- Ex-security agent provides rare first-hand insight into how Morocco surveillance system works from the inside.
- Targets secretly recorded in detention, offices, homes, cars and airports
- Intelligence services conspired with phone shop owners to sell phones pre-infected with spyware
Authorities in Morocco operate an expansive and vast surveillance apparatus that combines digital and analogue tools to track, monitor and ultimately silence journalists, activists and other critical voices, Amnesty International said in a new report.
We start with the verdict: Inside Morocco’s surveillance machine reveals how Moroccan authorities use unlawful surveillance to target human rights defenders, journalists and other dissenting voices and subject them to criminal prosecutions, judicial harassment and other forms of repression in violation of their rights to privacy, liberty, and freedom of expression, association and peaceful assembly.
“Morocco has wholly embraced techno-authoritarian practices, acquiring a wide range of surveillance technologies to establish and enable a repressive system specifically designed to instill fear among human rights activists and journalists, silence their voices and obstruct their work inside and outside Morocco,” said Agnès Callamard, Amnesty International’s Secretary General.
Morocco has repeatedly denied using spyware to spy on its citizens. However, new evidence obtained by Amnesty International including whistleblower testimony, leaked surveillance data, government spyware targeting records and material from companies selling surveillance tools proves the opposite. Drawing on this evidence, the organization documents not only the range of tools and techniques used to target dissent, but the web of international vendors providing them.
“Our report provides the most detailed picture to date of the tools deployed by the Moroccan authorities, such as high-tech spyware, audio bugging systems and trackers to spy on journalists, human rights defenders and other individuals. Morocco’s surveillance tools are purchased from corporate actors based in Israel, the EU and the United States of America, and including NSO Group, the now defunct Italian spyware company Hacking Team, now known as Memento Labs, and the British-German network of companies Gamma Group and FinFisher.
Agnès Callamard, Amnesty International’s Secretary General
“This is another demonstration of a global economy of techno-oppression, enabled by companies and States failing to uphold their obligations under international law.
“This repressive ecosystem makes it difficult, and dangerous for people in Morocco to exercise their rights to freedom of expression, association, and peaceful assembly. Even after they have been released from prison, they continue to live under the shadow of surveillance and are subject to smear campaigns with private details that can only be obtained through surveillance. Moroccan authorities must immediately end the unlawful surveillance of human rights defenders and journalists,” said Agnès Callamard, Amnesty International’s Secretary General.
Forensic evidence unearthed by Amnesty International demonstrates how human rights defenders were targeted using multiple infection methods, including physical infection of devices; 1-click attacks, which typically rely on the victim clicking on a malicious link; zero-click attacks, which can infect a target without them having to click a link, or take any action; and network injection attacks, delivered via the state-owned Maroc Telecom network.
A whistleblower at the heart of Morocco’s surveillance system
Amnesty International had previously published the first ever forensic evidence confirming Pegasus spyware infections of the mobile phones of human rights defenders and activists in Morocco.
This new report now identifies the Direction Générale de la Surveillance du Territoire (DGST), as the entity responsible for the deployment of Pegasus spyware in Morocco, and the extensively documented abuses of Pegasus against activists and journalists between 2017 and 2021 despite previous denials by Moroccan authorities.
A whistleblower, known by the pseudonym Safir, is a former DGST employee. In multiple interviews conducted over several years, he described the inner operations of the DGST and detailed the wide range of surveillance tools and techniques used by the agency. Amnesty International corroborated key aspects of Safir’s testimony with independent sources, technical evidence and interviews with human rights defenders.
By combining the first-hand accounts of the DGST insider with digital forensics research, interviews with ten targets of surveillance, and leaked data on both surveillance operations in Morocco and range of surveillance technology suppliers, Amnesty International is able to provide one of the most detailed and revealing accounts of state surveillance operations, while contextualizing spyware abuses as one tactic situated inside a wider system of surveillance and control.
Safir described how personal devices are compromised. Targeted individuals are secretly filmed and audio recorded while in detention, in their offices and cars, at cafes, and even inside their bedrooms. Phone calls are routinely intercepted. Location data is tracked, exposing the daily movements of activists and their associates. Safir described how phone shops were co-opted to sell mobile phones pre-infected with spyware by DGST agents, and how neighbours of targeted human rights defenders are recruited as informants.
These tactics do not only affect the targeted activists, but also extend to families, friends and professional networks. Agents operate without judicial oversight or accountability and target activists in secrecy and with impunity.
“The tools they use are wide-ranging, but the goal is clear: to blackmail, discredit, shame and, if necessary, unjustly imprison those who speak out in defence of human rights in Morocco,
Rebecca White, Amnesty International Security Lab Researcher.
“Ultimately, for human rights defenders in Morocco, there is virtually nowhere to hide and no way to escape the state’s all-encompassing web of surveillance, which even extends beyond Morocco’s borders.”
How the DGST targets activists
Morocco’s surveillance operations are primarily executed by the DGST. While many advanced digital surveillance techniques can be conducted remotely, the DGST has also relied on physical infection of devices as a key surveillance method against journalists and activists.
In his testimony, Safir said these methods were routinely deployed against individuals transiting through Morocco’s airports, as well as through arrangements to covertly supply “new” devices to targeted individuals via secondhand phone vendors. These phones appear new and unused, but when activated give authorities full access to the individual’s entire communications.
“We infected so many internet cafés with Remote Controlled Spyware (RCS). The field agents tell us which cybercafé the target is visiting, and we had visibility on what they were doing because we had previously infected all the machines there,” Safir said.
RCS spyware allows the operator to track calls, read messages, access photos and record audio.
Once a person is marked as a surveillance target, the DGST has an array of tools at its disposal, including advanced digital targeted and mass surveillance technologies. Beyond telephone surveillance, authorities covertly planted microphones and other recording devices in private spaces to capture conversations.
Journalist Omar Radi, who faced years of harassment and later imprisonment because of his work on corruption and human rights violations, was targeted using this method. Safir described them as small microphones operating wirelessly via encrypted radio transmission, implanted in his apartment’s light fixtures.
Human rights defenders also face surveillance, criminal prosecution and smear campaigns based on information they believe has been obtained through surveillance. These campaigns are deployed through state-aligned media platforms, often meant to delegitimize or stigmatize activists in Moroccan society.
“As soon as I speak in public, as soon as I write a Facebook post, as soon as I put something out on Instagram, they scrutinize my every move, they insult me. They’re not media – they’re tools of terror,”
Omar Radi.
The suspicion that private and domestic spaces have been intruded has a profound psychological impact on human rights defenders.
In 2021, veteran human rights activist Fouad Abdelmoumni was covertly filmed at home with his fiancée and the video circulated on WhatsApp.
“When I saw the videos of me and my partner in bed, the location and angle of the recording were clearly visible. It must have been the air-conditioning unit. I went to look but I didn’t find anything, so I deduced that they’d been able to easily install and remove it. The quality of the image and sound was very good, despite the fact it was dark, so the equipment must have been very sophisticated,” he said.
Safir confirmed Abdelmoumni’s testimony describing it as a “textbook case” of DGST’s surveil and clean-up operation designed to leave no trace.
The investigation was conducted as part of a collaboration with 14 media organizations coordinated by Forbidden Stories, and builds on the work of Moroccan investigative journalist Hicham Mansouri – himself a victim of Morocco’s surveillance machine and now exiled in France. In 2015, he was imprisoned under trumped-up charges of “adultery” and “sexual exploitation” after a trial which did not meet international standards. He told Amnesty International how surveillance leads to self-censorship.
“It’s very violent. A friend told me that, after years of this, the day he went into prison, it was a kind of relief,” said Mansouri
In October 2019, Amnesty International forensically documented the first Pegasus infection attempts in Morocco, targeting Abdessadak El Bouchattaoui, a human rights lawyer involved in defending Hirak El-Rif movement protesters. Pegasus Project records show that his phone number was entered into Morocco’s Pegasus system on 19 September 2017 and repeatedly selected for spyware targeting on multiple occasions, including on 23 October 2017, shortly before he received an SMS infection link. This confirms that Morocco’s Pegasus spyware operations were fully operational by October 2017.
Pegasus spyware evolution and use against human rights defenders and journalists
Based on analysis of legal documents, leaked surveillance records, open-source intelligence and Safir’s testimony, the report provides further evidence that from September 2017, the DGST began deploying and using Pegasus, with NSO Group staff conducting demonstrations or dry runs of the system during visits to Morocco. NSO Group develops the notorious and highly invasive Pegasus spyware.
Further evidence, drawn from previously unpublished internal NSO Group materials disclosed as part of a long-running US civil court case against the company initiated by WhatsApp and Meta, indicates that NSO staff conducted trainings and performed tests demonstrating new capabilities of their spyware product for the benefit of Moroccan authorities, a customer who NSO Group internally codenamed Morgen.
An analysis of all target phone numbers entered in the Moroccan Pegasus system between September and December 2017 by Amnesty International provides further evidence that human rights defenders and independent journalists were the DGST’s priority targets.
Amnesty International matched 103 Moroccan phone numbers to specific individuals selected as potential Pegasus targets. Sixty-five were identifiable as civil society members (including 34 human rights defenders, 22 journalists and media workers, five lawyers, and four academics), 25 were political representatives or officials, and five were diplomats or representatives of international organizations. The remaining eight included business people, religious figures and others whose identity or categorization was unclear.
“These records show the phone numbers of prominent human rights defenders and journalists were among the first to be entered into the Pegasus system, indicating that this was the priority purpose for which the DGST had acquired the highly invasive spyware system,
Donncha Ó Cearbhaill, Head of Amnesty International’s Security Lab.
“The report also evidences and forensically attributes numerous cases of Pegasus abuses to the DGST based on technical analysis of Pegasus attacks. Together, these findings provide strong evidence that Morocco was responsible for an extensive cross-border Pegasus surveillance campaign against critical journalists, activists, lawyers and politicians.”
Four weeks prior to publication of its report, Amnesty International wrote to Moroccan authorities but did not receive any response.
Prior to publication, Amnesty International wrote to the companies featured in the report with our key findings related to their operations.
Verint replied to stating that “Verint divested this line of business on Feb. 1, 2021. Media inquiries should be referred to Cognyte Software Ltd.”
Memento Labs stated that “We can confirm to you that there isn’t any active contract with any Morrocan Agency,” adding that “Memento Labs in the last years has dramatically changed the way of doing business and has already implemented an Internal Compliance program in order to carefully monitor Countries’ situations.”
Amnesty International did not receive a reply from any of the other companies.
For the purposes of our report, Amnesty International considers surveillance to be unlawful where it is conducted in violation of domestic laws and procedures governing the use of surveillance. Surveillance may also be unlawful even when undertaken in accordance with domestic legal procedures if it is used in ways that contravene international human rights law and standards.
Morocco’s surveillance practices and many of the tools it uses violate international human rights law and standards. Morocco must urgently cease the surveillance of human rights defenders and journalists lawfully exercising their human rights. Moroccan judicial authorities must ensure an independent and effective investigation into all reported cases of unlawful surveillance by the DGST.
States must stop the export of spyware, digital forensics tools, and other privacy-invasive technology to Morocco until there’s a system of human rights safeguards in place capable of preventing human rights abuses in practice.