A former member of Morocco’s internal security apparatus has provided a rare glimpse into the North African kingdom’s alleged use of Pegasus spyware to monitor high-level European politicians, activists, and members of the press.
The whistleblower, operating under the pseudonym Safir, claimed the Direction Générale de la Surveillance du Territoire (DGST) began deploying the software in 2017 against both domestic and international targets, reports Guardian.
Safir’s testimony is a central component of a collaborative investigation by 14 media outlets, including the Guardian, Le Monde, and Haaretz, supported by technical analysis from Amnesty International’s Security Lab.
The report, titled “the Pegasus Project: Inside the Moroccan Spying Machine,” details how the NSO Group’s technology allowed operators to covertly extract data from mobile devices and remotely control cameras and microphones.
According to the whistleblower, who served in the DGST for nearly a decade, the United Arab Emirates originally provided the prohibitively expensive software as a gift. Safir likened the arrangement to a shared digital subscription, where the UAE paid for the service and permitted allied agencies to use the account.
Within the agency, Pegasus was reportedly dubbed the “monster’s weapon,” reserved for high-priority targets after traditional surveillance methods, such as using pre-infected phones or monitoring internet cafes, had failed.
The investigation’s findings suggest a significant focus on Spanish interests, with over 200 mobile numbers in Spain selected for potential surveillance.
In 2022, the Spanish government confirmed that the devices of Prime Minister Pedro Sánchez and Defence Minister Margarita Robles were compromised in 2021. Other identified targets included the Spanish interior and agriculture ministers, as well as Western Saharan activist Aminatou Haidar and journalist Ignacio Cembrero.
Revelations of the DGST allegedly targeting Guardia Civil officers have caused friction. Spanish security officials expressed a sense of “betrayal,” noting that they did not take defensive measures because they viewed Morocco as a counter-terrorism ally.
This controversy was further heightened when Spanish Interior Minister Fernando Grande-Marlaska recently awarded DGST’s director general, Abdellatif Hammouchi, a high-ranking medal, a move condemned by some within the Guardia Civil due to the spying allegations.
While Morocco has consistently denied any involvement with NSO Group, internal documents from the Israeli firm reportedly used the codename “Morgan” for the country. Following the US blacklisting of NSO Group in late 2021, Israel’s defence ministry restricted cyber-exports to Morocco and the UAE. There has been no documented evidence of Pegasus activity linked to Morocco since that time.
