Morocco's Surveillance Machine: What Amnesty's Pegasus Files Show
Amnesty International accused Morocco's domestic intelligence service, the DGST, of unlawfully spying on journalists and human rights defenders with Pegasus spyware, hidden microphones and phones sold with malware already installed. The claim appears in Inside Morocco's surveillance machine, released Oct. 1, 2026, which covers operations between 2017 and 2021. Al Jazeera
The investigation is based on testimony from a former DGST employee, leaked documents and earlier reporting by journalists. Amnesty said it worked with 14 media organisations coordinated by Forbidden Stories. Amnesty hosts the full findings as document MDE29/1447/2026 and an executive summary as MDE29/1481/2026. Amnesty said it wrote to Moroccan authorities four weeks before publication.
Amnesty names the DGST as the agency that deployed Pegasus in Morocco against activists and journalists in that period. Pegasus is phone spyware that can secretly collect messages, photos, location and microphone audio without the user noticing. The central finding is a match. Amnesty said it linked 103 Moroccan phone numbers entered into the Pegasus system between September and December 2017 to named people.
Of those 103 numbers, 65 belonged to civil society members, including 34 human rights defenders and 22 journalists and media workers. Another 25 were political figures or officials. Five were diplomats or representatives of international organisations.
The report describes online spying paired with physical methods. Citing the whistleblower, Amnesty said microphones were hidden in the light fixtures in journalist Omar Radi's apartment. Shops sold mobile phones pre-infected with malware by DGST agents. Internet cafes were infected with remotely controlled spyware. Devices were physically tampered with at airports.
Amnesty also said it found evidence of spyware sent over the network of state-owned Maroc Telecom. Network injection, in simple terms, means diverting a person browsing the internet to install spyware without a clear warning. Amnesty said Morocco bought surveillance tools from companies based in Israel, the European Union and the United States. Amnesty called on Morocco to end the surveillance and on other states to stop spyware exports to Morocco until human rights safeguards are in place.
This report builds on earlier Amnesty work in Morocco that began in 2019. That October, Amnesty reported digital attacks using NSO Group spyware against two prominent Moroccan human rights defenders. In June 2020, it reported that Radi, a journalist critical of Morocco's human rights record, had been repeatedly targeted with Pegasus and with network injection attacks using NSO Group's tools. NSO Group is an Israeli company that makes spyware used against Moroccan targets. Amnesty
Moroccan authorities said in July 2021 they would investigate what they called unfounded allegations about spyware. NSO Group said reporting by media partners on spyware was full of wrong assumptions and uncorroborated claims. In November 2021, Israel shortened the list of countries that could buy cyber technology, barring Morocco, Saudi Arabia, Mexico and the United Arab Emirates from importing Israeli cyber tech. Morocco also instructed a lawyer to file a defamation case in a French court against two civil society groups behind Pegasus spyware allegations. Reuters
The broader context here is a change from single hacking attempts to a combined system. Amnesty's account links Pegasus selection, delivery through the telecom network, tampered phones in shops, infected cafes, airport access and microphones in a home as parts of one workflow. For experts who follow lawful interception, which means legally authorized access to communications, the combination is important. It suggests coordination across technical teams, logistics and people on the ground, so tracking could continue even if a target changed phones or networks.
Looking at what this means for export control diplomacy, the report pulls two levers at once. One is restraint by authorities in Rabat. The other is restraint by supplier countries on sales to Morocco until safeguards exist. Past scrutiny went beyond technical questions. It reached licensing policy, lawsuits and tension over intelligence cooperation. Export rules depend on proof of how tools are used. A named operator, a dated selection period and a matched list of 103 numbers give licensing officials a specific file to address.
In my view, the next questions will be practical and can be checked step by step. Will Moroccan prosecutors or parliament open an inquiry that can be verified. Will supplier states publish decisions to approve or deny sales. Will telecom regulators respond to the Maroc Telecom finding. Will courts in France or elsewhere accept new whistleblower and documentary evidence. Those checks do not require accepting every part of the whistleblower story at once. Logs, purchase records, forensic tests of infections and careful handling of leaked material can each be examined.
Looking beyond the findings, the stakes here for independent media are direct. When 22 journalists and media workers appear among 103 matched selections, the reported effect goes beyond reading one story. It puts pressure on sources, lawyers and families around a newsroom, and that pressure can work even without a prosecution. For diplomats and international staff also listed, the question widens to confidentiality of communications and protections under the Vienna Convention, the treaty that protects diplomats. Governments usually answer those cases quietly through formal complaints and intelligence channels, not press statements.
A note of caution is needed here about what is still uncertain. Amnesty's method leans heavily on one former insider plus leaked and press material that outside researchers cannot yet fully review. Moroccan authorities, in Amnesty's account, did not answer the pre-publication letter. NSO Group has previously disputed the assumptions behind Pegasus reporting. Past Israeli licensing changes were never explained by Morocco alone. Readers should keep those gaps in mind alongside the forensic detail, and look for responses that speak directly to the 2017 selection data and the Maroc Telecom finding.
