InvestigationThe Israeli company and the Moroccan government have published, since July 18, a series of press releases questioning the revelations of Forbidden Stories and “Le Monde”.
Morocco denies being a client of NSO Group. In its response to a first series of specific questions, relating to its use of the Pegasus spyware marketed by the Israeli company NSO Group, the Moroccan embassy in France responded to Forbidden Stories on July 17, “Do not understand the context of [cette] referral “, and affirmed that Amnesty International “Was unable to prove any relationship between Morocco and [NSO] “. This July 19, in a press release published by the official MAP press agency, Morocco claims to have “Never acquired computer software to infiltrate communication devices, just as the Moroccan authorities have never had recourse to this kind of act”.
- The same signature on several phones
The “Pegasus Project” has accumulated multiple elements, both technical and concerning the identity of the targets, which clearly show that Morocco is a client of NSO and operates electronic surveillance through Pegasus. Many victims of spyware have also had trouble with Moroccan intelligence, including activists supporting the independence of Western Sahara or journalists. In addition, the Citizen Lab at the University of Toronto, one of the world’s leading spyware research centers, had, as early as 2018, identified Morocco as a very likely NSO client, based on an analysis of the infrastructure used by the spyware. More recent analyzes from the same Citizen Lab confirmed that the Moroccan client of NSO group had been active in France since 2018 and until this year.
Amnesty International’s Security Lab has found traces of Pegasus, bearing the distinctive technical signature of the same client, on the phones used by journalist Edwy Plenel or former Minister François de Rugy, as well as on the phones of the activist Claude Mangin and Moroccan journalist Omar Radi – two people who are of great interest to the Moroccan intelligence services.
- Public “material evidence”
In a press release published on July 20, the Kingdom of Morocco “Challenges the peddlers of false and unfounded allegations, including Amnesty International and the Forbidden Stories consortium, as well as their supporters and proteges, to provide any tangible and material evidence, in support of their surrealist accounts”.
The physical evidence is all public: it has been put online this Sunday by Amnesty International’s Security Lab. The methodology of this report was independently validated by the Citizen Lab in Toronto. No element calling into question any part of the report, the seriousness of which has been unanimously hailed in the IT security community, has been reported to date.
- Concurring analyzes
NSO Group disputes, to a large extent, the information published by the various media partners within the “Pegasus Project”. In particular, the company denies a crucial point: it claims that the data analyzed by the consortium, a list of more than 50,000 phone numbers, has nothing to do with the Pegasus system and does not represent “targets” .
Analysis of multiple phones in this list shows, as consortium media has written all along, that it contains both numbers that have been infected, numbers that have been targeted, and numbers that have not ‘weren’t targeted by Pegasus. More than half of the phones tested by Amnesty International’s Security Lab had either been infected or had traces of spyware – an extremely strong coincidence that this list had nothing to do with NSO and its tool.
NSO also claims to have no access to the numbers targeted by its customers, but has denied, in recent days, that they have been able to target personalities such as Emmanuel Macron, the King of Morocco, Mohammed VI, or the entrepreneur Pavel Durov. . According to the consortium’s information, when NSO conducts ex post facto surveys, it is the clients who provide it with their targeting data; they can easily refuse or alter the data before transmitting it to NSO. The company denied that the entourage of murdered journalist Jamal Khashoggi could have been targeted by its spyware. Analyzes of the phones of several of his relatives show unequivocally that they were indeed infected with Pegasus.
On July 21, NSO released a new press release, titled “Enough”. The company explains that “Faced with the very well orchestrated media campaign, led by Forbidden Stories and pushed by interest groups, and their total lack of respect for the facts, NSO announces that it will no longer answer questions on this subject and will not participate not to this vicious smear campaign ”.
Also listen Pegasus: at the heart of a global investigation into phone spying