Amnesty Names Morocco's DGST as Operator of Pegasus Spyware
Amnesty International says Morocco's General Directorate for Territorial Surveillance (DGST) ran the country's Pegasus spyware operations.
That claim comes in a report titled "We Start With the Verdict: Inside Morocco's Surveillance Machine." It was produced with 14 media organisations and coordinated by Forbidden Stories. It draws on interviews with a whistleblower called Safir, described as a former DGST employee. Al Jazeera
How the targeting worked
Pegasus is a phone-surveillance tool made by the Israeli company NSO Group. Once installed, it can read messages and collect other phone data without the owner knowing. Like a wiretap for the smartphone age, it is hard to detect.
Amnesty says Morocco's Pegasus system was fully active by October 2017. It says the tool was used against activists and journalists between 2017 and 2021. From Pegasus records, Amnesty's researchers matched 103 Moroccan phone numbers to people listed as potential targets.
The steps were consistent, according to Amnesty. A number was entered into the system, marked for targeting, then sent a text message with a link designed to infect the phone.
Human rights lawyer Abdessadak El Bouchattaoui's case followed that sequence. His number was entered in September 2017 and marked for targeting weeks before he received an infection link by text. The report also details the cases of journalist and human rights defender Omar Radi, Fouad Abdelmoumni and Hicham Mansouri.
Amnesty's Security Lab examined Radi's phone in June 2020. Reuters reported at the time, citing Amnesty, that technology made by NSO Group had been used by the Moroccan government to spy on Radi. Radi now lives in Germany. Mansouri is a journalist in exile who was imprisoned in 2015 on charges of adultery and sexual exploitation.
A wider net and official response
Amnesty says phone hacking was part of a wider set of tools. A separate Amnesty news item, "How Morocco used surveillance web to silence journalists," centers on the whistleblower account. It says spyware, hidden microphones and infected phones were used to watch journalists, activists and rights defenders in Morocco. Al Jazeera
The full report describes a surveillance system that, according to Amnesty, lets authorities harass and discredit targets. Amnesty says surveillance of journalists and activists was often followed by smear campaigns in state-aligned media outlets.
Amnesty says it wrote to Moroccan authorities four weeks before publication and received no response. Moroccan authorities said in statements in 2020 and 2022 that Amnesty should provide material evidence for its Pegasus claims. On October 1, 2026, the Committee to Protect Journalists, speaking from New York, urged Moroccan authorities to immediately end unlawful surveillance of journalists after Amnesty's report. CPJ
The broader context here is attribution. Earlier Amnesty findings pointed to infections and targeting attempts. This report names an institution and adds an insider account. Safir describes internal process, while the forensic work provides numbers, dates and infection links. For people who follow wiretapping rules, export controls and oversight of intelligence agencies, that difference counts, because technical traces alone do not show which unit ordered an operation.
Looking at what this could mean for diplomacy, the next test is procedural. Amnesty and Forbidden Stories have published, and CPJ has called for an end to unlawful surveillance. Rabat previously asked for material evidence and, according to Amnesty, did not reply to the pre-publication letter. That leaves two public records side by side. Governments, courts and international bodies that work with Morocco must now decide whether the Safir testimony and the 103-number analysis justify reviews, questions or court filings. Journalists in exile are watching closely. Past joint investigations into Pegasus suggest more country-specific reports could follow, with each newsroom pursuing its own list.
