Moroccan intelligence services targeted at least 250 Spanish phone numbers using Pegasus spyware, developed by Israel's NSO Group. The operation involved attempts to access data from devices belonging to various individuals within Spain, noting a sophisticated and extensive surveillance campaign. The spyware used was confirmed to be Pegasus, a product of the Israeli firm NSO Group, known for its advanced capabilities in phone surveillance. The use of Pegasus spyware by Moroccan intelligence has been a subject of international scrutiny and concern, raising questions about digital privacy and state-sponsored espionage.
Moroccan Espionage Network Details
The Directorate General of Territorial Surveillance (DGST), an internal intelligence service headed by Abdellatif Hammouchi, managed the espionage operations. This central role of the DGST shows the institutional nature of the surveillance activities. Responsibility for operations targeting high-level figures, such as members of the Spanish government or French President Emmanuel Macron, was attributed to Fouad Ali El Himma, an advisor to King Mohammed VI, indicating a potential high-level directive for these sensitive targets. While the Moroccan external intelligence service (DGED) did not possess the Pegasus program itself, it reportedly suggested targets to the internal intelligence service, according to various reports, illustrating a coordinated approach between different branches of Moroccan intelligence.
Beyond government officials, other individuals targeted in the operations included prominent figures perceived as critical of Moroccan policies or influential in regions of strategic interest. These included journalist Ali Lmrabet, Sahrawi activist Aminatou Haidar, and Sahrawi writer and academic Mohamed Bashir Lahsen. Polisario Front officials were also among those whose phones were reportedly targeted by the spyware, reflecting Morocco's long-standing dispute over Western Sahara. These revelations indicate a broad scope of surveillance activities, encompassing various sectors and individuals perceived as relevant to Moroccan interests, from political dissidents to activists and journalists. The DGST's involvement as the managing entity notes the internal intelligence apparatus's central role in these alleged operations, demonstrating a concerted effort to monitor and potentially compromise communications of specific individuals.
Investigation and Technical Context
The extensive investigation into these alleged activities was conducted by the Spanish newspaper El Confidencial, in collaboration with 14 other European media outlets, and was coordinated by Forbidden Stories. This collaborative effort brought together journalistic resources from across the continent to uncover the details of the spyware use. Amnesty International's Security Lab provided key technical support for the investigation, lending its expertise in digital forensics to analyze the evidence. This inquiry revealed a staggering 768 attempted hacks using the Pegasus spyware, showing the scale of the surveillance efforts. Among those targeted was Moroccan journalist Hicham Majdoubi, who faced a particularly intense barrage of 42 hacking attempts. Algerian diplomats accredited in Madrid at the time were also identified as targets, including former ambassador Taous Ferroukhi, indicating a reach extending to diplomatic personnel from neighboring countries.
The period of these attempted hacks was specifically identified as between May 2018 and June 2019. The investigation clarified that the scope of its findings related to attempted access rather than confirmed breaches for every case. "The data available indicates attempted hacks, not necessarily successful ones, as proving actual infection requires a digital forensic examination of each device individually," the investigation stated, emphasizing the technical distinction between an attempt and a confirmed compromise. This nuance is critical for understanding the nature of the findings.
Broader Implications and Reach
The implications of these findings are broad, affecting international relations and the security of digital communications. A judicial investigation overseen by Spanish judge José Luis Calama later confirmed the hacking of Prime Minister Pedro Sánchez's phone, along with those of several ministers, indicating that some of these attempts were indeed successful at the highest levels of the Spanish government. Morocco reportedly continued its use of Pegasus spyware until the end of 2021, suggesting a sustained and prolonged campaign of digital espionage. The espionage campaign by Moroccan intelligence services extended far beyond Spain, encompassing over 12,000 phones across more than twenty countries, illustrating a global footprint for these surveillance operations. This broader reach notes the significant capacity and intent of Moroccan intelligence to conduct widespread digital surveillance on an international scale.
