Dubai’s ruler revealed to have hacked phones of estranged wife Princess Haya and her legal team

  • Oops!
    Something went wrong.
    Please try again later.
  • Oops!
    Something went wrong.
    Please try again later.
  • Oops!
    Something went wrong.
    Please try again later.
  • Oops!
    Something went wrong.
    Please try again later.
·10-min read
Dubai’s ruler revealed to have hacked phones of estranged wife Princess Haya and her legal team
In this article:
  • Oops!
    Something went wrong.
    Please try again later.
  • Oops!
    Something went wrong.
    Please try again later.
  • Oops!
    Something went wrong.
    Please try again later.
  • Oops!
    Something went wrong.
    Please try again later.

The ruler of Dubai hacked the phones of his estranged wife and her legal team in an outrageous spy plot during the acrimonious High Court battle over their children’s future, it can be revealed.

Sheikh Mohammed bin Rashid al-Maktoum mounted the extraordinary covert operation against Princess Haya bint al-Hussein last summer, with agents able to listen to phone calls, read her messages and emails, and steal her passwords and photos.

The Princess broke free from her marriage in April 2019, fleeing to the UK with children Sheikha Jalila and Sheikha Zayed which sparked a court bid by Sheikh Mohammed for the girls to be returned to Dubai.

A series of secret court rulings were published for the first time on Wednesday, laying bare how the Sheikh spied on the Princess and her top lawyers including Baroness Fiona Shackleton, and attempted to hack the phones of members of her security team during the bitter High Court wrangling.

The international spy plot was exposed by Cherie Blair QC, wife of former Prime Minister Tony Blair, who tipped off Baroness Shackleton that she had been a victim of hacking.

In a withering judgment, the President of the Family Division, Sir Andrew McFarlane, said the Sheikh had abused his status in the United Arab Emirates and wrecked attempts to rebuild trust between himself, his estranged wife, and their children.

“The father, who is the Head of Government of the UAE, is prepared to use the arm of the State to achieve what he regards as right”, said the judge.

“He has harassed and intimidated the mother both before her departure to England and since. He is prepared to countenance those acting on his behalf doing so unlawfully within the UK.

Princess Haya arriving with her Baroness Shackleton at the High Court in February 2020 (Getty Images)
Princess Haya arriving with her Baroness Shackleton at the High Court in February 2020 (Getty Images)

“It is more probable than not that the surveillance of the six phones…was carried out by servants or agents of the father, the Emirate of Dubai or the UAE, and that the surveillance occurred with the express or implied authority of the father.”

Sir Andrew said lengthy court proceedings, conducted in private over the course of the last two years and fought between expensively assembled legal teams, had attempted to rebuild links within the divided family.

“He (the Sheikh) has behaved in a manner which will do the opposite of building trust. The findings represent a total abuse of trust, and indeed an abuse of power, to a significant extent.”

Princess Haya, 47, an Oxford-educated Jordanian Royal and United Nations goodwill ambassador, told the court revelations that she and her team had been hacked left her feeling “hunted and haunted”.

In a separate series of bombshell rulings which were revealed last March, the judge concluded the 72-year-old Sheikh – a personal friend of the Royal Family – had previously orchestrated the abduction of his daughter Sheikh Shamsa in Cambridge in 2000.

Sir Andrew found Shamsa, who was flown out of the country from the Sheikh’s horse-racing headquarters in Newmarket, has been held captive for much of the last two decades.

The judge also ruled that the Sheikh had ordered agents to stop another daughter, Sheikh Latifa, from fleeing Dubai on a yacht which was intercepted off the coast of India in 2018.

The control the Sheikh had exerted over his daughters in the past weighed heavily on Sir Andrew’s findings that he had been behind the phone hacking plot.

“The father is prepared and able to use the government security services for his own family needs, and that this has occurred in the recent past”, he said.

The Sheikh released a statement later on Wednesday afternoon following publication of the rulings.

“I have always denied the allegations made against me and I continue to do so,” he said.

“These matters concern supposed operations of State security. As a Head of Government involved in private family proceedings, it was not appropriate for me to provide evidence on such sensitive matters either personally or via my advisers in a foreign court.

“Neither the Emirate of Dubai nor the UAE are party to these proceedings and they did not participate in the hearing. The findings are therefore inevitably based on an incomplete picture.

“In addition, the findings were based on evidence that was not disclosed to me or my advisers. I therefore maintain that they were made in a manner which was unfair.

“I ask that the media respect the privacy of our children and do not intrude into their lives in the UK.”

How the spy plot was revealed

The Sheikh’s agents used the sophisticated Pegasus software from the Israeli-based NSO Group to carry out the hacking, the court heard.

The spyware, which is completely undetectable to victims, exploits security holes so that a server – located anywhere in the world – can take control of the target phone.

Strictly licensed only to nation states, Pegasus allows users to “harvest” data from target’s phones, reading texts and emails, listening in to calls, and accessing contact lists, photos, passwords, and calendar entries.

“It would also allow recording of live activity and taking of screenshots and pictures”, said Sir Andrew. “The surveillance has occurred with the express or implied authority of the father.”

Mrs Blair, an advisor to the NSO on business and human rights issues, raised the alarm on August 5, 2020, after being told about an abuse of the software within the UAE.

In a urgent late-night phone call from a senior NSO manager, Mrs Blair was told that “it had come to the attention of NSO that their software may have been misused to monitor the mobile phone of Baroness Shackleton and her client, Her Royal Highness Princess Haya.

“The NSO senior manager apparently expressed great concern. Mrs Blair was told that NSO had taken steps to ensure that the identified phones could not be accessed again by their software. The NSO manager asked Mrs Blair to help in contacting Baroness Shackleton.

The Princess broke free from her marriage in April 2019, fleeing to the UK with children Sheikha Jalila and Sheikha Zayed (Getty Images)
The Princess broke free from her marriage in April 2019, fleeing to the UK with children Sheikha Jalila and Sheikha Zayed (Getty Images)

“Mrs Blair was able to obtain the phone number for Baroness Shackleton and she made contact with her later that evening.”

In a statement to the court, Mrs Blair said she believed Dubai was behind the hacking “because I assumed no one else would have an interest in targeting Princess Haya and Baroness Shackleton.

“I have not had any explicit confirmation from NSO who their client was. However, during a conversation with the NSO Senior Manager, I recall asking whether their client was the ‘big state’ or the ‘little state’. The NSO Senior Manager clarified that it was the ‘little state’ which I took to be the state of Dubai.”

On the very same day that Mrs Blair was alerted, a cyber-security specialist, Dr William Marczak from the University of California, Berkeley, also discovered the hacking plot.

Dr Marczak was monitoring the phone of a “UAE activist” - referred to in court proceedings as ‘Mr X’ – who believed he had been hacked with the Pegasus system. The computer expert noticed Baroness Shackleton’s law firm, Payne Hicks Beach, also appeared to have been targeted by the same server, and contacted lawyers to alert them to the intrusion.

Dr Marczak went on to give critical evidence to the High Court, on how he tracks Pegasus IP addresses and links them to the nation states responsible.

Sheikh shifts the blame on to Middle East partners

The Sheikh, who offered no evidence to the court, refused to confirm or deny if the UAE or Dubai has a contract with NSO to use the controversial Pegasus software.

But through his lawyers he made a series of suggestions that Jordan, Iran, Saudi Arabia, or Israel may have been responsible for targeting the Princess, in a bid to embarrass the Sheikh and frame him as the culprit.

But Sir Andrew rubbished the suggestions, calling them “so insubstantial as to be without consequence”.

He said the Sheikh’s lead counsel, Lord Pannick QC “has proffered the idea that it would be in the interests of another State to undertake the hacking in order for the mother and for the court to jump to the conclusion that the father was the culprit.

“The purpose, it was suggested, of this subterfuge being to embarrass the father and thereby somehow further the interests of the originating State. Nothing was said as to

the mechanism by which the mother or the court might find out that this highly sophisticated software had been used against her, or why another State might risk losing its very valuable contract with NSO, in order just to embarrass the father in this way even if NSO ever discovered that hacking had occurred.”

The judge concluded: “It is obvious that the father, above any other person in the world, is the probable originator of the hacking. No other potential perpetrator, being a person or government that may have access to the Pegasus software, can come close to the father in terms of probability and none has been put forward other than via transient and changing hints or suggestions.”

He noted the timing of the hacking, in July and August last year, came during key points of the High Court case but said this was probably coincidence and down instead to the point when the Pegasus system was able to exploit a security weakness.

He concluded the Princess had been hacked, with at least 265MB of data downloaded, while the phones of Baroness Shackleton – a top celebrity divorce lawyer – and Nicholas Manners, a partner at Payne Hicks Beach, had also been successfully infiltrated. The full extent of the stolen data is not known.

Sir Andrew said attempts at hacking had also been made on the Princess’ personal assistant and two members of her security team.

The court was told news of the hacking plot had a “very, very significant impact” on Princess Haya: “Quite simply, she understands and believes that there has been hacking and that is making her feel both hunted and haunted.”

Her lead barrister, Charles Geekie QC, said: “She wants the hounding of her to stop.”

Parliamentary authorities have been aware of the hacking since October 2020, when Baroness Shackleton told fellow members of the House of Lords during a debate that she was “a victim of being hacked through my telephone”.

“My Parliamentary email, my own email, my WhatsApp messages, my pictures and my texts are all visible to somebody else”, she said.

In response to media reports in August about use of the Pegasus software, NSO said it only works with government clients in the fight against crime and terrorism and “does not operate the systems that it sells to vetted government customers, and does not have access to the data of its customers’ targets”.

In a letter to the court, NSO confirmed its contract with UAE was terminated in December last year following an investigation.

“While the Investigation could not make any determinative conclusions as to what in fact happened, the recommendation following the Investigation was that the contract with the customer should be terminated, and that the systems which that customer had contracts for be shut down”, it said.

“NSO does not condone, assist in or encourage the use of its software for purposes other than the agreed purposes specified and identified in the contracts it concludes with its customers on a lawful basis.”

The Sheikh, who has never appeared in the High Court proceedings, deployed an expensively assembled team of lawyers to unsuccessfully fight the hacking claims.

Eleven judgments have been published today after successful applications from the newspapers and broadcasters, with the support of Princess Haya. The Sheikh did not ultimately oppose publication, dropping his objections to some parts becoming public at the last minute, and has been ordered to £560,000 in legal costs that the Princess racked up on the publicity issue.

Read More

What the papers say – October 7

Hacking and house-hunting: High Court issues rulings against Sheikh Mohammed

Princess Haya: Dubai’s ruler banned from going near her Surrey estate

Our goal is to create a safe and engaging place for users to connect over interests and passions. In order to improve our community experience, we are temporarily suspending article commenting