Berrak Chadi Abdesslam: Cyber security, a challenge for Moroccan intelligence

The rapid changes in the contemporary international security landscape coincide with the consolidation of cyberspace as a fundamental arena for geopolitical interaction, where the ambitions of regional powers intersect with states’ sovereign defense strategies.

In this context, targeted digital attacks and systematic disinformation campaigns have become alternative tools in traditional conflicts, aimed at destabilizing states by attacking their vital data and attempting to undermine citizens’ trust in their official institutions. 

This complex international situation compels emerging powers, led by the Kingdom of Morocco, to adopt hybrid defense strategies that combine operational rigor on the ground with high-level technological vigilance to safeguard their national security and preserve their diplomatic and sovereign achievements in a regional environment characterized by intense rivalry and ongoing instability, making cohesion between society and sovereign institutions the first line of defense against these cross-border threats.

An in-depth analysis of Morocco’s geopolitical position reveals that successive diplomatic successes regarding territorial integrity, coupled with Rabat’s increasingly central role as a strategic partner of international powers in the Mediterranean basin and across Africa through the Royal Atlantic Initiative, have created a state of unease among hostile parties.

Targeted digital attacks and systematic disinformation campaigns have become alternative tools in traditional conflicts, aimed at destabilizing states by attacking their vital data and attempting to undermine citizens’ trust in their official institutions. 

This situation has led them to shift their battles to the digital realm and to activate mechanisms of targeted algorithmic amplification. Within this framework, national technical surveillance is structured in accordance with the Moroccan legislative framework set forth in Law 05.20 on cybersecurity, supported by the key role of the General Directorate for Information Systems Security (DGSSI), alongside the General Directorate of Territorial Surveillance and the General Directorate of National Security (DGSN-DGST), as well as Morocco’s other sovereign agencies, with the aim of imposing a comprehensive digital deterrent that thwarts strategies of cognitive manipulation and social engineering at their source.

In this tense context, dominated by cognitive warfare, the weakness of the narratives crafted in regional disinformation laboratories becomes evident. The claim regarding the alleged disclosure of lists containing the names of seventy thousand members and collaborators of Moroccan intelligence within Europe falls within the realm of conceptual excess and operational inconsistency. Subjecting this unrealistic figure to the criteria of reason, logic, and the rules of international intelligence operations demonstrates its complete disconnect from reality and from the operational depth of states. From a logistical and professional perspective, it is impossible to manage or centralize a group of this magnitude in a single database or under a unified operational framework without violating the fundamental principles of rigorous intelligence work.

The peculiarity of these claims and their disinformative nature are accentuated when contrasted with the reality on the ground and the well-established historical role of Moroccan security services in preserving national and continental security. Far from these imaginary figures concocted for mobilization purposes, Moroccan intelligence operates in Western and European capitals under the legitimacy of strategic cooperation and cross-border intelligence coordination protocols. In this regard, the accurate intelligence and preventive actions provided by Rabat to its European partners have served as a true safeguard, enabling various Western capitals to avert tragic scenarios and imminent terrorist plots that threatened the safety of their citizens and critical infrastructure.

This measured and reliable Moroccan presence—whose reliability is recognized and commended by top security officials across Europe—is precisely the element that adversaries are attempting to distort by turning a security alliance designed to save lives into a pretext for spreading rumors. Such an attitude lays bare the level of disarray plaguing hostile sectors, which have resorted to excessive exaggeration and digital amplification to compensate for their inability to come to terms with the solidity, structural resilience, and indisputable international reputation enjoyed by the sovereign institutions of the Kingdom of Morocco.

The Sovereign Surveillance Statement: A Technical Analysis of the Inconsistency of External Allegations

The statement issued by the General Directorate of National Security and the General Directorate of Territorial Surveillance reflects the operational readiness of the Moroccan security system and marks a new phase in the hybrid confrontation, which goes beyond the traditional framework to target Morocco’s intangible capital, represented by institutional trust.

This official clarification offers a technical analysis that debunks baseless arguments and exposes the falsehood of circulating reports regarding alleged intrusions into sovereign bases—reports that certain external hacking groups known for their hostility, such as the cyber organization Jabaroot in coordination with regional platforms, attempted to spread through the alleged leak of lists including seventy thousand security personnel, in an attempt to forcibly link the Kingdom’s defense system to the management of migratory pressure at the Ceuta border post.

Field analyses reveal that the published personal data consists of nothing more than outdated information compiled from service sectors and private medical and social welfare institutions, misused to falsely attribute a law enforcement nature to it. The structural deficiencies in the documents presented—evident in military ranks that do not conform to local doctrine, uniforms unfamiliar to the Moroccan system, and obvious linguistic errors—confirm the absence of the minimum requirements for coherence and plausibility. 

This attempt is linked to narrow regional calculations aimed at undermining the Kingdom’s international prestige as a hub of security and stability; however, legal and technical oversight—grounded in the strict separation of sensitive systems through the total physical isolation protocol (Air-Gapping) and the rigorous application of compartmentalization architecture (Information Silos)—prevents the success of such maneuvers and confirms the strength of Morocco’s cyber deterrence in defending the State’s higher interests.

Politicized Digital Amplification and the Production of Sensationalism in Hostile Environments

The information architecture employed by certain media outlets intersects with schemes of manipulated digital piracy, exposing the nature of operational coordination aimed at the commercialization of false content through the process scientifically known as the systematic recycling of altered materials. These environments go beyond simple news coverage to deliberately invest in mechanisms of targeted algorithmic amplification, through the rapid collection of the rumor regarding the “seventy thousand names” and its reintroduction as definitive data, while omitting internationally recognized professional verification protocols—in particular the standards of the International Fact-Checking Network (IFCN).

This hybrid process can be broken down into an integrated operational sequence that begins with the collection and manipulation phase, involving the merging of old administrative and welfare databases along with the creation of fictitious lists to produce raw material with a police-like appearance. Next, a direct cyber launch is carried out by disseminating this data through channels linked to the Jabaroot organization on the Dark Web, with the aim of creating the illusion of unauthorized access to sovereign systems.

Subsequently, algorithmic pressure is activated by using thousands of automated accounts to intensify interaction and force social media platform algorithms to place the manipulated content among the most visible trends.

This organized flow culminates in politicized media manipulation carried out by internationally renowned platforms such as Le Monde, El Español, El País, El Confidencial, and La Razón, which make their platforms available to serve opposing regional agendas, aligning their objectives with those of separatist sectors. These media outlets proceed to contextualize the cited figure in order to artificially link it to the management of migration flows in the Ceuta area, seeking to exert communicative and political pressure on European partners, before revealing their ultimate objective: to escalate the digital discourse toward a call for the dismissal of senior security officials, in an attempt to undermine institutional trust, disrupt Morocco’s security framework, and weaken its deterrence capabilities to benefit regional agendas, terrorist organizations, and separatist groups.

This convergence of media disinformation and digital disruption transforms such platforms and media into active communication tools within hybrid cognitive warfare, where techniques for manipulating conceptual frameworks and repeating deceptive narratives are employed to sow uncertainty and generate an artificial state of security anxiety aimed at altering the perceptions of international partners and influencing public opinion.

However, these schemes are ultimately neutralized by the sovereign response expressed in the surveillance statement issued by the joint task force of the General Directorate of National Security and the General Directorate of Territorial Surveillance, which activates technical and legal deterrence mechanisms and confirms the absolute impossibility of such assertions, thereby safeguarding Morocco’s intangible capital and institutional cohesion under the leadership of King Mohammed VI.

The International Intelligence Doctrine and the Rules of Structural Separation

Scientific analysis and academic evaluation grounded in international intelligence doctrine lead to the refutation of the structural foundations of the figure presented, demonstrating its impracticability from both a logical and operational standpoint. From an organizational perspective, the concentration of such a large number of alleged members represents a contextual construct that directly contradicts the network-based distribution models and field operational standards characteristic of sovereign agencies.

In this context, the security standards applied internationally—notably the security policy document of the North Atlantic Council (NAC), reference C-M(2002)49, dated June 17, 2002—rule out the possibility of unified records of this magnitude existing in shared computer databases, given that sensitive administrative systems are subject to the “need-to-know” (Need-to-Know) principle. This protocol technically prohibits the integration of operational identities into a single, cross-accessible digital space and requires strict informational separation between the various operational units.

For its part, the book Silent Warfare: Understanding the World of Intelligence, by the American specialists Abram Shulsky and Gary Schmitt (affiliated with the Department of Defense and the U.S. National Security Council), constitutes a key academic reference in the analysis of the operational doctrine of contemporary security and intelligence services.

Specifically in the chapters devoted to counterintelligence, the authors argue that the sovereign protection of institutions is not based on safeguarding databases after they have been unified, but rather on preventing their consolidation through a compartmentalization architecture (Information Silos). The functional division examined in the work imposes a complete operational and horizontal separation that prevents the formation of any centralized digital repository containing the identities of personnel, since an officer assigned to a specific unit lacks the security and technical authorization to access the identity of an agent stationed in another structure.

In light of this international doctrine, the rejection of the veracity of the alleged unauthorized access is based on the prior absence of a common digital repository within the state structure; that which cannot be organically grouped cannot be digitally exposed. The data released reveals a conceptual confusion on the part of its promoters between primary administrative data (Raw Data) and processed intelligence products (Intelligence Product)—concepts that are clearly distinguished in the specialized literature.

The published lists consist solely of civil service records compiled from public sectors, organized through tactics of deception and targeted disinformation (Deception) designed within the framework of psychological warfare to generate mistrust among international partners and insinuate the existence of vulnerabilities in joint coordination structures.

These structural elements neutralize the intended impact of such campaigns in light of the rigorous verification standards of the contemporary international arena, which is aware of the nature of the protection protocols applied in the Kingdom of Morocco—based on the strict physical isolation (Air-Gapping) of sensitive databases from open networks, safeguarding the operational identity of the security institution and depriving these actions of the ability to alter regional geopolitical balances or affect Morocco’s intangible capital.

The Reality of the Figures and Flows: Debunking the Narrative in Light of Operational Logic

The disproportion and structural flaw in the alleged figure of seventy thousand names become evident when this number is subjected to models of international financial governance, the defense economy, and the standards for managing cross-border intelligence operations. From an operational perspective, an analytical comparison with the control and span of control standards documented in the 2004 official records of intelligence committees published in the U.S. Government’s Federal Register (GovInfo) demonstrates that international standards impose a strict oversight limit, set at one Case Officer for every three or four collaborators at most, in order to avoid compromising networks and ensure the security of information flows.

This convergence of media disinformation and digital disruption transforms such platforms and media into active communication tools within hybrid cognitive warfare.

Applying this metric to the management of an operation of the alleged scale, would require the recruitment and management of approximately twenty thousand case officers abroad, which would entail an annual operational cost exceeding four billion U.S. dollars, in accordance with the parameters contained in the November 2017 reports of the U.S. Office of the Inspector General (OIG) on the cost structure of sovereign agencies and the assessment of international logistical allocations.

This approach aligns with the argument developed by the specialist and former director of analysis at the CIA, Mark Lowenthal, in his book Intelligence: From Secrets to Policy, where he demonstrates that the management of the intelligence resource cycle (Resource Management) is subject to strict budgetary constraints that prevent the allocation of unaccounted-for funds (Black Budgets) without creating perceptible imbalances in the public accounts of states. This same conclusion is shared by Professor Michael Warner in his research on security governance, as he points out that sovereign agencies cannot isolate their logistical flows from the state’s general budgetary system.

The citation of these metric models and international reports—including the standards of the International Monetary Fund (IMF eLibrary, 2022), publications by the European Union Institute for Security Studies (EUISS, May 2015), and defense cost analyses by the RAND Corporation—does not constitute a mechanical transposition onto the system of the Kingdom of Morocco, but rather their use as an analytical verification tool to demonstrate the mathematical unfeasibility of the proposed scenario.

If the budgetary capacities of major powers and international financial governance frameworks confirm the technical impossibility of managing an operation of such magnitude or mobilizing such financial resources without generating an accounting record (Financial Footprint) reflected in the balance of payments, channeling or concealing such flows within the framework of Morocco’s Finance Act is unfeasible from both an operational and financial standpoint.

This impossibility is confirmed by an examination of studies on security resource management published by the International Monetary Fund in October 2021 (IMF Book), the guidelines on contingency funds contained in the U.S. Army TJAGLCS (2024) regulatory manual, and analyses of budgetary governance in the defense sector published on ResearchGate. These sources agree that the regulations of the Financial Action Task Force (FATF) and the controls of the international banking system prevent the concealment of monetary flows on that scale. Consequently, the budgetary formulation of the cited figure lacks economic consistency and falls outside the principles of resource management in security doctrines, which neutralizes the impact of this narrative and invalidates it in light of the requirements of the international financial system and the constitutional governance norms of the Kingdom of Morocco.

Institutional Deterrence and Challenges to Sustainable Sovereignty

A detailed analysis of the scope of these campaigns and the extent of digital manipulation reveals the lack of effectiveness of cyberattacks in the face of the robustness of the Moroccan state’s sovereign structures.

READ: Osama al-Sharif: Will Jordan block Israel’s annexation of the West Bank?

The diminished impact of the disseminated information and the invalidity of documents produced in hostile environments—when measured against technical rigor, network isolation protocols, and international financial governance standards—confirm the effectiveness of the Kingdom’s security doctrine and the capacity of its institutions to neutralize attempts at interference.

In the realm of sovereign reassertion, the statement issued by the General Directorate of National Security and the General Directorate of Territorial Surveillance consolidates Morocco’s institutional position through a clear and direct approach, going beyond a merely defensive response to neutralize narratives of vulnerability and dismantle their objectives in their initial phase.

In light of these factors, the Kingdom of Morocco’s strategic position as a key player in the region is reaffirmed, underpinned by cohesion among institutions and society under the leadership of King Mohammed VI, where national stability and intangible capital are consolidated as central elements in the face of actions aimed at disrupting the institutional order.

The views expressed in this article belong to the author and do not necessarily reflect the editorial policy of Maghrebi.org. Berrak Chadi Abdesslam is an expert in strategic planning and crisis management based in Morocco. This article was originally published in Atalayar.

If you wish to pitch an opinion piece, please send your article to opinion@maghrebi.org.