Jamal Khashoggi: Saudi murder suspect had spy training

Turkish media released CCTV pictures allegedly showing the Saudi 'hit squad' suspected of Mr Khashoggi's disappearance

The BBC has uncovered new details about one of the men accused of murdering Jamal Khashoggi, a prominent Saudi journalist who was critical of his country's government.

Turkish media identified Maher Abdulaziz Mutreb as being part of a 15-member team of suspected Saudi agents who flew into and out of Istanbul on the day of Mr Khashoggi's disappearance from the city's Saudi consulate on 2 October.

He is said to have spent two years working in London, with a source describing him as a colonel in Saudi intelligence to US news network CNN.

And now BBC Arabic can reveal he was trained how to use offensive spyware technology on behalf of the Saudi state.

• What we know about Saudi journalist's disappearance

• Who's who in alleged Saudi 'hit squad'

• Saudi Arabia profile

The source, who spoke to the BBC on condition of anonymity, has visually confirmed his identity from pictures circulated in the media in the days since Mr Khashoggi's disappearance.

According to him, Mr Mutreb was introduced as "an intelligence security operative". The spyware trainers, however, nicknamed him "dark face".

"Because he looked always grumpy, like he was on the sad side… he was very silent," the source added.

Saudi Arabia denies any knowledge of what happened to Mr Khashoggi, insisting he left the consulate soon after getting routine paperwork.

Trained to target citizens

The European surveillance expert described how Mr Mutreb spent two weeks on a course with him in 2011, learning how to use the technology his company was providing the Saudi government so that it could carry out targeted attacks on the phones and computers of its own citizens.

"The training involved things like infecting a computer from potential targets of interest for intelligence and extracting information, so digital evidence, information about this person of interest.

CCTV footage from Istanbul airport purports to show Maher Mutreb on 2 October

"This information might have been basically everything from [their] GPS position, conversation, microphone audio around the device itself, camera pictures, files on disk, emails, contacts, everything that was on the device itself."

During the training, which was in a military compound in the suburbs of Riyadh, the surveillance expert says Mr Mutreb "used to come and go" and "almost didn't speak at all".

"He wasn't one of the guys who was particularly skilled on the technical side," the spyware trainer explained.

"The group was split between those doing physical intelligence… so cameras, microphones etc, and another group of people that were doing digital surveillance… I believe that this guy was more on the physical surveillance than the digital surveillance."

A man identified as Maher Mutreb can be seen in the far right of a photo from Saudi Crown Prince Mohammed Bin Salman's visit to the Massachusetts Institute of Technology in March

The tools he was trained in, the source said, were similar to other tools which, according to Citizenlab and Amnesty International, were recently used against several of Mr Khashoggi's friends.

Paper trail

Mr Mutreb is believed to have spent two years working at the Saudi embassy in London. A document published by the British government in 2007 listed a man with that name as first secretary.

However, he has also been named as a Saudi intelligence officer by several individuals, and some leaked documents.

CNN spoke to a Saudi source in London who said he knew Mr Mutreb, describing him as a colonel in Saudi intelligence, while the popular Arabic app MenoM3ay - which enables users to see the names people have linked to phone numbers - lists a man with that name as a colonel in the royal court.

On October 12 Wikileaks tweeted the Khashoggi Files, which included emails with the name of Mutreb and five other men who were supposed to have attended a course in Italy in 2011, run by an Italian company called Hacking Team.

The emails were part of a dump of 400GB of data first released by Wikileaks in July 2015, which Hacking Team say was stolen from their internal network.

The emails also included conversations that suggested the intelligence agencies Hacking Team worked with used it to spy on activists and journalists.

The emails included a list of countries they sold their tools to, including Egypt, Russia, Saudi Arabia and Sudan. Hacking Team also sells surveillance software, some of which has offensive capabilities.