis Ababa, while small arms — mortars, launchers — were dispatched to Asmara. Employees told CNN they believed the smaller weaponry were being sent to Asmara to arm Eritrean troops.

All the employees said they were instructed by the airline to delete photos of the weapons from their phones. Not all of them did.

In June, photos circulated on social media platforms showing crates containing mortars on board an Ethiopian Airlines flight and the same crates being loaded on the plane in Massawa, Eritrea.

The company released a statement strongly denying the allegation that its planes were transporting weapons and claimed the photos were photoshopped.

However, CNN has corroborated the photos using visual analysis techniques, interviews and documentary evidence, dating them to a 777 Freighter cargo flight that flew from Ethiopia to Eritrea and back between November 8 and 9.

The images show a variety of mortars stacked up in the crates. Dan Kaszeta, a London based defense specialist and an associate fellow at the Royal United Services Institute, identified the mortars as 832-DU 82mm mortar rounds, originally made in Russia but with many versions subsequently manufactured, including in Bulgaria.

CNN has contacted the Bulgarian government and reached out to Bulgarian arms producers but received no response. According to the EU’s public database, Bulgaria sold weapons to Ethiopia as recently as 2020.

Another image features an employee wearing a uniform that matches with the Ethiopian Airlines uniform. The interior of the plane also fits the layout of an Ethiopian Airlines 777F cargo plane. The expiry date of the Emirates SkyCargo straps tightened around the crates — November 2023 — can be seen in the photos. Since these particular types of cargo straps — TSO C172 — have a lifespan of three years, they would have been used in November 2020 at the earliest. CNN has confirmed that these Emirates SkyCargo straps have been used on other Ethiopian Airlines flights. Emirates SkyCargo told CNN that its “straps may be inadvertently mixed with those of other airlines by ground handlers, who are third-party contractors, and may be used to secure cargo transported on other aircraft.”

A representative for TSO C172 cargo straps manufacturer AmSafe Bridport declined to comment.

CNN has learned that the cargo plane in question took off on November 8 from Addis Ababa empty before landing in Massawa, where local workers were tasked with manually loading it with a variety of weapons, including these mortars.

People are seen loading crates of weapons onto an Ethiopian Airlines plane at an airport in Massawa, Eritrea. Some faces have been blurred by CNN to preserve anonymity.

A cargo manifest from that day, seen by CNN, confirms the flight was empty when it reached Massawa.

A screenshot from the Ethiopian Airlines internal database taken by an employee and sent to CNN reveals a flight on November 8 to Massawa that is hidden from flight tracking sites. The weapons were then dropped in Bahir Dar, Ethiopia, before the aircraft returned to Addis Ababa on November 9.

‘A lot of legal repercussions’

Several aviation experts CNN spoke to on these findings said Ethiopian Airlines appeared to be in violation of the Convention on International Civil Aviation, commonly known as the Chicago Convention, which prohibits commercial carriers from transporting “munitions of war or implements of war.”

Pablo Mendes de Leon, professor of air and space law at The Hague, told CNN there are several indications that these flights were commercial flights — not military or state aircraft — including “that [the flights] carry a commercial flight number of Ethiopian Airlines in conjunction with the fact that an airway bill has been issued.”

“I have now arrived at the conclusion that [these flights have] been operated by civil aircraft falling under the terms of the Chicago Convention,” Mendes de Leon said, adding that CNN’s findings “have a lot of legal repercussions and conditions, all of which may not have been met.”

Ethiopia’s status as a regional economic powerhouse is partly dependent on Ethiopian Airlines’ dominance in cargo. The country and the airline have benefited from an American trade program that provides favorable access to the US market for countries that meet certain criteria.

   

This relationship matters for both countries: in 2017, US exports to Ethiopia consisted primarily of aircraft and aircraft components from Boeing, valued at more than $857 million.

But a clause in the US African Growth and Opportunity Act (AGOA) stipulates that eligible nations must not engage in “gross violations of internationally recognized human rights.”

Previous CNN investigations found atrocities committed by the Ethiopian government and its allies bore the hallmarks of genocide and ethnic cleansing.

In late August, US Trade Representative Katherine Tai warned Ethiopia’s chief trade negotiator that “the ongoing violations of internationally recognized human rights” in Tigray “could affect Ethiopia’s future [AGOA] eligibility if unaddressed.”

On Tuesday, a spokesperson told CNN that Tai’s office would conduct its next review of eligibility for AGOA in 2022, “based upon compliance with standards that include adherence to internationally recognized workers’ rights, rule of law, and human rights.” After the review, Tai could “possibly recommend that the President add or remove certain countries from AGOA beneficiary country status.”

…………………………………………………