Bezos Saudi hacking accusations lack details, experts say

De Becker speculated that the Saudis were seeking to expose the Bezos case as retaliation, after the Washington Post, owned by Bezos, published information criticizing the apparent involvement of the Saudi government in the bombing. badbadination of post columnist Jamal Khashoggi.

The article by De Becker describes many dramas surrounding AMI, including mistakes made by the company in the past, the wording of AMI emails that it says suspects and some contacts between the Saudis and AMI. He stops claiming that AMI has received information from the Saudis, but it is very implicit.

De Becker also cited press reports detailing the Saudis' surveillance capabilities, including the extensive surveillance they allegedly conducted on Khashoggi before his death.

All this is circumstantial to his main claim: "Our investigators and several experts concluded with great confidence that the Saudis had access to the Bezos phone and obtained confidential information."

He also stated that the information confirming this allegation had been communicated to the federal authorities, which is why he declared that he was no longer dealing with the case.

CNBC has met with three cybersecurity experts who have previously worked on cases involving Saudi Arabia and have asked to remain anonymous as they did not have permission from their employers to be safe. address to the media. Although the claims are possible, they added, they also constitute staggering claims requiring more concrete information to support.

Here is what we do not know.

• What tools? To understand how the Saudis had access to Bezos' mobile phone, security experts would need to understand the tools used by the pirates. Was it a known form of malware, or something new and tailor-made? Have they corrupted someone for access or files? Which leads to the second related question …

• Was access remote? It is possible to remotely attack an individual's mobile device, but these attacks are advanced and relatively rare in the real world. The Russians have for example used this tactic against NATO soldiers, and the UAE has also played with this type of remote surveillance, according to a report from the Reuters agency released early in the day. 39; year. It would be stunning to see a foreign government using one of these tactics to monitor the phone of an American business mogul.

• Or was physical access? If someone from Saudi Arabia had the Bezos phone in hand or if someone on the orbit of Bezos had created the malware, the national security issue would be less serious. But this is certainly an issue that the Amazon Board of Directors would like answered, as it highlights the need to better protect the CEO's technology in cybersecurity.

• Who in the Saudi government actually executed the espionage plan? It is difficult to determine exactly who is responsible for launching such an attack, but US government investigators are getting much better at it. Recent charges of Russian, Chinese, Iranian and North Korean hackers show that investigators can now accurately determine who is involved in a specific incident. If this attack was indeed sponsored by the Saudis, an investigation should be able to give more details, or even describe those responsible.

The claims of hacking can often fall into a broader narrative involving political intrigue, and the Bezos / AMI saga is packed.

But separating these narrative details from the concrete details of what the Bezos team alleges about the Saudis will require much more work.