Amnesty International's recent report provides substantial evidence that Morocco is ultimately responsible for an extensive cross-border surveillance campaign utilizing Pegasus software against critical journalists, activists, lawyers, and politicians from 2019 to 2021. This detailed investigation, spanning over a hundred pages, reveals how Moroccan intelligence agencies employed the Israeli-developed Pegasus software to spy on a wide array of individuals, including notable figures such as Margarita Robles and Fernando Grande-Marlaska.
Building on previously known information regarding the email account linakeller2203@gmail.com, which compromised the mobile devices of Spain's Interior Minister and Defense Minister, the organization has established that this email address is linked to the Moroccan surveillance apparatus. The same accounts associated with Morocco's Pegasus system, used previously against Moroccan activists abroad, were also employed to infiltrate the devices of high-ranking Spanish political officials during the diplomatic crisis with Morocco in May and June 2021.
Amnesty International has been investigating the use of Pegasus software by governments for several years. However, recent testimonies from sources who have worked within Moroccan intelligence, along with leaked internal records and materials from surveillance technology providers, have allowed the organization to point directly to the General Directorate for Territorial Surveillance (DGST), Morocco's internal intelligence service, as the primary operator of Pegasus in collaboration with NSO Group, the Israeli company responsible for the software. The state-owned telecommunications company Maroc Telecom also played a role in facilitating these infections within the territory.
The Moroccan Client
Furthermore, Amnesty International has reconstructed the complex operations of NSO Group, successfully identifying with high confidence the Moroccan operator of the software, referred to as "Morgan". The report indicates that the DGST of Morocco is the ultimate user of Pegasus. A legal dispute in the United States has shed light on the code names NSO assigns to its clients, including "Morgan," which, according to a report by Israeli newspaper Haaretz, is based on the first letter of the country’s name combined with a car manufacturer. This investigation leads to the conclusion that Morocco is indeed behind this codename, a finding corroborated by sources within the cyber-surveillance industry.
Additionally, during the initial phase of Pegasus installation and deployment in Morocco, the first "infected" phone numbers belonged to DGST agents, which Amnesty International has verified. The investigation concludes that these were "trials" to test the program’s effectiveness, a fact confirmed by the former Moroccan agent. According to this source, a secret service officer demonstrated Pegasus in situ in 2018, providing his phone number, which Amnesty International has confirmed was entered into Morocco's Pegasus system in May 2018. The organization emphasizes that the activities of NSO Group's Moroccan client align closely with the DGST's objectives since the program's inception in Morocco, targeting human rights defenders, independent journalists, Sahrawi activists, and political opponents.
The Infiltration of the Spanish Government
According to the information obtained, the Israeli company operating the software creates a "customized infrastructure" for each client. This unique client-specific allocation allows for the grouping and attribution of attacks: when the same infrastructure, such as an iCloud account, appears in multiple targets, those targets can be linked to the same Pegasus client. The forensic evidence collected by Amnesty International, along with findings from independent French authorities, show that many selected individuals, both within and outside of Morocco, were ultimately infected with Pegasus using a common set of iMessage accounts.
One of these accounts, linakeller2203@gmail.com, was used in 2021 against Sahrawi activist Claude Mangin and exiled Moroccan journalist Hicham Mansouri. This same address was identified in a Spanish court document as the Apple account used in the Pegasus attacks of 2021, which compromised the phones of Spain's Interior Minister and Defense Minister. These attacks occurred during the diplomatic crisis between Prime Minister Pedro Sánchez's government and Morocco, sparked by the humanitarian hosting of the Polisario Front leader, Brahim Ghali, in Spain. The report also notes that the phone of the Spanish Prime Minister was compromised with Pegasus during this period, although judicial documents do not specify the iMessage account used to infect his device.
As reported by elindependiente.com.
