Ruler of Dubai authorised hacking of ex-wife’s phone, High Court finds

The ruler of Dubai authorised the hacking of his former wife and her lawyers’ phones with multimillion-pound spyware during a legal battle over their two children, the High Court has found.

Sheikh Mohammed bin Rashid Al Maktoum, 72, gave his “express or implied authority” for the phone of his sixth wife Princess Haya Bint Al Hussein, 47, to be infiltrated with Pegasus spyware during the ongoing legal case, the court ruled.

The vice president and prime minister of the United Arab Emirates (UAE), who was previously found to have conducted a “campaign of fear and intimidation” against Princess Haya, also authorised the use of Pegasus on Princess Haya’s solicitors, her personal assistant and two members of her security team, it was found.

The use of Pegasus, which is manufactured by the NSO Group and sold exclusively to nation states, came to light in August 2020 when Cherie Blair told Princess Haya’s solicitor Baroness Shackleton that she may have been hacked, the court heard.

Mrs Blair, the wife of former prime minister Tony Blair and then an NSO adviser, contacted the Conservative peer – who has previously represented the Prince of Wales and Sir Paul McCartney – after she was told that the software may have been “misused”.

NSO told the court it could not disclose who its customers were, but confirmed that an unnamed customer’s contract had been terminated within weeks of the discovery.

On Wednesday, the High Court published a number of rulings in the ongoing case between Sheikh Mohammed and Princess Haya, the half-sister of King Abdullah II of Jordan, over their two children, Al Jalila, 13, and Zayed, nine.

Last year, Sir Andrew McFarlane – the most senior family judge in England and Wales – found that Sheikh Mohammed “ordered and orchestrated” the abduction and forced return to Dubai of two of his adult daughters: Sheikha Shamsa, 40, in August 2000 and her sister Sheikha Latifa, 35, in 2002 and again in 2018.

In the latest judgments, the High Court made more findings of fact against Sheikh Mohammed, including that the multimillion-pound spyware Pegasus had been used on his estranged wife’s phone with his “express or implied authority”.

Sir Andrew ruled that it was more likely than not that the at least attempted surveillance of six phones “was carried out by servants or agents of the father, the Emirate of Dubai or the UAE and that the surveillance occurred with the express or implied authority of the father”.

He concluded: “The father, who is the head of government of the UAE, is prepared to use the arm of the state to achieve what he regards as right.

“He has harassed and intimidated the mother both before her departure to England and since.

“He is prepared to countenance those acting on his behalf doing so unlawfully in the UK.”

Sir Andrew added in a separate judgment that the proceedings had been “characterised by coercive and controlling behaviour of a high order” by the Sheikh.

However, Sir Andrew did not find that the hacking in either July or August 2020 was related to what was happening at that time in the ongoing legal battle over the two children.

The High Court heard that, once on a phone, Pegasus can track a person’s location, read texts and emails, listen to phone calls, record live activity, as well as access apps, photos and operate the camera and microphone.

The spyware can infiltrate a device if a phone user presses on a fraudulent link or even without any action from the phone’s owner at all, according to experts’ evidence.

The court also heard that a person is unlikely to detect that a phone is infected with the spyware “even with the most sophisticated and professional antivirus search mechanisms”.

Sir Andrew found proved that at least a “very substantial” 265 megabytes of data had been taken from Princess Haya’s phone, equivalent to around 24 hours of voice recording or 500 photographs, but it was not known what data had been lifted.

At a hearing in October 2020, Princess Haya’s barrister Charles Geekie QC told the court: “It had a very, very significant impact on her… she understands and believes that there has been hacking and that is making her feel both hunted and haunted.”

The findings of fact, which are vehemently denied by Sheikh Mohammed, have been found to the civil standard of proof on the balance of probabilities.

While he denied any knowledge of the hacking and offered no evidence to the court, Sheikh Mohammed’s lawyers argued that Princess Haya had not proved her case and that he could not confirm or deny whether the UAE had a contract with the NSO Group.

They also suggested that another country could be responsible, with the billionaire ruler’s barrister arguing that Jordan may have carried out the hacking in order to embarrass Sheikh Mohammed.

However, Sir Andrew rejected this suggestion, calling the hacking findings a “total abuse of trust and indeed an abuse of power to a significant extent”.

“At no stage has the father offered any sign of concern for the mother, who is caring for their children, on the basis that her phones have been hacked and her security infiltrated,” he added.

Princess Haya originally fled the UAE for England in early 2019 with her two children, claiming she was “terrified” of her husband.

She applied for the children to be made wards of court, as well as applying for a forced marriage protection order in relation to Jalila and a non-molestation order for her own protection.

In the rulings published last year, Sir Andrew found that Sheikha Shamsa, then 19, was taken from the streets of Cambridge in August 2000 and “has been deprived of her liberty for much if not all of the past two decades”.

He also ruled that Sheikh Mohammed had abducted Sheikha Latifa and forced her to return to Dubai twice, once in 2002 and again in 2018.

Latifa’s second attempted escape from the UAE made headlines around the world after the publication in March 2018 of a video which she said would only be released if “I’m dead, or I’m in a very, very, very bad situation”.

After several months of planning, Latifa and friend Tiina Jauhiainen – with the help of a former French spy, Herve Jaubert, who is said to have charged Latifa 350,000 euro (£302,800) for his assistance – attempted to travel by boat into international waters.

Sir Andrew found proved claims by Ms Jauhiainen that Indian special forces boarded a boat in international waters off the coast of Goa on March 4 2018, before Latifa was taken back to Dubai against her will.

In his most recent judgments, Sir Andrew said he took his previous findings into account.

“The findings of fact previously made with respect to Princess Latifa establish that the father is prepared and able to use the government security services for his own family needs,” he wrote.

After the publication of the judgments Sheikh Mohammed said he continued to deny the allegations, adding: “As a Head of Government involved in private family proceedings, it was not appropriate for me to provide evidence on such sensitive matters either personally or via my advisers in a foreign court.

“Neither the Emirate of Dubai nor the UAE are party to these proceedings and they did not participate in the hearing. The findings are therefore inevitably based on an incomplete picture.”

He added that he maintained that the findings were made in an unfair manner.

In August, Sheikh Mohammed brought a Court of Appeal claim against the findings of hacking on the basis of procedural unfairness, however, his appeal was unsuccessful.