The investigation conducted by Amnesty International, the Radi, a Rabat-based investigative journalist, has been the target three times and spied on after their phone has been infected by a ONS of the tool. The mechanism which may have been used to target Radi, a so-called “network injection attack”, can be deployed without the victim into clicking on an infected link and is believed to have been used against a Moroccan journalist.
ONS does not publish a list of its government customers, but a previous survey conducted by researchers from Citizen Lab has identified Morocco as one of the 45 countries where the company of spyware has been active.
The Guardian is the publication of this report, in coordination with Forbidden Stories, a collaborative network of journalism which highlights the work of journalists who are threatened, imprisoned or killed.
Amnesty said the timing of the alleged attacks in Morocco indicated that they occurred after the NSO has published a new human rights in September 2019, and after that the company became aware of a previous Amnesty report that detailed other alleged illegal hacking attacks in Morocco, which has used the technology of the company.
According to the terms of the human rights policy, the NSO has promised to investigate the well-founded report detailing the abuse of the technology by its customers, and the customer’s access to its technology would be terminated, if necessary, if the company has found that its technology has been abused.
“ONS has serious questions to answer for the actions he has taken when they are presented with evidence of the technology has been used to commit violations of human rights in Morocco,” said Danna Ingleton, the deputy director of Amnesty Tech.
NSO said in a press release that he was “deeply disturbed” by a letter he received from the Amnesty, which contained the allegations.
“We are reviewing the information contained in them and open an investigation if the situation warrants,” the company said. “In line with our human rights policy, NSO Group take seriously our responsibility to respect human rights. We are committed to avoid causing, contributing to, or directly related to impacts on the rights of man.”
In response to questions about his relationship with the Moroccan authorities, the ONS has stated that it “seeks to be as transparent as possible”, but it is obliged to comply with “the state of privacy concerns and not to disclose the identity of its clients.
A spokesman added that the ONS had taken “investigation steps” following publication of a first report published by Amnesty alleged other Moroccans had been hacked with the help of Pegasus, but that he could not provide more details due to confidentiality constraints.
The Moroccan authorities did not respond to requests for comment.
The new claims are like ONS fighting a lawsuit brought against it by WhatsApp, the messaging app owned by Facebook, who claims that Pegasus has been used to target 1400 users on a two-week period last year. ONS denies the allegations and has said that his government clients were ultimately responsible for how his technology is used.
At the centre of the latter is Radi, a journalist who has been targeted as part of a broad campaign by the Moroccan authorities to stifle dissent, Amnesty said.
Radi is a freelance investigative journalist who writes mainly for The Office and is a member of the ICIJ journalism consortium. It covers issues of human rights, social movements and land rights, a problem Radi says is plagued with corruption.
An Amnesty report earlier this year, the Moroccan authorities have intensified their repression “pacific voices” with more arbitrary arrests of people who have been targeted for criticising the king or other officials.
In one case, earlier this year, Radi said, he asked the villagers for a story, but was later prevented from publishing their accounts, after they called him and pleaded with him to remove their interviews because they had been harassed by the police after his visit.
As a journalist, Radi said he had lived with the suspicion that he was under regular surveillance since 2011, after it became known that Morocco has been the acquisition of spyware technology from a variety of sources.
Technology experts from Amnesty, which investigated Radi phone in February that he had been subjected to various attacks between September 2019 and January 2020, when Radi was “repeatedly harassed” by the Moroccan authorities.
It has in the past faced interrogation and detention in solitary confinement. He has received a suspended four-month prison term in March for a tweet he posted in April 2019 in which he had denounced the trial of a group of activists.
Radi, said Amnesty had contacted him after his December 2019 arrest and told him that he thought he was a possible target for surveillance.
Radi, said the discovery that it had been hacked raised questions in his mind. “What could I have said on the phone that was sensitive? Or do I need the sources which could be in trouble if the people listening to me to find who I’m talking about?”
Amnesty said legal data extracted from Radi phone indicated that he had been subjected to network attacks by injection in September and in February 2019 and January 2020. Amnesty has said that he believed that the attacks were used to infect Radi mobile phone with Pegasus in a way that was not necessary to click on the infected links.
Network injection attacks allow hackers to redirect a target browser and applications to malicious websites that are under the control of an attacker, and then install spyware to infect the target device. Amnesty said Radi the phone has been directed to the same malicious web sites Amnesty found in an attack against Moroccan activist and academic Maati Monjib, including Amnesty detailed in a previous report.In both cases, the injections occurred while the target – Radi and Monjib – have been using a LTE/4G connection. One way of spyware companies can execute these infections require the use of what Amnesty has called a “rogue” cell of the tower: a portable device that mimics a legitimate cell phone towers, and, when it is placed in close physical proximity to a target, allows attackers to manipulate the interception of the mobile traffic.
Last year, the Guardian reported that two other Moroccans have been targeted with the help of the NSO of the technology, including Aboubakr Jamai, an activist and former journalist who lives in France.
Jamaï, who has been invited to respond to the latest news, said that with the morocco goals were clearly seen as a threat to the Moroccan regime.
“In a sense, I’m almost glad they’ve done it and that it has been made public, because it lifts the veil on the true nature of this regime, who has been out with a bunch of things because … this is not as violently repressive as the Syrian regime or even the Egyptian regime. But it is still an authoritarian regime,” he said.
Do you have a tip? Please send an email to [email protected]