Morocco used Pegasus spyware to target human
A major investigation reveals Moroccan authorities systematically used Pegasus spyware and physical surveillance to monitor activists, journalists, and
Moroccan authorities used Pegasus spyware and physical device infiltration to secretly record and track human rights defenders and journalists between 2017 and 2021. A leaked dataset shows the surveillance operation targeted a wide range of dissenters, including activists, journalists, lawyers, academics, political officials, diplomats, and business people. The investigation matched 103 Moroccan phone numbers to specific individuals, detailing a systematic campaign of digital repression.
| Category | Number of Individuals |
|---|---|
| Human Rights Defenders | 34 |
| Journalists and Media Workers | 22 |
| Lawyers | 5 |
| Academics | 4 |
| Political Representatives or Officials | 25 |
| Diplomats or International Organization Representatives | 5 |
Amnesty International alleges Moroccan authorities operated a broad surveillance apparatus using digital and analogue tools to monitor critical voices. The DGST, or Direction Générale de la Surveillance du Territoire, is identified as the entity responsible for deploying the spyware. This surveillance was used alongside criminal prosecutions and judicial harassment, violating rights to privacy, liberty, expression, association, and peaceful assembly.
Mechanisms of intrusion
The operation combined multiple methods to gain covert access to phones. Physical infection of devices was a key technique. Agents arranged for phone shops to sell devices pre-infected with spyware and used physical recording equipment in private spaces like homes and offices. Surveillance also included intercepted calls, location tracking, and secret recordings in detention facilities, cars, cafes, and bedrooms. Neighbours of targeted human rights defenders were recruited as informants. Microphones were covertly implanted in private spaces, such as light fixtures in journalist Omar Radi's apartment.
Remote intrusions were equally sophisticated. Targets were infected through one-click and zero-click attacks, and via network-injection attacks through the national provider Maroc Telecom. The Pegasus spyware was deployed starting in September 2017, with staff from the vendor NSO Group conducting demonstrations for Moroccan authorities. In one instance, veteran activist Fouad Abdelmoumni was covertly filmed at home with his fiancée in 2021, and the video was circulated on WhatsApp.
Key actors and evidence
Findings were based on whistleblower testimony, leaked surveillance data, spyware-targeting records, vendor material, digital forensics, and interviews with ten surveillance targets. A whistleblower known as Safir, a former DGST employee, described the inner operations of the agency and detailed the tools and techniques used. Safir described the Abdelmoumni case as a textbook example of the DGST's surveillance and clean-up operation.
Amnesty International corroborated this testimony with independent sources and technical evidence. The organization documented the first Pegasus infection attempts in October 2019 targeting human rights lawyer Abdessadak El Bouchattaoui. Pegasus records show El Bouchattaoui's number was entered into Morocco's system on 19 September 2017 and repeatedly selected for targeting. The investigation was a collaboration with 14 media organizations coordinated by Forbidden Stories and built on work by imprisoned Moroccan journalist Hicham Mansouri.
Official denials and corporate links
Moroccan authorities deny using spyware to spy on citizens, but evidence from whistleblower testimony, leaked data, and spyware records proves otherwise. The investigation ties the spyware to several private surveillance technology firms. NSO Group, Hacking Team (now Memento Labs), Gamma Group, and FinFisher are named as companies connected to technologies purchased by Morocco. NSO Group internally codenamed Morocco as Morgen and provided training and tests of new capabilities to authorities.
In response to the findings, some vendors have made compliance statements. Verint stated it divested its relevant business line on February 1, 2021. Memento Labs stated it has no active contract with any Moroccan agency and has implemented an internal compliance program. Amnesty International's Secretary General, Agnès Callamard, said Morocco has wholly embraced techno-authoritarian practices to instill fear among activists and journalists. The organization is urging Moroccan authorities to cease the unlawful surveillance of human rights defenders and journalists.
