Moroccan intelligence accused of spying on journalists and human rights activists

Amnesty said in their report released on Thursday that the apparatus operated by Morocco's domestic intelligence agency – the Direction Générale de la Surveillance du Territoire (DGST) – included Israel's Pegasus spyware.

It also said phones were deliberately infected with malware and surveillance cameras secretly installed in private homes, and found there had been systematic interception of telephone calls.

The report draws on testimony from a former DGST employee, digital forensic evidence and internal documents from surveillance technology companies, including NSO Group, Hacking Team and Verint.

The Moroccan authorities have repeatedly denied using Pegasus and maintain that they respect the confidentiality of private communications.

France-Morocco rapprochement overshadowed by fresh Pegasus spying claims

A web of surveillance

The former DGST employee, identified by Amnesty under the pseudonym Safir, described an intelligence operation ranging from sophisticated remote hacking to methods requiring physical access to a target.

According to his testimony, journalists and activists were secretly filmed and recorded while in detention, in offices, cars and cafés – and even in their bedrooms.

Telephone calls were routinely intercepted and location data used to track targets and their associates, Amnesty said.

Safir also described arrangements with second-hand phone shops through which DGST agents could supply apparently new devices that had already been infected with spyware, giving the authorities access to their users' communications.

Amnesty said the DGST also relied on cooperation from at least one Moroccan telecommunications provider.

Its investigation found that some Pegasus attacks were carried out through “network injection”, allowing targeted devices to be redirected towards spyware infrastructure while connected to the Maroc Telecom network.

The report says Morocco also purchased other surveillance systems over more than a decade.

The DGST and Morocco's High Council for National Defence had contracts from at least 2009 with the Italian company Hacking Team, while Morocco also purchased Verint's Reliant surveillance platform in 2014, according to internal records cited by Amnesty.

Israel, Morocco agree to open embassies, step up cooperation after US talks

Pegasus targets

Amnesty said its analysis provided further evidence that the DGST began using NSO Group's Pegasus spyware from September 2017.

Pegasus can give an operator extensive access to the contents of an infected smartphone, including messages, photographs, location information and the phone's microphone and camera.

Internal NSO documents disclosed during a US court case involving WhatsApp and its parent company Meta identified the Moroccan customer under the codename “Morgen”, Amnesty said.

Amnesty identified 103 Moroccan phone numbers entered into the Pegasus system between September and December 2017, including dozens belonging to human rights activists, journalists, lawyers and academics. It said the evidence showed civil society figures were among the DGST's priority targets.

The NGO said Morocco used Pegasus between 2017 and 2021 and possibly later. 

It called for an independent investigation into the DGST and urged governments to halt exports of intrusive surveillance technology to Morocco until stronger safeguards are in place.

(with newswires)