Would you prefer to access this content in video form? Watch James explain it on LinkedIn. To learn more, head over to VIRO, the new on-demand education platform from Virtual Routes.
Morocco and many other authoritarian states use spyware for repression, with severe consequences for dissidents, political activists, and pretty much anyone on the wrong side of the regime. This much we already knew.
Setting aside the revelation that some intelligence services test spyware on their own phones, here are three broader lessons from the recent Forbidden Stories investigation into Morocco’s purchase and use of the infamous NSO Group spyware Pegasus.
Spyware is still just one tool of many
The investigation reports that Morocco’s domestic intelligence agency, DGST, placed listening devices in targets’ houses and vehicles, planted pre-infected phones in local shops to be sold to selected individuals, arrested targets so they could access their cell phone data, and followed targets – and their mothers, friends, and even cigarette vendors – around.
The wide range of methods uncovered, on top of the many more presumably available, makes a former Moroccan intelligence official’s assertion that ‘we turned to Pegasus after exhausting all other surveillance methods’ more revealing.
It shows some degree of reluctance to use sophisticated spyware, likely because of the expense, but also the value spyware offers, providing an almost unparalleled view into targets’ daily lives.
As I have argued in an ongoing Virtual Routes project on commercial cyber proliferation, the logic behind states’ choice and combination of ‘varying vectors’ for digital espionage is often forgotten.
Spyware prices are a mystery
Spyware prices are nearly as opaque as the World Cup’s dynamic pricing system. The Forbidden Stories investigation reviewed an earlier French government investigation into Pegasus abuses, including an interview with an NSO Group reseller based in France.
This reseller claimed that NSO Group quoted France €60-80 million ($68-91 million) for the complete package, with a €50,000-65,000 ($57,000-74,000) commission for the reseller himself – not bad! The Forbidden Stories team also uncovered documentation of a contract signed between NSO Group and the Government of Panama back in 2012, with a price of $8 million.
But how do these compare worldwide? Data on Pegasus from the last fifteen years shows that countries have paid between $5 million and $50 million for the privilege. Mexico is the likely standout, with reported payment sums ranging from $61 million to a staggering $300 million.
However, these prices are really comparing apples and oranges. Set-up costs versus fixed annual costs, the number of users, the number of targets, the make and model of phones, and infection vector can all influence pricing.
There are only a couple things you can reliably say about spyware prices in government markets.
First, while they might seem expensive at face value, they’re often actually relatively cheap in the security budget context – France and Saudi Arabia, for example, budgeted €61.8 billion ($70.4 billion) and $78 billion respectively for defense in 2025. States spend far more money on less tangible defence and security products. Clearly, these spyware prices are low enough to maintain high demand, while high enough that governments are open to new providers.
Second, the ‘as-a-service’ model ties governments into continuing usage – and providers into continuing income, with this stickiness encouraging companies not to act on abuses unless absolutely necessary. Being overly particular about how exactly companies use their products would not be good for business (though it might improve employee morale).
Transnational security alliances are key to spyware procurement
Governments rely on transnational security alliances to procure spyware products. The most famous of these alliances is Five Eyes, but in the MENA region, the UAE has become a centre of gravity for defence and intelligence exports.
In 2017, Morocco and Israel didn’t even have formal diplomatic relations, but that didn’t stop Morocco from buying spyware from Israeli NSO Group – facilitated by a Moroccan branch of an Emirati company, Al Fahad Smart Systems, which is ultimately owned by the Emirati state. Notably, the same chain had earlier helped DGST acquire the Italian RCS spyware.
This group would be far from the only triple alliance in spyware; the France/Egypt/UAE relationship comes to mind for Nexa Technologies. As Bassant Hassib and I have argued, spyware acts as diplomatic lubricant; it builds relationships between security officials who then can trust each other to overcome previously intractable divides. Note that all of this happened before the Abraham Accords.
Finally, there are some intriguing resonances around the UAE company reselling Pegasus to Morocco, Al Fahad. Al Fahad had previously come up in a similar context, as a reseller for Hacking Team’s earlier (and less sophisticated) spyware to Morocco.
However, the same name also appeared in supposedly leaked documents published by Qatar-based newspaper Al Araby. These documents surfaced as part of a lawsuit against NSO Group, centred on the use of Pegasus by the Saudi Arabian government. The documents – unverified and of uncertain credibility – describe Al Fahad as a UAE government ‘project’ for phone hacking and reference NSO Group links. Is this the same organisation? Is it even real? Hard to tell…
Disclaimer: The Moroccan government denies using spyware, NSO Group denies pretty much everything, and other parties mentioned did not comment to the Forbidden Stories investigators.
