Areej al-Sadhan, the sister of a Saudi humanitarian worker who was kidnapped and later sentenced to 20 years in prison, filed a lawsuit against X, formerly known as Twitter, in May.

According to The Guardian, her case relates to the infiltration of the California company by three Saudi agents, two of whom pretended to be Twitter employees in 2014 and 2015, which resulted in the arrest of al-Sadhan's brother, Abdulrahman, and the revealing of the identities of thousands of anonymous Twitter users, some of whom were later reportedly detained and tortured as part of the government's crackdown on dissent.

Last August, a US jurist found Ahmad Abouammo, a 44-year-old dual US-Lebanese citizen, who obtained information on dissidents who used the platform, guilty after holding a trial in a federal court in San Francisco.

Prosecutors had sought a prison term for the alleged spy of over 7 years, saying they wanted a "sentence strong enough to deter others in the technology and social media industry from selling out the data of vulnerable users."

Abouammo had messaged Saud al-Qahtani, a senior assistant to Crown Prince Mohammed bin Salman (MBS), saying, "Proactively and reactively we will delete evil, my brother." According to the lawsuit, it was a reference to the identifying and injuring of supposed Saudi dissidents who were utilizing the network.

Al-Qahtani was accused of being a mastermind in the murder of writer Jamal Khashoggi in 2018 by the US.

“Twitter was either aware of this message – brazenly sent on its own platform – or was deliberately ignorant to it,” according to the revised lawsuit.

X refused to respond to press questions.

After resigning in May 2015, Abouammo continued to contact Twitter to respond to requests for the identities of confidential users from Bader al-Asaker, a key advisor to MBS.

Al-Sadhan's lawyers updated the claim last week to include how then-CEO Jack Dorsey's leadership had Twitter willfully providing user data to the Kingdom.

Human Rights Watch recently slammed a Saudi court for condemning a man to death based solely on his Twitter and YouTube activity, calling it an "escalation" of the government's war on free expression.

Muhammad al-Ghamdi, the condemned man, is the brother of a Saudi academic and regime critic living in exile in the United Kingdom. According to Saudi court records seen by HRW, al-Ghamdi was charged with having two accounts with a total of ten followers. Both accounts had less than 1,000 tweets combined and included retweets from well-known government opponents.

Read more: KSA sentences Tunisian doctor to 15 years for reacting to a Tweet

Twitter 'given ample notice' of security vulnerabilities

The lawsuit details how Twitter was given "ample notice" of security vulnerabilities to internal personal data, as well as the possibility of insiders unlawfully accessing it, based on public reporting at the time.

The lawsuit adds that Twitter "did not simply ignore all of these red flags... it was aware of the malign campaign."

According to the lawsuit, Saudi Arabian authorities would formally follow up with Twitter after receiving confidential user data from its agents working inside the company, by filing so-called EDRs - or emergency disclosure requests - in order to obtain documentation that confirmed a user's identity, which it would then use in court. Those EDRs were frequently authorized on the same day.

In May 2015, Albabarah acquired the data of two Twitter users who posted about the monarchy in a way that al-Asaker felt was offensive. According to the lawsuit, EDRs regarding the individuals were then transmitted and automatically authorized by Twitter.

Between July and December 2015, Twitter granted the monarchy information requests "significantly more often" than most other nations, including Canada, the United  Kingdom, Australia, and New Zealand.

On November 5, 2015, only days before Twitter was asked by the FBI about its worries about Saudi infiltration, it promoted Alzabarah, who is now a fugitive in Saudi Arabia.

When Twitter learned of the FBI's suspicions, it placed Alzabarah on leave and confiscated his laptop, but not his phone, which he had been using frequently to communicate with Saudi state connections.

According to the complaint, Twitter "had every reason to expect Alzabarah to immediately flee to Saudi Arabia, which is exactly what he did."

Afterward, Twitter notified users that had been exposed, citing their data "may" have been targeted, with no specific information, thereby putting thousands of users at risk, according to the lawsuit.

Even after Twitter became aware of the hack, it continued to meet and coordinate with Saudi Arabia. Dorsey met with MBS around six months after the FBI alerted the business to the problem, and the two talked about ways to "train and qualify Saudi cadres."