The report, titled “We Start With the Verdict: Inside Morocco’s Surveillance Machine,” was produced with 14 media organisations and coordinated by the Forbidden Stories network. It draws on interviews with a whistleblower using the pseudonym Safir, a former employee of the DGST. Amnesty said it corroborated key parts of Safir’s testimony with independent sources, technical evidence, and interviews with 10 people identified as surveillance targets.
Among the four cases detailed are Omar Radi, a journalist and human rights defender now based in Germany; Fouad Abdelmoumni, a veteran activist; Abdessadak El Bouchattaoui, a human rights lawyer; and Hicham Mansouri, a journalist in exile who had been imprisoned on charges Amnesty describes as trumped-up.
Radi told Al Jazeera he had noticed signs of surveillance between 2018 and 2020, including his phone’s battery draining quickly, its temperature rising, and the network slowing down. He also described physical surveillance that was barely discreet. “They came every day to get a daily report from the parking attendants in my street, the shops I used to go to, and my friends,” he said.
Amnesty identifies the DGST as the agency behind the deployment of Pegasus in Morocco and documents what it describes as abuses of the spyware against activists and journalists between 2017 and 2021. The report says Morocco’s Pegasus operations were fully active by October 2017, pointing to the case of El Bouchattaoui, whose number was entered into the system in September 2017 and selected for targeting weeks before he received an infection link by text message. Amnesty said its analysis of Pegasus records matched 103 Moroccan phone numbers to individuals identified as potential targets between September and December 2017, of whom 65 were identifiable as civil society members.
Morocco has previously rejected Amnesty’s allegations. In statements issued in 2020 and 2022, Moroccan authorities challenged Amnesty to provide material evidence. Amnesty said it wrote to Moroccan authorities four weeks before publishing its latest report and invited them to respond but received no response. Al Jazeera also sought comment from Moroccan officials and had not received a response at the time of publication.
Moroccan media outlet Le360 challenged the latest report, arguing that the presence of a phone number in Pegasus targeting records does not, by itself, prove that a device was infected or establish who ordered an alleged attack. The outlet also argued that Amnesty had not provided the conclusive technical and material evidence Moroccan authorities had demanded.