Whistleblower revives Moroccan Pegasus spyware claims in Spain

A new whistleblower investigation has provided a fresh insight into Morocco’s alleged use of the Israeli-made Pegasus spyware, reviving previous allegations that more than 200 Spanish phone numbers were selected as surveillance targets during the 2021 Pegasus Project and the subsequent 2022 spyware scandal.

The investigation’s latest update, published by Forbidden Stories, a non-profit investigative journalism organisation, is based on testimony from a former Moroccan intelligence officer who claims Morocco’s domestic intelligence service operated Pegasus against journalists, dissidents and other high-interest targets. According to The Guardian on July 16th, the testimony provides the first detailed insider account of Morocco’s alleged deployment of the spyware.

The group collaborated with Amnesty International’s Security Lab, relying on the account of a Moroccan whistleblower from the Direction Générale de la Surveillance du Territoire (DGST), known as “Safir,” and corroborated some of his claims using intelligence documents.

It further revealed that four Moroccan mobile phone numbers were infected with Pegasus in September 2017, likely to test the system within Morocco. Two of the numbers were associated with DGST staff members, probably used to evaluate the spyware’s capabilities.

Pegasus is spyware developed by the Israeli cyber-intelligence company NSO Group that allows users to access all data on a target’s mobile device, remotely activate the phone’s microphone and camera, transforming the device into a listening and surveillance tool.

While NSO Group states that Pegasus is sold exclusively to governments for tracking criminals and terrorists, allegations suggest that several countries have used the spyware to target dissidents, journalists, diplomats, and politicians, according to Forbidden Stories reports.

Morocco has consistently denied employing Pegasus to target critics both foreign and domestic, asserting in an official statement that journalists investigating NSO Group were “incapable of proving [the country had] any relationship” with the company.

According to the Forbidden Stories investigation, whistleblower Safir alleges that Morocco acquired Pegasus in 2017, and that the country’s internal security services began using Pegasus that same year, deploying it domestically and internationally for four years.

Spain occupies a unique position in the Pegasus story because it hosts Europe’s largest Moroccan diaspora, many of whom include journalists, activists and political dissidents who have been critical of Rabat. The country has also seen a rise in right-wing parties’ support as grievances with immigration rise. Many Moroccan journalists, activists and political dissidents have relocated to Spain over the past two decades, making the country a recurring focus of allegations that Morocco conducted surveillance overseas.

The Pegasus Project revealed that more than 200 Spanish mobile numbers were identified as potential targets of a user believed to be based in Morocco.

In May 2022, the Spanish government announced that both Prime Minister Pedro Sánchez‘s and Defence Minister Margarita Robles’s phones had been infected with Pegasus spyware in May and June 2021.

Spain’s interior minister, Fernando Grande-Marlaska, as well as its agriculture minister, Luis Planas, also had their phones targeted.

The leaked database at the centre of the Pegasus project investigation revealed that Moroccan journalists’ and human rights defenders’ numbers were entered into the Pegasus system that same month, September 2017, with Morocco eventually moving onto international targets.

Forensic examinations by Amnesty later confirmed Pegasus infections on many devices examined, though not every number on the leaked list corresponded to an infected phone.

One included the Spanish number of Aminatou Haidar, a human rights activist from Western Sahara, whose name appeared on a list believed to have been targeted by Pegasus dating back to 2018. In November 2021, traces of spyware were found on a second phone belonging to Haidar.

Ignacio Cembrero, a Spanish journalist whose work focuses on the Maghreb, was also listed in the Pegasus Project database. Forensic analysis found that Pegasus was not on the device at the time of examination, as reported by El País.

Despite allegations linking Spanish phone hacking to Pegasus, diplomatic ties remain intact. Last year, Grande-Marlaska awarded Abdellatif Hammouchi, the DGST director general, the highest honour bestowed by Spain’s Guardia Civil, a gendarmerie under both the interior and defence ministries. However, a Guardia Civil union criticised the decision, claiming that awarding someone accused of human rights violations and international espionage was an insult to the force’s officers’ dignity.

The allegations echo allegations published about France, where the same Forbidden Stories investigation reported that around 1,000 French phone numbers, including those of senior government ministers and journalists, were identified as potential Pegasus targets allegedly linked to Moroccan interests.

 Adding fuel to the fire, Forbidden Stories has reported that leaked documents, photos, and testimonies from Spanish security personnel and a former Moroccan intelligence agent indicate that the DGST employed its technical skills to intercept communications of Guardia Civil officers visiting Morocco to exchange counter-terrorism expertise. One senior Guardia Civil officer’s personal phone number appears five times on the list of Pegasus surveillance.

A former DGST officer told the Forbidden Stories consortium that such targeted surveillance is done “just in case” and that “We spy on everyone.”

The Guardian and agencies, Forbidden stories and agencies, El País and agencies, Maghrebi.org