Saud Al-Qahtani: From Legal Officer to the Center of Media, Cyber Operations and State Power
An Investigation into Surveillance, Foreign Influence, Transnational Repression, Jamal Khashoggi, and What Remained After 2018
THE DEEP FILES
Investigations • Documents • Evidence
Scope of Investigation: From Saud Al-Qahtani’s birth in 1978 through September 26, 2026.
Methodological Note: This investigation distinguishes between four categories of information: facts established by official documents or judicial records; formal assessments by governments or intelligence agencies; allegations contained in lawsuits, witness accounts, human-rights reports, and investigative reporting; and questions for which no satisfactory public answer has yet been identified.
The appearance of a person’s name in a lawsuit, report, or allegation does not establish that the allegation is true. Conversely, the absence of a criminal conviction does not erase independently documented facts, official sanctions, or government assessments.
The unanswered questions presented throughout this investigation are also addressed to Saud Al-Qahtani, the Saudi Royal Court, relevant Saudi institutions, former officials and employees, contractors, witnesses, and Saudi citizens who may possess original documents or firsthand information capable of resolving them.
Chapter 1 — Who Is Saud Al-Qahtani?
Saud bin Abdullah Al-Qahtani was born in Riyadh on June 7, 1978.
According to his published Saudi biography, he attended schools in Riyadh and completed secondary education at the Capital Model Institute, ranking among the top ten students in the Riyadh region.
He subsequently received a bachelor’s degree in law from King Saud University before joining the Royal Saudi Air Force’s university officer qualification program. His official biography states that he graduated with distinction and honors.
Al-Qahtani subsequently served at King Faisal Air Academy. His Saudi biography states that he progressed through the military ranks until reaching the rank of major, managed personnel affairs and later officers’ affairs, and worked as a legal lecturer.
He also obtained a master’s degree in criminal justice from Naif Arab University for Security Sciences.
The decisive transformation in his career, however, was not military. It was his entry into the Crown Prince’s Court.
Between 2003 and 2005, Al-Qahtani managed the media department in the Crown Prince’s office. In 2005, he became deputy director-general of the Media Monitoring Center. In 2008, he became director-general of the Media Monitoring and Analysis Center. He ultimately became general supervisor of the Center for Studies and Media Affairs at the Saudi Royal Court.
In 2012, he was appointed an adviser at the Royal Court at the excellent grade. In December 2015, he became an adviser at the Royal Court with the rank of minister, a position he held until October 2018.
He was also associated with or held positions in institutions including the Saudi Federation for Cybersecurity, Programming and Drones, MiSK Foundation, the Royal Commission for AlUla, King Abdulaziz Foundation, and sports-related bodies.
This raises the central institutional question of this investigation:
How did a man whose career began in law, the Air Force and media monitoring reach a position later connected in official U.S. documents to a media center, cyber capabilities, dissident monitoring, a rapid-intervention force, and ultimately an operation resulting in a killing outside Saudi Arabia?
Chapter 2 — A Center That Appears To Have Become More Than A Media Office
The institution’s formal name matters: Center for Studies and Media Affairs at the Saudi Royal Court.
On its face, this sounds like a media and research organization. Yet the evidence and allegations that subsequently emerged raise significant questions about the breadth of activities conducted within or around this institutional structure.
One of the clearest pieces of evidence establishing Al-Qahtani’s authority is contractual.
On August 25, 2015, Al-Qahtani signed an agreement with the Podesta Group identifying himself as President of the Center for Studies and Media Affairs at the Royal Court.
The original Foreign Agents Registration Act filing contains his name, title and signature. This establishes that Al-Qahtani exercised direct contractual authority on behalf of the Center.
Chapter 3 — Millions Of Dollars And Washington Influence
The Center established relationships with a substantial network of American lobbying, public-relations and legal firms. They included Podesta Group, BGR Government Affairs, Squire Patton Boggs, and SGR LLC.
U.S. Department of Justice FARA records document these relationships.
Financial records reviewed during this investigation indicate approximately $2.25 million in payments to the Podesta Group during roughly twelve months in 2016-2017. SGR reported approximately $625,000 during one six-month reporting period. Squire Patton Boggs operated under an arrangement reported at approximately $100,000 per month plus expenses. BGR’s publicly reported agreement was approximately $500,000 annually.
These payments do not, by themselves, establish corruption. Properly registered lobbying and public-relations activity is lawful in the United States.
What they establish is something different: the Center controlled by Al-Qahtani had substantial financial resources available for international political, legal and communications engagement.
That raises questions that remain unanswered:
What was the Center’s total annual budget?
Who authorized individual contracts?
Did Al-Qahtani possess final contracting authority?
How much was spent in the United States, Europe and elsewhere?
Were success fees or intermediary commissions paid?
Who evaluated whether these contracts represented value for Saudi public money?
Chapter 4 — Jasta And The Campaign In Washington
Part of this lobbying infrastructure operated during Saudi Arabia’s campaign concerning the Justice Against Sponsors of Terrorism Act, or JASTA.
FARA records reviewed during this investigation document contacts with congressional offices and elements of the executive branch.
Political-action-committee contributions also occurred around some periods in which lobbying contacts were taking place.
We have not established evidence proving that congressional votes were purchased or that members of Congress were bribed.
The investigative question is therefore more precise: Who contacted whom, on what dates, how much money was spent, what political contributions occurred around those dates, and what position did each contacted official ultimately take?
This can be reconstructed through FARA and Federal Election Commission records.
Chapter 5 — Hacking Team: Cyber Capabilities Years Before Khashoggi
One of the most important trails uncovered during this investigation comes from the leaked records of the Italian surveillance company Hacking Team.
Open-source investigators, including Bellingcat, reconstructed contact information associated with Saud Al-Qahtani and identified communications in 2012 and 2015 concerning surveillance technology.
The communications included Saudi interest in surveillance capabilities. By 2015, correspondence discussed establishing a long-term strategic relationship between the Saudi side and Hacking Team.
A critical distinction must nevertheless be preserved: requesting information or negotiating for surveillance technology is not the same thing as proving a completed purchase, payment and operational deployment.
The complete contracts, invoices and operational records have not been publicly established for every technology discussed.
Chapter 6 — Maher Mutreb Appears Years Before Istanbul
One name repeatedly emerges: Maher Abdulaziz Mutreb.
Reporting based on the Hacking Team material placed Mutreb within a Saudi training context involving the company as early as 2011.
Years later, Mutreb appeared again. This time the evidence came not from leaked corporate correspondence but from the United States Treasury.
In its November 2018 sanctions action, the Treasury described Mutreb as a subordinate of Saud Al-Qahtani in connection with the Khashoggi operation.
This produces an investigative chronology:
2011 — Mutreb appears in the Hacking Team environment.
2012 — Communications associated with Al-Qahtani and Hacking Team.
2015 — Al-Qahtani seeks a strategic relationship with the company.
2018 — Mutreb appears in Istanbul, and the U.S. Treasury describes him as Al-Qahtani’s subordinate.
This does not prove that Hacking Team technology was used in the Khashoggi operation.
It does raise an important question: What precisely was Maher Mutreb’s organizational role within the apparatus surrounding Saud Al-Qahtani?
Chapter 7 — Domains And Digital Infrastructure
Open-source research also associated Al-Qahtani with numerous internet domains and pieces of digital infrastructure.
Some infrastructure was subsequently associated with malicious tools or activities including Blackshades, Darkness, Optima and distributed-denial-of-service activity.
Domain registration, however, does not establish that the registrant personally conducted every malicious activity later associated with the infrastructure.
The necessary evidence would include historical WHOIS records, hosting records, payment records, IP logs, administrator accounts, and evidence identifying the actual operators.
Chapter 8 — The Blacklist
In August 2017, Al-Qahtani publicly promoted the hashtag #The_Blacklist.
He encouraged users to submit names of people they believed should be identified and monitored in the context of the Qatar crisis.
The underlying statement later appeared in an international arbitration record, preserving evidence of the communication even after Al-Qahtani’s Twitter account disappeared.
What remains unknown is considerably more important:
What happened to the names afterward?
Was this simply a Twitter campaign?
Was a database created?
Who reviewed the submissions?
Were names transmitted to security agencies?
Was anyone subsequently investigated, detained or otherwise targeted because of inclusion on the list?
Chapter 9 — Twitter: Accessing The Private Data Of Critics
Here the evidence moves from investigative reporting into a U.S. criminal prosecution.
Former Twitter employee Ahmad Abouammo was convicted in the United States in connection with acting on behalf of Saudi interests and improperly accessing private user information.
Evidence presented in the criminal proceedings included a luxury Hublot watch valued at approximately $42,000 and substantial payments.
U.S. prosecutors established that non-public Twitter information was accessed and supplied for Saudi interests. Such information could potentially reveal identifying information about users operating pseudonymous accounts.
Another former Twitter employee, Ali Alzabarah, was accused of accessing private information belonging to numerous users. After Twitter confronted him in December 2015, he left the United States for Saudi Arabia.
A third man, Ahmed Almutairi, also identified as Ahmed Aljbreen, was accused of serving as an intermediary between Saudi interests and the Twitter employees.
The criminal case establishes espionage activity inside Twitter for Saudi interests. It does not automatically establish that Saud Al-Qahtani personally commanded the operation.
Chapter 10 — Bader Al-Asaker And A Parallel Channel
The strongest criminal evidence surrounding Abouammo points directly toward Bader Al-Asaker.
U.S. court records describe interactions involving Al-Asaker, Abouammo, payments and information concerning accounts critical of the Saudi government or royal family.
The evidence therefore does not justify automatically drawing the chain Al-Qahtani to Al-Asaker to Abouammo.
The more accurate structure is presently an Al-Qahtani-centered network alongside an Al-Asaker to Abouammo and Twitter channel.
Connections between the two require independent evidence.
Chapter 11 — Abdulrahman Al-Sadhan
In 2023, Abdulrahman Al-Sadhan and his sister Areej brought litigation in the United States naming defendants including Saudi Arabia, Saud Al-Qahtani, Bader Al-Asaker, Ahmad Abouammo, Ali Alzabarah, Ahmed Almutairi or Aljbreen, Twitter or X, and the Saudi Arabian Cultural Mission.
The plaintiffs allege that Abdulrahman’s pseudonymous Twitter activity was exposed and that this contributed to Saudi authorities identifying and later detaining him.
The existence of the lawsuit does not establish the entire alleged causal chain.
The critical factual question is: Was Al-Sadhan’s account specifically among the accounts improperly accessed by Abouammo or Alzabarah, when was the information obtained, and to whom was it transmitted?
Chapter 12 — Omar Abdulaziz And Pegasus
Saudi dissident Omar Abdulaziz, living in Canada, became another important target.
Citizen Lab established that his phone was infected with Pegasus and linked the operator with high confidence to Saudi Arabia.
The timing is significant because Abdulaziz was communicating with Jamal Khashoggi and working with him on a project intended to counter pro-government activity online.
But one evidentiary boundary remains essential: evidence that a Saudi-linked operator compromised Abdulaziz’s telephone does not, by itself, prove that Saud Al-Qahtani personally ordered the operation.
That would require contracts, operational records, instructions, testimony or other independent evidence.
Chapter 13 — Ghada Oueiss
Journalist Ghada Oueiss brought U.S. litigation naming Al-Qahtani, Bader Al-Asaker, DarkMatter, MiSK and other entities and individuals in allegations concerning hacking, dissemination of private material and an online defamation campaign.
The litigation encountered jurisdictional and procedural obstacles.
A list of defendants in a lawsuit cannot therefore be treated as a proven criminal network.
Its investigative value lies elsewhere: Which individuals, companies and technical intermediaries recur across otherwise separate cases?
Chapter 14 — Detained Women’S Rights Activists
Beginning in May 2018, Saudi authorities arrested prominent women’s-rights activists.
Human Rights Watch reported receiving credible evidence that some detainees were subjected to electric shocks, whipping, sexual harassment or assault and other abuse at an unofficial detention location.
Other accounts alleged that Saud Al-Qahtani personally appeared during interrogation or abuse sessions.
Loujain Al-Hathloul’s family made particularly specific allegations concerning his presence and threats attributed to him.
These are serious allegations. They are not equivalent to a criminal conviction of Al-Qahtani.
Saudi authorities rejected allegations of torture, and Saudi proceedings later reported that investigations had not established them.
That leaves questions capable of documentary resolution:
Who administered the unofficial detention facility?
Who entered it?
Who were the interrogators?
Who were the physicians?
Do entry logs exist?
Do CCTV records exist?
Do telecommunications records place Al-Qahtani there?
Chapter 15 — The Ritz-Carlton
In November 2017, Saudi authorities detained princes, ministers, businessmen and former officials during the anti-corruption campaign centered on Riyadh’s Ritz-Carlton.
Saudi authorities later stated that settlements resulted in the recovery of more than SAR 400 billion through cash, property, securities and other assets.
Reporting and human-rights accounts subsequently described allegations of mistreatment of some detainees. Other reporting placed Al-Qahtani among officials involved in questioning certain detainees.
Yet no comprehensive public ledger identified detainee, interrogator, assets demanded, valuation, settlement, and ultimate recipient of assets.
No evidence identified during this investigation establishes that Al-Qahtani personally appropriated Ritz-Carlton assets.
But if he participated in interrogations, significant questions remain:
Did he discuss financial settlements?
Could he recommend acceptance or rejection of a settlement?
Who valued companies and properties?
Who signed the transfers?
Where did the recovered assets ultimately go?
Chapter 16 — Saad Hariri
November 2017 also produced the extraordinary episode involving Lebanese Prime Minister Saad Hariri.
Information subsequently recorded in the UN Special Rapporteur’s Khashoggi report implicated Al-Qahtani in allegations concerning the interrogation and intimidation of Hariri during the period in which Hariri announced his resignation from Riyadh.
Investigative reporting citing Arab and diplomatic sources also placed Al-Qahtani in the episode.
Saudi Arabia disputed the characterization that Hariri was forcibly detained.
The timing nevertheless creates a significant institutional question:
Hariri — November 2017.
Ritz-Carlton — November 2017.
Al-Qahtani appears in allegations concerning interrogation in both.
If those accounts are accurate, what legal authority permitted the head of a studies and media center to participate in political or security interrogations?
Chapter 17 — From Media To Operations?
This becomes one of the central unresolved questions.
The official career trajectory reads: media, media monitoring, media analysis, Center for Studies and Media Affairs.
Yet subsequent sources describe activities involving cybersecurity, dissident monitoring, special cyber operations, target acquisition, interrogations, and eventually the Rapid Intervention Force.
Was the media center merely one part of a broader apparatus?
Were operational units structurally separate?
Were security officers seconded into the Center?
The complete organizational chart of the Center between 2015 and October 2018 has never been publicly established in the material reviewed for this investigation.
Chapter 18 — Rapid Intervention Force
In February 2021, the U.S. Treasury sanctioned the Rapid Intervention Force, or RIF, also widely referred to as the Tiger Squad.
The Treasury stated that the RIF was owned or controlled by, or acted directly or indirectly for or on behalf of, Saud Al-Qahtani.
The U.S. intelligence assessment published the same month stated that seven members of the Istanbul team belonged to the RIF.
Even more importantly, the assessment stated that the unit had previously participated in operations to suppress dissidents inside Saudi Arabia and abroad.
That creates one of the largest unanswered questions in this entire investigation:
What were those earlier operations?
The published intelligence assessment does not identify them.
Chapter 19 — Sultan Bin Turki
Prince Sultan bin Turki II provides one of the most important pre-Khashoggi cases.
He boarded an aircraft in Europe believing that he was traveling to Cairo. The aircraft instead went to Riyadh.
Western witnesses traveling with him subsequently described what happened and said they recognized Saud Al-Qahtani after arriving in Saudi Arabia.
This is not an established killing.
It is a reported forcible return across borders with witness evidence placing Al-Qahtani in the aftermath.
Questions remain:
Who owned the aircraft?
Who chartered it?
Who filed the flight plan?
Who instructed the pilots to change destination?
Who met the aircraft?
Where is Sultan bin Turki today?
Chapter 20 — Turki Bin Bandar
Prince Turki bin Bandar, a former police officer who became publicly critical of Saudi authorities, was detained in Morocco and returned to Saudi Arabia in 2015.
His case has been documented in investigations into Saudi transnational repression.
No independent evidence identified in this investigation establishes Al-Qahtani’s personal participation.
The questions therefore concern the operation itself:
Who requested his return?
Under what legal process?
What documents were supplied to Morocco?
Where is the complete Saudi case file?
Chapter 21 — Saud Bin Saif Al-Nasr
Prince Saud bin Saif Al-Nasr became publicly critical of Saudi leadership and supported calls for political change.
Investigative reporting subsequently described him as disappearing after being drawn into travel connected to an alleged business opportunity.
No death certificate has been established.
No body has been produced.
No evidence identified here directly establishes Al-Qahtani’s participation.
The basic question therefore remains extraordinarily simple:
Where is Saud bin Saif Al-Nasr?
Chapter 22 — Saad Aljabri And The Alleged Canadian Assassination Attempt
Former Saudi intelligence official Saad Aljabri made one of the most serious allegations concerning the RIF.
He alleged that a Saudi team traveled to Canada in October 2018 intending to kill him.
His U.S. litigation alleged that Canadian border authorities intercepted members of the group and identified inconsistencies in their explanations and materials.
Aljabri’s allegations named Saud Al-Qahtani among figures allegedly connected to the operation.
A court has not issued a judgment establishing that Al-Qahtani ordered an attempt to murder Aljabri.
The allegation nevertheless contains factual elements capable of independent verification:
Canadian Border Services Agency records;
passport information;
visa applications;
airline records;
equipment;
photographs;
and the identities of everyone admitted or refused entry.
Those records could substantially confirm or undermine the allegation.
Chapter 23 — Saudi Transnational Repression Beyond Al-Qahtani
Freedom House has documented Saudi transnational repression extending across multiple countries and involving methods including forced return, physical assault, digital surveillance, detention, threats, and coercion through relatives remaining in Saudi Arabia.
This is an important distinction: not every Saudi transnational-repression operation can be attributed to Saud Al-Qahtani.
Each case requires its own evidentiary link.
Other cases examined during this investigation include Omar Abdulaziz in Canada, Yahya Assiri and Ghanem Al-Dosari in Britain, Abdullah Alaoudh and pressure involving relatives inside Saudi Arabia, and Palestinian activist Iyad El-Baghdadi in Norway.
The evidence connecting Al-Qahtani personally varies significantly or is absent in several of these cases.
Chapter 24 — Jamal Khashoggi
On October 2, 2018, journalist Jamal Khashoggi entered the Saudi consulate in Istanbul. He did not leave alive.
On November 15, 2018, the U.S. Treasury imposed sanctions on 17 individuals for their roles in the killing. Saud Al-Qahtani was among them.
The Treasury stated that Al-Qahtani was part of the planning and execution of the operation and that his subordinate, Maher Mutreb, coordinated and executed it.
This represents formal U.S. government attribution.
Chapter 25 — The U.S. Intelligence Assessment
In February 2021, the Office of the Director of National Intelligence published its assessment concerning the Saudi government’s role in Khashoggi’s killing.
It stated that the 15-member team included officials who worked for or were associated with the Center for Studies and Media Affairs led by Al-Qahtani.
Seven members belonged to the RIF.
The assessment also named Al-Qahtani among individuals whom U.S. intelligence assessed with high confidence as having participated in, ordered, been complicit in, or otherwise been responsible for Khashoggi’s death.
The report contains an important limitation: U.S. intelligence did not know whether all of the individuals listed knew in advance that the operation would result in Khashoggi’s death.
That qualification is part of the record and must remain part of the investigation.
Chapter 26 — The Istanbul Team
U.S. Treasury sanctions identified members of the operation including Maher Mutreb, Salah Al-Tubaigy, Naif Al-Arifi, Mohammed Al-Zahrani, Mansour Abahussain, Abdulaziz Al-Hasawi, Waleed Al-Shehri, Thaar Al-Harbi, Fahad Al-Balawi, Badr Al-Otaibi, Mustafa Al-Madani, Saif Al-Qahtani, Turki Al-Shehri, and others.
But inclusion in the operation does not mean every member was an employee of Saud Al-Qahtani.
The institutional affiliation of every individual must be reconstructed separately.
Chapter 27 — Ahmed Al-Asiri
In 2021, the U.S. Treasury stated that Ahmed Hassan Al-Asiri coordinated with Al-Qahtani to organize and dispatch the 15-man team.
This creates an institutional junction:
Royal Court and Al-Qahtani
to
intelligence and Al-Asiri
to
operational team.
Saudi judicial proceedings reached a different outcome.
Saudi authorities stated that evidence was insufficient to charge Al-Qahtani, while Al-Asiri was acquitted for insufficient evidence.
Both records belong in the investigation.
The unresolved question is: What evidence informed the U.S. assessments that did not result in Saudi criminal charges against Al-Qahtani?
Chapter 28 — Turkey
Turkish prosecutors charged Al-Qahtani, Al-Asiri and others in proceedings concerning Khashoggi’s killing.
Defendants were tried in absentia.
In 2022, Turkey transferred the proceedings to Saudi Arabia.
The Turkish indictment therefore cannot be represented as a conviction.
Chapter 29 — Was Khashoggi The First Foreign Operation?
The available evidence does not support such a conclusion.
The published U.S. intelligence assessment states that the RIF had previously participated in operations suppressing dissidents inside Saudi Arabia and abroad.
But the public report does not identify those operations.
The identities of the earlier targets therefore remain one of the most important missing pieces of the record.
Chapter 30 — Were Other Dissidents Killed Abroad?
After examining reported deaths, disappearances, forced returns, surveillance operations and alleged assassination attempts from 2015 through September 2026, this investigation has not identified a documented series of dissidents killed outside Saudi Arabia that can reliably be attributed personally to Saud Al-Qahtani.
Khashoggi remains the case carrying the strongest direct official attribution.
Other cases involve forced return, disappearance, surveillance, hacking, threats, and alleged assassination attempts.
These categories should not be collapsed into one another.
Chapter 31 — Mansour Bin Muqrin
Prince Mansour bin Muqrin died when a helicopter crashed in Asir in November 2017.
Later theories attributed the crash to the Tiger Squad.
The evidence reviewed for this investigation does not establish that allegation.
The incident also occurred inside Saudi Arabia.
It should therefore not be presented as an established Al-Qahtani assassination.
One factual question remains: Where is the complete final technical investigation into the helicopter crash?
Chapter 32 — Judge Suleiman Al-Thunayan
Claims later circulated alleging that the Tiger Squad killed Judge Suleiman Al-Thunayan through a medically administered substance or virus.
Contemporaneous reporting of his death does not establish this allegation.
Without medical records, an autopsy, witness evidence or an official investigation supporting the claim, it remains an allegation requiring corroboration.
Chapter 33 — The Alleged Target List
The Washington Post reported information from a Saudi source who said he had seen a list prepared by Al-Qahtani by 2017 containing more than twenty people who could be detained.
Khashoggi was reportedly among them.
The document itself has not been publicly authenticated.
The questions are therefore directed to those who may possess it:
Does the list exist?
Who prepared it?
Who approved it?
Who were the other names?
What happened to each person?
Chapter 34 — What Was “Target Acquisition”?
Reporting concerning the post-Khashoggi restructuring described one Al-Qahtani subordinate as previously responsible for “target acquisition” within a special-operations wing.
The individual was subsequently described as moving into analysis and training.
His identity has not been publicly established in the material reviewed.
But the terminology itself requires explanation.
What did target acquisition mean inside an organization called the Center for Studies and Media Affairs?
Media targets?
Online accounts?
Individuals for surveillance?
Operational targets?
Who headed the unit?
Chapter 35 — Four Unidentified Deputies
Sources describing the post-2018 restructuring referred to four figures from Al-Qahtani’s organization without publicly identifying them:
his former secretary;
the head of special cyber operations;
the head of cybersecurity;
and the official responsible for target acquisition within the special-operations wing.
They were reportedly reassigned into functions described as chief of staff, planning and development, operations, and analysis and training.
Their identities remain unresolved.
Chapter 36 — Abdullah Sharaf Al-Ghamdi
The name Abdullah Sharaf Al-Ghamdi appears in the later institutional landscape.
His Saudi biography documents positions within the Center for Communication and Knowledge Foresight and the Secure Communications Center before he moved into major national digital institutions.
Nothing identified in this investigation establishes wrongdoing by Al-Ghamdi or proves that he was one of Al-Qahtani’s four unidentified deputies.
His relevance is institutional: How did personnel and digital functions move between these organizations?
Chapter 37 — Nasir Al-Biqami And The Later Structure
Reporting identified the Center for Communication and Knowledge Foresight under Nasir Al-Biqami within the post-2018 institutional landscape.
But the complete Saudi administrative record remains unclear.
Did this organization replace the Center for Studies and Media Affairs?
Was it merged with it?
Did both operate simultaneously?
Which personnel and budgets were transferred?
Chapter 38 — The Center Did Not Disappear On October 19, 2018
This is one of the investigation’s most significant institutional findings.
U.S. FARA records continued to identify the Center for Studies and Media Affairs as a foreign principal after Al-Qahtani was removed from office.
American professional relationships associated with the Center also continued.
BGR records show amendments involving representation of the Center and Saudi Embassy during August and September 2018, immediately before Al-Qahtani’s removal.
Therefore:
Al-Qahtani left his official position.
The institution did not simply disappear that day.
Who took control?
Chapter 39 — Who Authorized The Money After Al-Qahtani?
Reporting based on FARA disclosures indicates that payments to American advisers associated with the Center continued after 2018.
That creates a straightforward documentary question:
Who instructed the American firms and authorized invoices after October 19, 2018?
The Royal Court can answer.
The American firms can answer.
The invoices and engagement correspondence can answer.
Chapter 40 — Twitter Permanently Suspends Al-Qahtani
In September 2019, Twitter permanently suspended Saud Al-Qahtani’s account for violating its platform-manipulation policies.
Twitter also stated that his individual account was not included in the datasets released with that disclosure.
It would therefore be incorrect to attribute every Saudi information-operation account removed by Twitter to Al-Qahtani.
The unanswered questions for X are:
What specific conduct triggered the permanent suspension?
Did it occur before or after October 2018?
Which accounts were technically associated with his account?
Chapter 41 — A Broader Saudi Information-Operations Ecosystem
Twitter subsequently disclosed thousands of accounts attributed to Saudi-linked information operations.
That does not establish that Al-Qahtani personally controlled every network.
The appropriate investigative chain is:
operator to company to employees to payments to infrastructure to government relationship.
Political similarity between accounts is not sufficient evidence of common command.
Chapter 42 — Al-Qahtani’S Personal Wealth
This investigation also examined the question of personal financial benefit.
No reliable evidence identified thus far establishes that Saud Al-Qahtani personally embezzled funds from the Center for Studies and Media Affairs or received personal commissions from the American lobbying contracts examined.
Government expenditure and personal wealth are separate questions.
But significant information remains unavailable:
What was his salary?
What additional compensation did he receive?
What companies did he own?
What property did he own?
Did he hold assets outside Saudi Arabia?
Did relatives or business partners receive contracts from institutions under his authority?
What conflict-of-interest rules applied to him as an adviser with ministerial rank?
Chapter 43 — Sanctions And Assets
U.S. Global Magnitsky sanctions against Al-Qahtani block property and interests in property subject to U.S. jurisdiction and prohibit covered transactions.
The United Kingdom also imposed sanctions on him.
But being sanctioned does not establish that authorities actually located substantial bank accounts, real estate or other assets belonging to him.
No public announcement identified during this investigation provides a complete valuation of assets frozen specifically in Al-Qahtani’s name.
Did such assets exist?
If so, what were they worth?
Chapter 44 — His Official Fall
Following Khashoggi’s killing, Al-Qahtani was removed from his position in October 2018.
That removal is official.
From that date through September 26, 2026, this investigation has not identified a published royal order formally restoring Saud Al-Qahtani to government office.
There have been reports and claims concerning continuing influence, contacts and possible rehabilitation.
Those claims are not equivalent to an official appointment.
Chapter 45 — The Saudi Investigation
Saudi authorities later stated that Al-Qahtani had been investigated but that there was insufficient evidence to charge him in the Saudi proceedings concerning Khashoggi.
That outcome belongs in the record.
Beside it stand U.S. Treasury sanctions, the ODNI assessment, British sanctions, and Turkish proceedings.
The divergence between these institutional findings is itself an investigative question.
Chapter 46 — Did The Man Fall, Or Did The Apparatus Survive?
Two fundamentally different hypotheses emerge.
Hypothesis One: Saud Al-Qahtani personally continued secretly directing his former apparatus after his official removal.
The publicly available evidence reviewed here is insufficient to establish that.
Hypothesis Two: Personnel, contracts, institutional structures and capabilities developed during his tenure continued after his removal.
There is substantially more evidence supporting institutional continuity.
The Center remained present in FARA records. Professional contracts did not immediately disappear. Sources reported that some personnel were reassigned rather than removed.
The central question therefore becomes:
Was October 19, 2018 the dismantling of an apparatus, or merely the removal of the person at its head?
Chapter 47 — The Network Emerging From The Evidence
The evidence produces a more complicated picture than that of a media adviser implicated in the Khashoggi case.
Saud Al-Qahtani was officially connected to the Saudi Royal Court, the Center for Studies and Media Affairs, international lobbying contracts, cybersecurity institutions, and media monitoring and analysis.
Official U.S. assessments and sanctions subsequently connect him to Maher Mutreb, Ahmed Al-Asiri, the Rapid Intervention Force, and the Khashoggi operation.
Meanwhile, the wider Saudi information and surveillance environment includes Bader Al-Asaker, Ahmad Abouammo, Ali Alzabarah, Ahmed Almutairi or Aljbreen, and the acquisition of private Twitter information.
A line should not be drawn between every individual and Al-Qahtani unless independent evidence supports it.
Chapter 48 — Fifty Questions Still Requiring Answers
- What was the complete organizational structure of the Center for Studies and Media Affairs between 2015 and 2018?
- Who headed special cyber operations?
- Who headed cybersecurity operations?
- Who was responsible for target acquisition?
- What did “target acquisition” mean operationally?
- What was Maher Mutreb’s exact official position?
- What operations did the Rapid Intervention Force conduct before the Khashoggi operation?
- Which foreign operations was the U.S. intelligence assessment referring to when it stated that RIF had participated in suppressing dissidents abroad?
- Did a list containing more than twenty potential targets attributed to Al-Qahtani exist in 2017?
- If it existed, whose names appeared on it?
- What happened to the names collected through #The_Blacklist?
- Were those names entered into a government database?
- Who owned and operated the technical infrastructure used for monitoring activities?
- What technology did the Center actually purchase from Hacking Team?
- Where are the contracts and invoices?
- Did an institution under Al-Qahtani’s authority purchase Pegasus or another NSO system?
- Who was the legal customer?
- Who paid for it?
- Which Twitter accounts did Saudi officials seek information about?
- Was Abdulrahman Al-Sadhan’s account among them?
- To whom did Ahmed Almutairi or Aljbreen report?
- What employment did Ali Alzabarah obtain after returning to Saudi Arabia?
- Did he subsequently work for Al-Qahtani’s Center or another government institution?
- Who administered the unofficial facility where women’s-rights activists alleged abuse?
- Did Saud Al-Qahtani enter that facility?
- Where are the entry records, CCTV records and medical records?
- What role, if any, did Al-Qahtani play in Ritz-Carlton interrogations?
- Did he participate in discussions concerning financial settlements?
- Who valued the assets involved in settlements officially valued at more than SAR 400 billion?
- Where did those assets ultimately go?
- What was Al-Qahtani’s actual role, if any, in the Saad Hariri episode?
- If he participated in questioning Hariri, what legal authority permitted a media-center chief and Royal Court adviser to do so?
- Who organized Sultan bin Turki’s forcible return?
- Who owned or chartered the aircraft?
- Who ordered the change in destination?
- Where is Sultan bin Turki today?
- Where is Turki bin Bandar?
- Where is Saud bin Saif Al-Nasr?
- What do Canadian border records show concerning the alleged Aljabri team?
- Do any members overlap with the RIF or Istanbul team?
- Who assumed control of the Center after October 19, 2018?
- Who authorized contracts and invoices after Al-Qahtani’s removal?
- Where did the four unidentified deputies described in post-2018 reporting go?
- Was the special-operations function actually abolished?
- Or was it renamed?
- Why did the Center continue appearing in FARA records after Al-Qahtani’s removal?
- What was the institutional relationship between the old Center and the Center for Communication and Knowledge Foresight?
- What was the extent of Saud Al-Qahtani’s personal wealth?
- Did U.S., British or other sanctions authorities freeze identifiable assets belonging specifically to him?
- Did Al-Qahtani, his relatives, business associates or other related persons obtain financial benefits from contracts issued by institutions over which he exercised authority?
Conclusion — The Unfinished Record
The established record requires no exaggeration.
Saud Al-Qahtani began his career in law and the Royal Saudi Air Force, entered royal media operations, rose to adviser with the rank of minister, and headed a Royal Court center that spent millions of dollars on international lobbying and influence activities.
His name appears in documentary evidence concerning efforts to obtain surveillance technology.
He publicly promoted a campaign to identify people through #The_Blacklist.
The United States subsequently sanctioned him for his role in the operation that resulted in Jamal Khashoggi’s killing.
The U.S. Treasury later stated that the Rapid Intervention Force acted directly or indirectly for or on behalf of Al-Qahtani.
The published U.S. intelligence assessment stated that this same force had participated in operations against dissidents inside Saudi Arabia and abroad before Khashoggi was killed.
At the same time, important limits remain in the public evidence.
The evidence reviewed does not establish that every Saudi dissident who disappeared, was hacked, threatened or forcibly returned was personally targeted by Al-Qahtani.
It does not establish a documented series of foreign killings personally ordered by him beyond the official attribution surrounding Khashoggi.
It does not establish that Al-Qahtani embezzled the Center’s money or personally received commissions from its U.S. lobbying contracts.
And allegations concerning the Tiger Squad cannot be converted into established facts merely because they have been repeatedly published.
But an enormous institutional gap remains.
Who operated the apparatus?
What were the RIF operations that preceded Khashoggi?
Who were their targets?
What exactly was the “target acquisition” function?
Who ran special cyber operations?
Where did those officials go after October 2018?
Who took control of the Center, its money, its contracts, its personnel and its technical capabilities after Saud Al-Qahtani was formally removed?
The Khashoggi case therefore does not exhaust the questions surrounding Saud Al-Qahtani.
It is the point at which parts of a previously opaque structure became visible internationally.
The larger investigation concerns what existed before October 2, 2018, who operated it, how its media, cyber, surveillance and operational functions interacted, which individuals were targeted inside and outside Saudi Arabia, and what parts of that institutional structure continued after Al-Qahtani’s formal removal.
