The murder of Jamal Khashoggi — investigated using Google Trends.
On the traceability and validity of Google Trends data.
Context
Jamal Khashoggi was a Saudi journalist and prominent government critic who wrote, among others, for the Washington Post. He advocated for press freedom and was particularly critical of Crown Prince Mohammed bin Salman. On October 2, 2018, Khashoggi was murdered inside the Saudi consulate in Istanbul — an internationally prominent case that placed Saudi Arabia under considerable diplomatic pressure.
Against this backdrop, we want to analyze the search behavior of that period, in particular conspicuous queries that yielded early indications about the perpetrators. At the time the data was collected there were initial suspicions, but neither proof nor confessions. Since the case has now been at least partially solved, we can re-examine that data for its informational value and reliability.
It should be noted that this analysis draws on both the higher-resolution live data and the less precise historical data from Google Trends. We want to examine how this data maps onto confirmed events. The live data can no longer be reconstructed today given the long elapsed time frame.
Traces of preparation
Time of disappearance
Jamal Khashoggi disappeared on October 2, 2018 inside the building of the Saudi consulate in Istanbul. Turkish media reported that a 15-member special team from Saudi Arabia had already arrived a day earlier. We now examine whether the available data contains indications of possible pre-crime preparations.
To this end, we first analyze the search volume for his name in Saudi Arabia. Notably, searches for "Jamal Khashoggi" were already increasing before October 2, 2018.
Search via YouTube
It is also striking that searches were conducted not only through general Google Search but specifically on YouTube for video material on Khashoggi — possibly to make it easier to identify him later.
Crime scene: the consulate
On October 1 — that is, one day before the murder — an increased number of queries about the Saudi consulate in Istanbul were registered from Saudi territory. These could have been related to preparing a trip or visit. It is also conceivable, however, that targeted searches were made for current reports or developments concerning the consulate — possibly in anticipation of, or to monitor, the imminent events.
Reactions and observation
Press statement during the night of October 20, 2018
Up until this point, the Saudi royal family had denied any involvement in the murder of Jamal Khashoggi. In the early morning hours of October 20, 2018, however, it acknowledged co-responsibility for the first time via the state news agency SPA. The act was not described as deliberate but as an accident. Khashoggi had reportedly died during a "fistfight." The unusual nighttime publication time of the press release suggests that it was meant to attract as little public attention as possible.
Monitoring the foreign press
That Saudi users were taking an elevated interest in the international news cycle is also evident in the following figure. In the early morning hours of October 20, a striking increase in queries for "BBC" and "CNN" can be observed. This suggests targeted searches for current reports from international media — possibly to gauge the global reaction to the press release or to assess how the events were being covered relative to the official narrative.
Indications of a body double
On October 23, 2018, Turkish investigators announced that they had found indications of the use of a body double for Jamal Khashoggi. They presented corresponding video footage as supporting evidence. The body double was apparently meant to leave the consulate — in the hope of being seen by passers-by — in order to create the impression that Khashoggi had left the building alive and to conceal the actual act, in particular the dismemberment.
Notably, queries had already been registered in April 2018 that could indicate a targeted search for a body double. It should be noted, however, that the data basis on this question is not strongly pronounced.
Turkish investigators later identified the body double as Mustafa al Madani. This name had also been searched on Google in the preceding months.
Data outage after press conference
On October 23, 2018, the Turkish president presented central investigative findings in the Khashoggi case at an international press conference. Immediately afterwards, an abrupt data outage can be observed in Google Trends — suddenly, no search data was being delivered for the period after August 21, 2018.
The following chart clearly shows this break. Whether there is a causal connection between the publication of sensitive information and the disappearance of the data cannot be established conclusively — but the temporal proximity raises legitimate questions about transparency and possible influence.
Data was not only suppressed for Khashoggi-related queries, but for all search terms worldwide. Six hours later, Google again presented complete data.
Attempted erasure of digital traces
From October 15 onwards — five days before the admission — a striking increase can be observed in queries such as history.google.com, history.google.com delete and history.google.com delete all. This suggests targeted attempts to delete digital traces at Google. The clustering of such terms suggests an awareness of traceability and an effort to obscure any incriminating activity after the fact. So was it really not an accident?
What the data shows
For our investigation we evaluated both current live data and historical Google Trends data. The analysis shows that suspicious search patterns in Saudi Arabia were already discernible before October 2, 2018 — the day Jamal Khashoggi was murdered. These include increased queries about Khashoggi's person, the Saudi consulate in Istanbul, and later, terms related to deleting the Google search history.
Possible indications of a body double can also be substantiated by earlier queries. The patterns align in remarkable ways with the events later officially confirmed.
In hindsight, the collected data also pointed — even before the official Saudi admission of intent — to a planned, targeted operation, rather than to an unfortunate mishap or a spontaneous argument as initially claimed. The structure and temporal sequence of the search activity appear so coordinated that they could support the suspicion of deliberate preparation early on.
Importantly: it was not the individual queries themselves that were suspicious per se — terms such as "Jamal Khashoggi" or "consulate Istanbul" can be entirely legitimate in a political context. What was striking was the very targeted, moderate rise of these queries shortly before the act. This discreet clustering within a limited time window suggests operational work — aimed at avoiding attention while still obtaining the necessary information in advance.
It is also notable that no discernible effort was made to obscure the geographic origin of the queries. All conspicuous searches can clearly be traced back to Saudi Arabia. This could indicate either that the actors were not aware of the digital visibility — or that those responsible assumed the queries themselves would not raise immediate suspicion.
Equally striking is the complete data outage at Google Trends shortly after the Turkish president's press conference on October 23, 2018 — and not only with regard to the Khashoggi case, but for all search terms. Whether this was a technical glitch or a targeted data restriction remains open — but the temporal correlation is striking.
Critical examination of the data
In principle, all data provided by Google Trends should be critically scrutinized. This holds in particular when we are dealing with a very small number of queries. Could it be, for instance, that in reality "consulate istanbul" was only searched more frequently from Saudi Arabia on the day of the act, and not the day before? Are the data incorrect, or could there even be another reason for the increased demand?
We must always evaluate all data within a common context and with regard to their temporal stability. Queries should never be looked at in isolation. At the end of the analysis we do not find proof in the classic sense, but rather a recommendation for further investigation.
Overall, the investigation shows that Google Trends data — combining live and historical data — can be a promising tool for surfacing early digital warning signals. It does not replace a forensic chain of evidence, but it can play an important role in pattern recognition and hypothesis generation — especially in cases where attempts are being made to obscure events or control information.