A former member of Morocco’s domestic intelligence service has provided new details about the country’s alleged use of Pegasus spyware to monitor journalists, human rights defenders, dissidents and foreign officials.
The testimony suggests that Morocco’s Direction Générale de la Surveillance du Territoire (DGST) began using the Israeli-made surveillance software in 2017 and deployed it against high-value targets for several years.
Pegasus, manufactured by Israel’s NSO Group, can secretly access messages, emails, photographs and other data stored on a mobile phone. It can also remotely activate a device’s microphone and camera, effectively turning the phone into a surveillance tool.
NSO Group has repeatedly maintained that Pegasus is sold only to governments for use against criminals and terrorists. However, investigations have linked the software to the targeting of journalists, activists, diplomats and political figures around the world.
Morocco has consistently denied using Pegasus against critics at home or abroad and has challenged investigators to provide evidence linking the country to NSO Group.
Pegasus introduced to Moroccan intelligence
The latest findings are based partly on testimony from a former DGST officer using the pseudonym Safir, who reportedly worked for Morocco’s domestic intelligence service for almost a decade.
Two other former Moroccan intelligence officers are also said to have corroborated parts of the account, while leaked documents, targeting records and forensic analysis were used to examine Morocco’s alleged surveillance operations.
According to the investigation, senior Moroccan intelligence officers and technical specialists attended a demonstration of Pegasus at a villa in Rabat in 2017.
Representatives reportedly showed officials how the software could infect mobile phones remotely, activate cameras and microphones and extract private messages and data without requiring physical access to the device.
Those attending the demonstration are said to have immediately recognised the significance of the technology, which removed the need for intelligence officers to seize or physically tamper with a target’s phone.
Safir claimed that the expensive spyware may have been provided to Morocco through the United Arab Emirates, which had developed close security and intelligence ties with Rabat.
“The Emirates bought it and redistributed it to friendly services,” the former officer alleged.
The UAE authorities have previously faced accusations of using sophisticated surveillance technology against political opponents, activists and journalists.
Journalists and rights defenders allegedly targeted
Before acquiring Pegasus, Morocco’s intelligence services reportedly relied on traditional surveillance methods, including human informants, monitoring internet cafés and installing spyware on devices before they reached their intended users.
According to Safir, Pegasus was reserved for individuals considered particularly important after cheaper and less sophisticated surveillance methods had been exhausted.
“We never start with Pegasus,” the former officer said. “It’s the monster’s weapon.”
Four Moroccan mobile phone numbers were reportedly entered into the Pegasus system in September 2017 as part of initial testing. Two of the numbers were linked to DGST employees and may have been used to assess the software’s capabilities.
That same month, numbers belonging to Moroccan journalists and human rights defenders allegedly began appearing in targeting records associated with the spyware.
The surveillance operation is then believed to have expanded to include activists, officials and security personnel outside Morocco, particularly individuals connected to politically sensitive issues involving the kingdom.
Among those reportedly targeted was prominent Sahrawi human rights activist Aminatou Haidar, who campaigns for the independence of Western Sahara. Forensic investigators said traces of Pegasus were discovered on one of her phones.
Moroccan journalist and human rights groups have long accused the authorities of using surveillance, prosecution and intimidation to silence criticism of the monarchy, security services and Rabat’s control over Western Sahara.
Evidence points to Moroccan end-user
Further evidence linking Morocco to Pegasus reportedly emerged from legal proceedings brought by WhatsApp’s parent company, Meta, against NSO Group in the US.
Documents disclosed during the case included a list of codenames allegedly assigned to Pegasus customers. Former NSO employees reportedly confirmed that Morocco was an end-user of the software and had been assigned the codename “Morgan”.
The investigation also examined records associated with Pegasus accounts allegedly allocated to Morocco, finding that they had been used to select journalists, human rights defenders, political officials and members of foreign security services for surveillance.
One former DGST officer reportedly said the service monitored individuals even when there was no immediate suspicion of wrongdoing.
“We spy on everyone,” the former officer said, describing some of the surveillance as precautionary.
NSO Group was placed on a US government blacklist in November 2021 after Washington concluded that the company had acted against US foreign policy and national security interests.
Reports later indicated that the Israeli government had restricted the export of cyber-surveillance technology to several countries, including Morocco and the UAE.
Investigators said they had not found evidence of Pegasus-linked surveillance by Morocco after late 2021.
NSO Group says it investigates credible allegations of abuse and can suspend or terminate clients found to have misused its technology. The Moroccan government has continued to deny allegations that it used Pegasus to target journalists, activists or foreign officials.
