The “Pegasus” spyware case has returned to the forefront of debate in France following the publication of new information and journalistic investigations regarding the use of the software to target French officials, journalists, opponents, and public figures. These developments come nearly five years after the initial revelations in 2021, when it emerged that phone numbers belonging to prominent French figures were present within data linked to potential targets of the spyware developed by the Israeli company NSO Group.
The new element in the file is the emergence of internal documents, testimonies, and additional information that are said to reinforce the hypothesis that Moroccan agencies used Pegasus in surveillance operations targeting individuals inside and outside France. However, a distinction must be made between the presence of a phone number on a list of potential targets and proof of an actual compromise. While the inclusion of a number may indicate interest in the owner or an attempt to target them, it does not on its own constitute conclusive technical evidence of a successful espionage operation. Proving an infiltration requires examining the phone and finding technical traces linked to the software.
Among the new elements presented are internal documents from NSO Group referring to a client with the code name “Morgan.” According to published investigations, this name referred to Morocco. These documents are of particular importance because they do not stem merely from the analysis of phone numbers or external testimonies, but from information related to how the company organized its relations with its clients. If this connection is definitively proven, it could represent a crucial element in identifying the entity that acquired and used the program.
Testimony also emerged from an individual presented as a former official in the Moroccan domestic intelligence service, using the pseudonym “Saphir.” According to published reports, this individual spoke about Morocco’s use of the Pegasus program since 2017, and its allocation to monitor targets deemed highly sensitive, including journalists, opponents, human rights activists, and foreign officials. He also described a broader surveillance system that does not rely on Pegasus alone, but includes other technical means of information gathering, alongside practices aimed at monitoring opponents and influencing their public image.
In France, the sensitivity of the file centers on the existence of numbers belonging to high-ranking political officials, including President Emmanuel Macron and several ministers and dignitaries. Since its appearance in 2021, this information has sparked grave concern within French state institutions, because targeting the President of the Republic or members of the government—even if the infiltration was unsuccessful—represents an issue pertaining to national security and the protection of official communications.
Some devices linked to officials and journalists underwent technical examinations, and in a number of cases, it was announced that indicators consistent with targeting or infiltration attempts using Pegasus were found. However, the results were not identical for all individuals, and the presence of a name or number in the leaked data does not necessarily mean the phone was compromised. Therefore, the investigation has continued to rely on combining technical evidence with victim testimonies and information regarding the operations of NSO Group and its clients.
The Pegasus program is one of the most sophisticated cyber-espionage tools. Upon successfully infecting a phone, it can access messages, photos, contacts, and stored files, as well as activate the microphone or camera and collect location data. In some cases, the attacker does not need the phone owner to click on a malicious link, as the software can exploit vulnerabilities that allow infiltration without any user interaction. This makes its detection difficult, especially when the vulnerabilities used are not yet known to phone manufacturers and operating system developers.
On the judicial front, the French investigation into complaints related to the case remains ongoing. This path aims to determine whether the phones of individuals on French territory were actually compromised, identify the entity that ordered or executed the surveillance operations, and ascertain the extent of the developing company’s responsibility. Investigators are also seeking to understand how Pegasus was sold, its terms of use, and the entities permitted to select targets.
The procedures included hearing from former officials or founders of NSO Group. However, obtaining precise information about clients and executed operations has remained complex due to commercial confidentiality, Israeli legal restrictions, and the security nature of the contracts. The company consistently asserts that it sells its technologies exclusively to governments and official agencies for the purpose of combating terrorism and serious crime, and that it does not select the targeted individuals itself. Nevertheless, human rights organizations, journalists, and security researchers state that the program has been used in multiple countries against individuals with no connection to terrorism or organized crime, such as journalists, lawyers, human rights defenders, and political opponents.
For its part, Morocco categorically denies the accusations leveled against it and rejects the claim that it purchased Pegasus or used it to spy on French officials, journalists, and opponents. Moroccan authorities have also challenged the methodology of the journalistic investigations, considering that the published conclusions do not offer definitive proof of their responsibility. Morocco has taken legal action against certain media outlets and individuals who linked its name to the case, stressing that the accusations harm the image of the state and its institutions.
One notable point that emerged in the context of the investigations is that French officials had discussed, at an earlier stage, the possibility of acquiring the Pegasus program or reviewing its capabilities. Information pointed to meetings held between representatives of the Israeli company and French officials during 2019 and 2020. However, France did not complete the purchase, and the decision was said to be linked to a reluctance to rely on a highly sensitive foreign surveillance tool, in addition to the security, political, and legal risks that could result from its use.
This aspect reveals the complexity of states’ positions regarding advanced spyware. On one hand, security agencies see these tools as capable of helping track terrorist networks, criminal groups, and individuals using encrypted applications. On the other hand, the absence of strict oversight leads to the possibility of turning them into means for monitoring journalists, opponents, and foreign officials. Consequently, the debate is not limited to the identity of the states that used the program, but also encompasses the responsibility of the manufacturing companies and the states that permit the export of such technologies.
Politically, the case remains highly sensitive due to relations between France and Morocco. Relations between the two countries have passed through periods of tension before subsequently witnessing attempts at rapprochement. Observers believe that diplomatic, security, and economic interests render the political handling of the Pegasus file more complex. France considers Morocco an important partner in files related to counter-terrorism, migration, economic cooperation, and issues concerning North Africa and the Sahel region, while Rabat refuses to accept accusations it views as unproven and harmful to its sovereignty and institutions.
Nevertheless, the improvement of political relations does not necessarily mean the closure of the judicial track. The investigations handled by the judicial authorities are supposed to continue independently of diplomatic calculations. The fundamental question remains whether sufficient technical and legal evidence can be gathered to allow for an unquestionable determination of responsibilities—a task made difficult by the complexity of the software, the possibility of erasing its traces, and the refusal of certain parties to disclose information regarding their clients.
The Pegasus case transcends the dispute between France and Morocco, as it raises a broader problem regarding the limits of digital surveillance in the world. Technologies that were in the past the exclusive preserve of a limited number of intelligence agencies are now being sold as commercial products to various countries. This development has led to the emergence of an international market for hacking software, through which governments can purchase capabilities that allow access to the most sensitive personal devices.
For this reason, human rights organizations and digital security experts are calling for the imposition of stricter international rules on the sale, export, and use of spyware. Proposals include subjecting deals to independent oversight, establishing clear criteria for target selection, and prohibiting the use of the software against journalists, lawyers, activists, and political officials outside legitimate criminal investigations, in addition to providing effective means for victims to seek justice and obtain redress.
At the current stage, it cannot be said that the case has been judicially resolved. There are journalistic investigations, technical evidence, and new testimonies that reinforce certain accusations, but there are, conversely, official denials and objections to the way the data is interpreted. Therefore, it remains necessary to separate proven facts from accusations that are still under investigation. What is certain is that the file has not been closed, and that the new information has renewed pressure on the French authorities and on NSO Group, while re-raising questions about whether diplomatic considerations have influenced the political handling of the case.
In the end, the Pegasus case has become a test of the ability of democratic systems to protect officials, journalists, and citizens from illegal surveillance. It has also become a test of the judiciary’s capacity to deal with cross-border digital crimes involving private companies, states, and intelligence agencies, surrounded by high levels of secrecy. What the French investigation reveals in the future will not only affect relations between Paris and Rabat, but may also contribute to defining the rules that will regulate the spyware industry and its use in the coming years.
