47: Project Raven

Episode Summary

Executive Summary: The episode follows David, a former Navy/NSA cyber operator recruited into UAE contractor Project Raven, where American mercenaries helped build offensive spying capabilities. What began as counterterrorism shifted into political surveillance of journalists, activists, U.S. persons, and foreign governments, exposing ethical, legal, and human-rights abuses and prompting defections, investigations, and public reporting.

Main Topics: David’s path from military service to cyber operations (Priority: 5/5): David’s background in religion/philosophy, Navy service, SEAL training attempt, and cyber training explains how he became an offensive intelligence analyst and why he was well-suited for covert work. Project Raven’s recruitment and cover story (Priority: 5/5): A U.S.-contracted cyber unit was relocated to Abu Dhabi under the guise of defensive cybersecurity, but the real mission in the black briefing was offensive cyber operations for UAE intelligence. Operational structure of the villa-based hacking team (Priority: 5/5): The team worked from a converted villa with management, targeting, infrastructure, and operations rooms, using anonymous servers, phishing, exploits, and lateral movement to infiltrate targets and exfiltrate communications. Mission creep from counterterrorism to political espionage (Priority: 5/5): Requests evolved from alleged terrorist threats to monitoring royal family travel, foreign ministries, journalists, human rights activists, and even U.S. citizens, raising ethical and legal concerns among staff. Surveillance of activists and journalists (Priority: 5/5): Rory Donaghy and Ahmed Mansoor were targeted with phishing, spyware, and social-media lures; Rory lived in London, while Ahmed was arrested, tortured, and sentenced after persistent surveillance. Karma spyware and mobile exploitation (Priority: 4/5): The UAE acquired Karma, an iPhone exploit tool that could infect devices via text/iMessage with no user interaction, demonstrating the sophistication of the operation and contributing to later Apple patches. Blowback, exits, and investigations (Priority: 4/5): As staff objections grew, some were repatriated, others joined Dark Matter, and the FBI and researchers continued to investigate potential illegal targeting of U.S. persons and misuse of the capability.

Key Arguments: Mercenaries may be paid to act without allegiance, but they still have moral boundaries; when work crosses those boundaries, teams fracture. Project Raven was presented as defensive cybersecurity, yet the actual work was offensive intelligence collection for the UAE government. The operation increasingly targeted political dissent rather than legitimate security threats, undermining the original counterterrorism rationale. U.S. persons and U.S.-based targets were especially problematic because domestic law and FISA-based expectations restrict such targeting. A single managed service provider and default credentials can collapse the security of an entire government ecosystem, enabling broad access. The surveillance was not abstract: journalists and activists experienced real-world consequences, including fear, arrest, torture, and social isolation. Foreign contracting jobs can differ drastically from the advertised role; workers should verify scope, legal authorities, and exit options before moving overseas.

Data Points: Years David worked at NSA: about 3 years - David said he worked there from August 2011 to August 2014. Project Raven contract length: 2 years - He was told he would move to Abu Dhabi for the duration of the contract. Initial hotel period: 30 to 60 days - New arrivals lived in a hotel before moving into the villa. Team size at villa: around 30 people - Multiple teams worked in the converted villa office space. Time before David considered himself skilled: 3 to 4 months - He said it took a few months before he realized he could do the analyst work well. Rory’s suspicious tweets: 31 public tweets - Citizen Lab found 31 public tweets sent to Rory that were suspicious and linked to spyware-laced URLs. Arrested Twitter accounts used in lures: about 6 accounts - Some accounts sending lure tweets belonged to UAE citizens who had been arrested. Apple patch date: 2017 - Apple pushed an update that made the Karma tool less effective. Project Zero disclosure window: 90 days - Natalie Silvanovich’s vulnerabilities were given the standard 90-day fix window before public disclosure. Staff leaving Project Raven for Dark Matter: about a quarter quit - When Project Raven was replaced by Dark Matter, roughly one-quarter of the team left.

Pivotal Quotes: "I don't think Americans should be doing this to other Americans. I'm a spy, I get that. And I'm an intelligence officer, but I'm not a bad one." — Lori Stroud: Her objection after finding that Project Raven data collection included U.S. citizens. "What you're signing up for may not be actually what you're doing." — David: His warning to listeners about foreign contract work and mission drift. "it all happens silently" — Rory Donaghy: He described how surveillance affected him without obvious immediate signs.

Implications: The story shows how state-backed cyber talent can be repurposed from defense to repression, especially when oversight is weak. For workers, it’s a warning to scrutinize foreign contracts; for the industry, it highlights the need for legal, ethical, and transparency safeguards.